The Last Frontier to Protect OT Environments
By Terence Liu, CEO, TXOne Networks
OT Zero Trust – a Device-Centric Methodology
In the IT world, the heart of Zero Trust is continuous verification, ensuring that every point of entry between connected services is from an authorized identity, at the proper time, from the expected source, through registered devices. This is a very human-centric and contextual process. Due to a high level of interaction between people through various services, any compromised personnel can pose threats to the entire organization.
In the OT world, devices and equipment are seldom bound to specific personnel. Despite its similarities in damage propagation to the IT world, OT countermeasures are totally different. Here at TXOne Networks, we advocate OT Zero Trust methodology, which is also a process of continuous verification. However, it is a device-centric, rather than people-centric, approach that covers all stages in the asset lifecycle. Every piece of equipment should be inspected before being sent to the production line, and all equipment should be continuously monitored and protected while in the process of manufacturing. IT people can easily sacrifice a portion of service availability for a boost in security during a given period. But OT people need to do it the other way around because, in OT environments, system availability is king.
OT Zero Trust methodology is a framework wherein every asset is covered by at least one security countermeasure during its entire lifecycle. An asset’s lifecycle includes pre-service inspection, endpoint protection, and network defense.
The Practicalities of OT Zero Trust Methodology
In our field experience, the No.1 hurdle for OT security managers hasn’t been budgetary limitations, nor their professional knowledge of cybersecurity that prevents them from pursuing a higher level of security. It’s a lack of manpower.
Imagine a factory plant with thousands of devices scattered over tens of acres, managed only by two professional OT security managers. That should paint a clear picture of why fancy IT security features are not the solution.
Only when OT Zero Trust is applied to practical security implementations will it make sense. Avoid bringing up more questions while trying to answer one. Pinpoint the exact path for the user to follow instead. The answer does not lie within the slight differences of detection rates among ill-suited solutions, but in an environment tailor-made to address OT-specific security requirements and conditions.
A Higher Call for OT Zero Trust – The Last Frontier of Defense
In our recent survey from 300 C-level executives or directors in charge of OT security, 94% of them experienced OT incidents that originated from IT. We see a clear trend that more and more ransomware-based outbreaks in OT are targeted attacks. If hackers can break through layered IT security defenses and retrieve all credentials to drop/spread ransomware in the OT space, deploying the same solutions in OT is not likely to help intercept malicious acts. The only solution is extensive OT security awareness – a contextual, situational awareness involving deep insight of OT activities.
In addition to examining the level of security with OT-specific signature intelligence, the Extended OT Zero Trust also reacts to items based on insights into the day-to-day operation norms in OT. For example, an Extended OT Zero Trust can confidently trigger the alarm when it sees a commonplace command over common protocols if the operation context never involved such protocols before.
This contextual awareness goes beyond traditional security approaches and requires a great deal of industrial insights and technologies such as AI; achieving this level of awareness is the ultimate goal of OT Zero Trust. Never trust. Always verify – and verify with industrial context.
To sum up, OT Zero Trust is a new but significant security paradigm that we need to shift into. We’re eager to see it realize its potential and thrilled to be among its first pioneers.
About the Author
Dr. Terence Liu leads TXOne Networks, a cybersecurity company focusing on protecting OT and ICS with unique OT Zero Trust approach. Especially, TXOne’s comprehensive solutions protect the mission-critical assets including the services and applications within as well as their network communication. The protection starts right after the onboarding of the assets, and throughout the staging, production, all the way to the maintenance phases, back and forth. Today TXOne has thousands of satisfied enterprise customers in a variety of verticals.
TXOne Networks official site http://www.txone.com/