What is operational technology (OT)?
Operational technology (OT) keeps critical infrastructure and industrial environments functioning. OT is made up of software and hardware used to manage, secure and control industrial control systems (ICS) systems, devices and processes in your OT environment. OT devices are commonly found in manufacturing, transportation, oil and gas, electricity and utilities and other similar industries.
What’s an OT device?
OT devices are devices used in industrial environments as well as within critical infrastructure. For example, you may see OT devices in a manufacturing setting, such as the pharmaceutical industry or for vehicle manufacturing, or in industrial settings, like oil production.
Here are a few examples of OT devices:
- Programmable logic controllers (PLCs)
- Remote terminal units (RTUs)
- Industrial control systems (ICS)
- Distributed control systems (DCS)
- Human machine interfaces (HMIs)
- Supervisory control and data acquisition system (SCADA)
- Internet of things (IoT) devices
- Industrial internet of things (IIoT) devices, also known as Industry 4.0
OT devices are generally controlled by either distributed control systems (DCS) or programmable logic controllers (PLCs). During the more than seven decades of existence, most OT devices were protected by air-gapping — physical isolation of the device from external networks. By not connecting these devices to outside networks, the goal was to keep them safe from external risks.
That worked well for decades, but today, more industrial environments are experiencing a convergence of both IT and OT. That means there are new risks and air-gapping is no longer effective. Modern industrial and critical infrastructure environments need operational technology security that can protect both IT and OT simultaneously.
What is operational technology security?
Operational technology security consists of the processes to protect all of the hardware, software and devices within your OT infrastructure. OT security encompasses all of the steps you take to manage and monitor these devices from attacks (both internal and external) as well as other cyber risks.
During early emergence of OT devices in the 1960s through recent times, OT devices were generally closed systems — meaning they were off network and didn’t communicate with other on-network devices. This is called air-gapping because the devices were physically separated from the unsecured networks. That was the primary mode of OT security for many decades.
But today, more OT devices are coming online and even in operations where they’re not, it’s getting increasingly challenging to maintain truly sterile OT environments. Even in facilities where convergence is not a strategic imperative, there’s a chance OT devices may (accidentally) connect with devices that are (or have been) online. Whether it’s intentional or accidental, IT and OT are increasingly more converged within industrial environments. That means air-gaps are no longer sufficient for true OT security.
Modern OT environments need more comprehensive operational security. For industrial control systems, for example, if you’re just using network monitoring to discover vulnerabilities or other security issues, you’re probably only seeing about 50% of your converged IT-OT attack surface. And, the more infrequently you’re checking those devices for issues, the longer you have for a threat actor to be present in your environment for weeks — maybe even months — before you know they’re there.
Your OT security should include continuous, passive and active monitoring, IT/OT threat detection, detailed asset inventory, configuration control and risk-based vulnerability management. Used in combination, these measures help keep a pulse on your OT environment cyber risks without disrupting day-to-day operations.
How can I actively monitor my OT devices without disruptions or downtime?
With the right tools, you can continuously monitor your OT devices without disruptions.
OT device-based security is an important part of comprehensive OT security, but unfortunately some organizations are hesitant to actively monitor or patch these devices. Why? Because traditional methods have often meant disruptions and downtime. Or, worse yet, what happens if you install a patch and one of the primary pieces of equipment you use goes down and can’t function? It could be a death-knell for business.
That’s where Tenable OT Security's active device querying comes in.
Tenable’s active querying is patented and communicates with your OT devices, such as PLCs, HMIs and DCSs, in their native language. That means you can get detailed information about your device — down to a granular level — with disrupting operations.
Tenable OT Security conducts read-only queries of your devices using native communication protocols and can’t make changes to your devices. This allows you to gather deep details about each of your assets safely and without disruption. Tenable’s active querying will not impact your controllers.
Once you’ve discovered all devices within your network, including dormant assets, you can classify each asset and then take a deep dive into device information.
Tenable’s active querying gives you insight into:
- Configuration information
- Hotfix insight
- Firmware versions
- User information
- Back plane information
- Others security issues
If Tenable OT Security detects an issue, you can set it to send an alert to the relevant responder on your team.
By understanding the full context of everything on your network, including device level information, you get a more comprehensive look into your OT infrastructure so you know where you have risks so you can make plans to remediate the most critical issues first.
Active querying also eliminates blind spots caused by passive network monitoring alone. How? With device querying, you can get non-disruptive, detailed device information even if a device is dormant or infrequently connects to your network. That means you know when any change that happens, even those changes that occur directly on a device, so you can respond swiftly and effectively.
How are information technology (IT) and OT different?
There are differences between IT and OT. First, let’s look at information technology (IT) and what it is.
Information technology is used to process, manage, store and protect information in what is generally a stable environment. The focus in IT is on security. IT has a short lifecycle and standard operating systems that require frequent updates.
Now, let’s explore operational technology a little more in comparison. OT is used to monitor, manage and control physical devices and related processes. Unlike IT, OT devices can be in adverse situations where the core focus is on uptime. Also different from IT, OT generally has a long lifecycle. Updates, which can cause disruptions, are infrequent, and many OT devices have proprietary operating systems, not the standard, more common ones often seen in IT.
A simple way to consider some of the key differences between the two is: IT is about data and OT is about processes.
Historically, IT and OT devices have been separated from one another in most environments. However, today, IT and OT are converging faster than ever before. This interconnectivity creates new attack surfaces. Security measures traditionally used for each independently often don’t work well for this converged environment. Instead, you need new security measures and combinations to protect both as they exist together.
What is IT-OT convergence?
IT-OT convergence happens when IT and OT devices connect or interact with one another within the same environment. This can happen intentionally, for example, when your OT device is connected to an outside network, or accidentally when someone connects a laptop (that has been connected to an outside network) to your OT device for updates.
For decades, to protect OT devices, most organizations kept them physically separated from outside networks, which is known as an air-gap. But, the increasing number of benefits for connected OT devices is moving many organizations away from that practice. For example, a converged IT/OT environment can help you get the most out of your production processes and promote sustainability, but unfortunately those benefits also bring increased cyber risks.
This convergence also creates new challenges for security professionals. Threats to OT devices are different from those for IT, and finding and remediating them is harder. While threats that begin in your IT environment can move laterally over to your OT environment, security is further complicated because many traditional IT professionals are not familiar with the complexities of OT devices. Add to that expanding attack surfaces and more potential attack points for bad actors. The result? Increasing opportunities for your OT environment to come under attack.
A converged IT-OT environment requires enhanced visibility for complete security including passive network detection and active device querying, detailed inventory of all of your assets and real-time data about all your assets and threats. Without this, you’ll have blind spots that continually put your organization at risk.
Teknolojia ya uendeshaji (OT) ni nini? Teknolojia ya uendeshaji (OT) inahifadhi miundombinu muhimu na mazingira ya viwanda kufanya kazi. ICS ni mfumo wa programu na vifaa vinavyotumiwa kusimamia, kulinda na kudhibiti mifumo ya udhibiti wa viwanda (ICS), vifaa na michakato katika mazingira yako ya OT. Vifaa vya OT hupatikana kwa kawaida katika viwanda, usafirishaji, mafuta na gesi, umeme na huduma na viwanda vingine vinavyofanana. Kifaa cha OT ni nini? Vifaa vya OT ni vifaa vinavyotumiwa katika mazingira ya viwanda na pia ndani ya miundombinu muhimu. Kwa mfano, unaweza kuona vifaa vya OT katika mazingira ya utengenezaji, kama vile sekta ya dawa au kwa ajili ya utengenezaji wa magari, au katika mazingira ya viwanda, kama vile uzalishaji wa mafuta. Vifaa vya OT (viunganishi vya vifaa vya OT) - Vifaa vya Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi wa Usimamizi. Wakati wa zaidi ya miongo saba ya kuwepo, vifaa vingi vya OT vililindwa na hewa-gapping <unk> kutengwa kimwili kwa kifaa kutoka kwa mitandao ya nje. Kwa kutounganisha vifaa hivi kwa mitandao ya nje, lengo lilikuwa kuwalinda kutokana na hatari za nje. Hii ilifanya kazi kwa miaka mingi, lakini leo, mazingira ya viwanda yanaonekana kuwa na mabadiliko ya teknolojia na teknolojia. Hiyo inamaanisha kuna hatari mpya na hewa-gapping ni tena ufanisi. Mazingira ya kisasa ya viwanda na muhimu ya miundombinu yanahitaji usalama wa teknolojia ya uendeshaji ambayo inaweza kulinda wote IT na OT kwa wakati mmoja. Usalama wa Teknolojia ya Uendeshaji ni nini? Usalama wa Teknolojia ya Uendeshaji ni mchakato wa kulinda vifaa vyote, programu na vifaa ndani ya miundombinu yako ya OT. Usalama wa OT ni hatua zote unazochukua kusimamia na kufuatilia vifaa hivi kutoka kwa mashambulizi (ya ndani na ya nje) na pia hatari nyingine za mtandao. Wakati wa kuibuka mapema kwa vifaa vya OT katika miaka ya 1960 hadi nyakati za hivi karibuni, vifaa vya OT kwa ujumla vilikuwa mifumo iliyofungwa - ikimaanisha walikuwa nje ya mtandao na hawakuwasiliana na vifaa vingine kwenye mtandao. Hii inaitwa hewa-gapping kwa sababu vifaa walikuwa kimwili kutengwa kutoka mitandao unsecured. Hiyo ilikuwa njia ya msingi ya usalama wa OT kwa miongo mingi. Lakini leo, vifaa zaidi vya OT vinakuja mtandaoni na hata katika shughuli ambazo hazipo, inakuwa changamoto zaidi na zaidi kudumisha mazingira ya kweli ya OT. Hata katika vifaa ambapo convergence si kipaumbele kimkakati, kuna nafasi ya vifaa OT inaweza (by accident) kuunganisha na vifaa ambayo ni (au wamekuwa) online. Kama ni makusudi au ajali, IT na OT ni zaidi na zaidi converged ndani ya mazingira ya viwanda. Hiyo ina maana hewa-mapengo ni tena ya kutosha kwa ajili ya kweli OT usalama. Mazingira ya kisasa ya OT yanahitaji usalama wa uendeshaji wa kina zaidi. Kwa mifumo ya udhibiti wa viwanda, kwa mfano, ikiwa unatumia tu ufuatiliaji wa mtandao kugundua udhaifu au masuala mengine ya usalama, labda unaona tu karibu 50% ya uso wako wa shambulio la IT-OT. Na, mara chache zaidi wewe ni kuangalia vifaa hivyo kwa ajili ya masuala, muda mrefu zaidi una kwa ajili ya mwigizaji tishio kuwapo katika mazingira yako kwa wiki <unk> labda hata miezi <unk> kabla ya kujua wao ni huko. Usalama wa OT unapaswa kujumuisha ufuatiliaji wa kuendelea, wa moja kwa moja na wa kazi, kugundua tishio la IT, hesabu ya mali ya kina, udhibiti wa usanidi na usimamizi wa hatari ya hatari. Kwa kutumia pamoja, hatua hizi husaidia kuweka msukumo juu ya hatari za mtandao za mazingira yako ya OT bila kusumbua shughuli za kila siku. Jinsi gani naweza kikamilifu kufuatilia vifaa vyangu OT bila usumbufu au downtime? Kwa kutumia vifaa sahihi, unaweza kuendelea kufuatilia vifaa vyako vya OT bila usumbufu. Usalama wa vifaa vya OT ni sehemu muhimu ya usalama wa jumla wa OT, lakini kwa bahati mbaya mashirika mengine hayashawishi kufuatilia au kurekebisha vifaa hivi. Kwa nini? Kwa sababu mara nyingi mbinu za kitamaduni zimesababisha usumbufu na wakati wa kukosa kazi. Au, mbaya zaidi, nini kinatokea kama wewe kufunga patch na moja ya vipande vya msingi vya vifaa wewe kutumia huenda chini na hawezi kazi? Inaweza kuwa kifo-kono kwa ajili ya biashara. Hiyo ni ambapo Tenable OT Usalama ya hai kifaa querying inakuja katika. Tenable's Active Querying ni patented na anawasiliana na vifaa vyako OT, kama vile PLCs, HMIs na DCSs, katika lugha yao ya asili. Hiyo ina maana unaweza kupata habari ya kina kuhusu kifaa chako <unk> chini ya ngazi granular <unk> na kuvuruga shughuli. Tenable OT Usalama hufanya kusoma tu maswali ya vifaa vyako kutumia asili mawasiliano itifaki na hawezi kufanya mabadiliko ya vifaa vyako. Hii inakuwezesha kukusanya maelezo ya kina kuhusu kila moja ya mali yako kwa usalama na bila usumbufu. Tenable ya kuhoji hai si kuathiri controllers yako. Mara baada ya kugundua vifaa vyote ndani ya mtandao wako, ikiwa ni pamoja na mali dormant, unaweza kuainisha kila mali na kisha kuchukua kuzama kina katika habari ya kifaa. Tenable's active querying inakupa ufahamu wa: - Configuration information - Hotfix insight - Firmware versions - User information - Back plane information - Others security issues Kama Tenable OT Security inagundua tatizo, unaweza kuweka ili kutuma onyo kwa responder husika katika timu yako. Kwa kuelewa muktadha kamili wa kila kitu kwenye mtandao wako, ikiwa ni pamoja na habari ya kiwango cha kifaa, unapata mtazamo kamili zaidi wa miundombinu yako ya OT ili ujue ni wapi una hatari, na unaweza kufanya mipango ya kurekebisha masuala muhimu zaidi kwanza. Active querying pia huondoa blind spots unasababishwa na passively mtandao ufuatiliaji peke yake. Kwa njia gani? Kwa kutumia maswali ya kifaa, unaweza kupata habari ya kifaa isiyo ya kuvuruga, hata kama kifaa ni kimya au mara chache huunganisha kwenye mtandao wako. Hii inamaanisha kuwa unaweza kujua mabadiliko yoyote yanayotokea, hata yale yanayotokea moja kwa moja kwenye kifaa, ili uweze kujibu haraka na kwa ufanisi. Teknolojia ya habari (IT) na OT ni tofauti gani? Kuna tofauti kati ya IT na OT. Kwanza, hebu tuangalie teknolojia ya habari (IT) na ni nini. Teknolojia ya habari hutumiwa kusindika, kusimamia, kuhifadhi na kulinda habari katika kile ambacho kwa ujumla ni mazingira thabiti. Lengo la IT ni usalama. IT ina mzunguko mfupi wa maisha na mifumo ya uendeshaji ya kawaida ambayo inahitaji sasisho za mara kwa mara. Sasa, hebu kuchunguza teknolojia ya uendeshaji kidogo zaidi katika kulinganisha. Mfumo wa OT hutumiwa kufuatilia, kusimamia na kudhibiti vifaa vya kimwili na michakato inayohusiana. Tofauti na IT, vifaa vya OT vinaweza kuwa katika hali mbaya ambapo lengo kuu ni juu ya uptime. Pia tofauti na IT, OT kwa ujumla ina mzunguko wa maisha mrefu. Updates, ambayo inaweza kusababisha usumbufu, ni nadra, na vifaa vingi vya OT vina mifumo ya uendeshaji ya wamiliki, sio ya kawaida, ya kawaida inayoonekana katika IT. Njia rahisi ya kuzingatia baadhi ya tofauti kuu kati ya hizo mbili ni: IT ni kuhusu data na OT ni kuhusu michakato. Kihistoria, vifaa vya IT na OT vimejitenga kutoka kwa kila mmoja katika mazingira mengi. Hata hivyo, leo, IT na OT zinakutana kwa kasi zaidi kuliko hapo awali. Uunganisho huu huunda nyuso mpya za mashambulizi. Hatua za usalama za jadi kutumika kwa kila moja kwa kujitegemea mara nyingi hazifanyi kazi vizuri kwa mazingira haya converged. Badala yake, unahitaji hatua mpya za usalama na mchanganyiko ili kulinda zote mbili kama wao kuwepo pamoja. Uunganisho wa IT-OT ni nini? IT-OT Convergence ni wakati vifaa vya IT na OT vinaunganishwa au kuingiliana na kila mmoja ndani ya mazingira sawa. Hii inaweza kutokea kwa makusudi, kwa mfano, wakati kifaa chako cha OT kimeunganishwa na mtandao wa nje, au kwa bahati mbaya wakati mtu anaunganisha kompyuta ndogo (ambayo imeunganishwa na mtandao wa nje) kwa kifaa chako cha OT kwa sasisho. Kwa miaka mingi, ili kulinda vifaa vya OT, mashirika mengi yaliweka vifaa hivyo kibinadamu tofauti na mitandao ya nje, ambayo inajulikana kama pengo la hewa. Lakini, idadi inayoongezeka ya faida kwa vifaa vya OT vilivyounganishwa inahamisha mashirika mengi mbali na mazoezi hayo. Kwa mfano, mazingira ya IT-OT ya kuunganishwa yanaweza kukusaidia kupata zaidi kutoka kwa michakato yako ya uzalishaji na kukuza uendelevu, lakini kwa bahati mbaya faida hizo pia huleta hatari za cyber. Mkusanyiko huu pia huunda changamoto mpya kwa wataalamu wa usalama. Hatari kwa vifaa vya OT ni tofauti na zile kwa IT, na kugundua na kurekebisha ni ngumu zaidi. Wakati vitisho vinavyoanza katika mazingira yako ya IT vinaweza kuhamia upande wa mazingira yako ya OT, usalama ni ngumu zaidi kwa sababu wataalamu wengi wa IT wa jadi hawajui utata wa vifaa vya OT. Ongeza kwa kwamba kupanua nyuso za mashambulizi na zaidi ya uwezekano wa kushambulia pointi kwa ajili ya waigizaji mbaya. Matokeo yakawa nini? Kuongeza nafasi kwa mazingira yako ya OT kuja chini ya shambulio. Mazingira ya IT-OT ya kuunganishwa yanahitaji mwonekano ulioimarishwa kwa usalama kamili, pamoja na kugundua mtandao wa passively na kuhoji kifaa cha kazi, hesabu ya kina ya mali yako yote na data ya muda halisi kuhusu mali yako yote na vitisho. Bila hii, utakuwa na sehemu za kipofu ambazo daima huweka shirika lako hatarini.