Mitigating real-time cyber risk with a cohesive IT/OT SOC

Guest blog by Jules Farrow-Lesnianski, OT Director at Sapphire #techUKOTSecurity

Operational Technology

OT underpins much of our critical national infrastructure (CNI) across water, energy, transportation and logistics, aerospace and defence, food and beverage, chemicals and pharmaceutical sectors. You will also find elements of OT supporting all modern enterprises, from IoT within data centres to physical security systems, CCTV, HVAC, elevators and escalators within office spaces.

Generally, OT suffers from multiple cyber security issues, including a high prevalence of legacy systems (with average lifecycles measured in decades), often insecure-by-design systems that prioritise availability with limited resources, many of which have significant potential consequences if they were to fail – with many industrial organisations facing both significant financial losses and potential safety implications.

Threat

The threat to our CNI continues to rise, with the number of cyber incidents and their impact increasing year-on-year. Industrial organisations continue to be a high-value target for attackers due to the relative ease of disruption, leading to interest from nation-state-aligned groups and those using ransomware to demand higher ransoms. The manufacturing sector continues to top lists of those experiencing the most attacks, paying the highest cyber insurance premiums, claiming the most on their policies, and experiencing the highest recovery costs.

Why Now?

Industry 4.0 has seen the digital transformation of our industries, enabling real-time decision-making and higher levels of productivity, flexibility, and agility. Unfortunately, this came at the cost of eroding the only level of cyber protection these systems often had – airgaps. The convergence of IT and OT environments has significantly increased the threat to our industrial environments without introducing risk mitigations. This has led to the increase in cyber incidents and cyber insurance costs we are now experiencing, increasing levels of government regulation to tackle the issue. These factors drive board-level engagement with cyber security, with many industrial organisations now acknowledging operational cyber risk as one of their top priorities across their entire business.

The OT Security Journey

Industry analysts Gartner estimate that 60% of organisations are at the very beginning of their OT cyber security journey, whilst we observe that many OT cyber solutions available today are complex to deploy and gain their intended benefits for those at an early stage of maturity. Sapphire’s OT cyber services cover everything you need from the ground-up – identifying your OT assets, vulnerabilities and mapping your complex networks regardless of common constraints like legacy technologies, geographical distribution and safety-critical 24/7 operations. Once you have the insight required to identify your OT cyber risks, we can advise on the best strategy for your organisation, ensuring prioritised mitigation of your most critical operational risks and calculated return on investment for your selected mitigation solutions.

IT/OT SOC

As your IT and OT environments converge ever closer and the lines between them blur, you need to ensure your SOC can provide adequate cover across your entire IT/OT estate. To gain in-depth visibility, OT-specific cyber solutions should work around the specialist requirements and constraints standard in operational networks, ensuring a single-pane-of glass view of an organisation’s entire environment. It is vital that SOC analysts are trained in OT cyber incident management to identify and triage incidents in real-time, while being mindful of the differing priorities of confidentiality, integrity and availability across the IT/OT divide. With OT-utilising organisations experiencing numerous OT cyber incidents a year, IT/OT SOCs will significantly reduce the potential impact and recovery time on your critical infrastructure.

Cyber Security Programme

The Cyber Security Programme provides a channel for our industry to engage with commercial and government partners to support growth in this vital sector, which underpins and enables all organisations. The programme brings together industry and government to overcome the joint challenges the sector faces and to pursue key opportunities to ensure the UK remains a leading cyber nation, including on issues such as the developing threat, bridging the skills gap and secure-by-design.

Learn more