Managing Third-Party Risks in the Software Supply Chain

Supply chain attacks might leverage multiple attack techniques. Specialized anomaly detection technologies, including endpoint detection and response, network detection and response and user behavior analytics can complement the broader scope covered by security analytics on centralized log management/SIEM tools. 

The software supply chain encompasses many entities involved in the development, production and distribution of IT products and services, including hardware manufacturers, software developers, cloud service providers and even the vendors used by direct suppliers (fourth parties). Organizations rely on numerous third-party vendors and service providers to build, deploy, and maintain their software systems. While this interconnectedness brings numerous benefits, it also introduces significant risks that can have far-reaching consequences. 

The myriad of third party risks such as, compromised or faulty software updates, insecure hardware or software components and insufficient security practices, expand the attack surface of the organization. A security breach in one such third party entity can ripple through and potentially lead to significant operational disruptions, financial losses and reputational damage to the organization.

In view of this, securing not just their own organizations, but also the intricate web of suppliers, vendors and partners that make up their cyber supply chain is not just an option, but a necessity. It is needless to state that managing the third party risks is becoming a big challenge for the Chief Information Security Officers. More to it, it may not just be enough to maanage third-party risks but also fourth party risks as well. Aligning third-party vendors with business objectives is a critical supply chain security priority.

Understanding Third-Party Risks

Third-party risks are potential threats that originate from outside vendors, suppliers, or service providers that an organization relies on. Third-party risk involves the direct suppliers and vendors an organization engages with for products and services used in the software supply chain. These entities often have privileged access to sensitive data, making them prime targets. Fourth-party risk extends further to include the vendors and service providers that the third party rely on to deliver the products or services. This indirect relationship can obscure visibility into potential vulnerabilities, posing challenges for organizations in managing these risks.

These risks can include data breaches, service disruptions, and noncompliance with regulations. The common types include:

• Operational Risks: The risk of a third-party causing disruption to the business operations. This is typically managed through contractually bound service level agreements (SLAs) and business continuity and incident response plans.  Depending on the criticality of the vendor, you may opt to have a backup vendor in place, which is common practice in the financial services industry.
• Cybersecurity Risks: The risk of exposure or loss resulting from a cyberattack, security breach, or other security incidents. Cybersecurity risk is often mitigated via a due diligence process before onboarding a vendor and continuous monitoring throughout the vendor lifecycle.
• Compliance Risks: The risk of a third-party impacting your compliance with local legislation, regulation, or agreements. This is particularly important for financial services, healthcare, government organizations, and business partners. 
• Financial Risks: The risk that a third party will have a detrimental impact on the financial success of your organization. For example, your organization may be unable to sell a new product due to poor supply chain management.
• Reputational risk: The risk of negative public opinion due to a third party. Dissatisfied customers, inappropriate interactions, and poor recommendations are only the tip of the iceberg. The most damaging events are third-party data breaches resulting from poor data security, like Target's 2013 data breach.

Best Practices for Managing Third-Party Risks

Effectively managing third-party risks involves a proactive approach that includes the following best practices:

1. Identify and Classify Third-Party Vendors

First, identify all third-parties who play  role in the software supply chain and classify them based on their criticality of the components and services that are sourced from them . It would be also be importnt to consider the criticality of the system for which such components or services are consumed for. Like most risk mitigation plans, a sound strategy involves categorizing the threats by priority. In terms of third parties, the goal is to determine which third-party relationship is riskiest. This helps prioritize risk management efforts by planning and allocating necessary resources.

2. Conduct Thorough Due Diligence

As  next step, conduct a comprehensive due diligence to assess the security posture, financial stability, compliance with regulatory requirements, and overall reliability of the third-parties. This process should include reviewing their security policies, secure coding practices, supply chain risk management plans, previous incident reports, and financial statements. Based on the assessment, either require the third-party to implement necessary policies, processes and controls or put in place appropriate compensating controls to keep the risk under control. Besides, the duediligence shall be conducted in periodic intervals or upon happening of any event or incident impacting the components or services consumed.

3. Establish Clear Contracts and SLAs

Another important step is to ensure that contracts and Service Level Agreements (SLAs) are executed with the third parties and the contract should clearly contain clauses detailing the expectations, responsibilities, indemnities, and penalties. Such contracts should cover aspects such as data security, incident response, confidentiality, and applicable regulatory compliance. The entity shall also be required to report or notify significant security incidents within reasonable time, so that appropriate action as may be necessary to prevent the cascading impact of such incident can be taken.

Mapping your most critical third-party relationships can identify weak links across your extended enterprise. But to be effective, it needs to go beyond third parties. In many cases, risks are often buried within complex subcontracting arrangements and other relationships, within both your supply chain and vendor partnerships. Illuminating your extended network to see beyond third parties is critical to assessing, mitigating and monitoring the risks posed by sub-tier suppliers.

Furthermore, it’s recommended that companies include a “right-to-audit” clause in any contract. This enables the hiring entity to conduct an audit on the third party, checking to see if signed contract is actually being followed. Such a clause also allows companies to assess whether new clauses need to be added to the contract in the future.

4. Monitor and Assess Continuously

Continuous monitoring of third-party vendors is essential to ensure ongoing compliance and risk management. This involves regular audits, assessments, and reviews of the vendor's performance, security practices, and financial health. Besides, after analyzing your organization’s relationships with vendors and suppliers and grouping them based on their risk level, the risk management strategy should be reviewed and revised to make it more efficient. Properly managing supplier risks is essential for interconnected businesses and helps address cybersecurity vulnerabilities throughout the supply chain ecosystem.

Third-party management isn’t just about monitoring for cybersecurity weaknesses and providing compliance advisory services of third parties, although such concerns are important. Third-party risk management includes a whole host of other aspects such as ethical business practices, corruption, environmental impact, and safety procedures to name a few. How third parties operate can directly impact the reputation of the company hiring them.

5. Implement a Third-Party Risk Management (TPRM) Program

Develop and implement a comprehensive third-party risk management program that includes policies, procedures, and tools to manage and mitigate risks. This program should be integrated with the organization's overall risk management strategy and updated regularly to address emerging threats and vulnerabilities. A well-designed third party risk management program framework provides a win-win situation. It helps in predicting third-party risks and high-risk vendors prior to risk assessment. The risk management planning framework saves time and provides insightful risk assessment.

Effective TPRM requires expertise in information security, privacy, sanctions, ESG and other specialized fields. While some businesses have this expertise in-house, many organizations gain these capabilities and add capacity to their risk management function through outsourcing.

6. Foster Strong Relationships and Communication

Suppliers who feel valued are more likely to work with you to solve problems, share information, and adapt to changes. This can lead to a more resilient supply chain. Communication between stakeholders and external suppliers can improve the process by bringing more creative ideas to the table. By fostering open communication and transparency, you can create a foundation of trust that enables better information sharing and risk management. Regular meetings, feedback sessions, and open channels of communication can help address issues promptly and improve overall risk management.

7. Prepare for Incident Response

In an ideal world, a well-defined supply chain incident response plan, complete with well-tested procedures, SBOMs, and comprehensive software inventories would be in place. However, reality often catches us off-guard. Despite best efforts, incidents may still occur. This is where timely notification of the incidents by the third-party is essential. The incident response plan should include steps for notifying affected parties, containing the incident, and conducting post-incident analysis.

Conclusion

Managing third-party risks in the software supply chain is a critical aspect of modern business operations. By adopting these best practices, organizations can safeguard their operations, maintain regulatory compliance, and build resilient partnerships with their third-party vendors. In an era where cyber threats are ever-evolving, proactive risk management is the key to staying ahead.

While companies can implement a wide range of strategies to manage third-party risks, there’s no guarantee of safety from breaches. Therefore, it’s important to stay vigilant, as third-party risks are now at the forefront of organizational threats.

The Perils of Security Debt: Serious Pitfalls to Avoid

In today's fast-paced digital world with ever evolving cyber threats, businesses face an increasing number of cyber security incidents. As organizations strive to remain agile and competitive, there’s often a tendency to prioritize speed and innovation over security. This can lead to what's known as "security debt"—the accumulation of risks and vulnerabilities that are neglected in the race to deploy new features or systems quickly. For Boards and C-suite executives, understanding the perils of security debt is crucial to ensuring the long-term health and safety of their organizations. Here’s a deep dive into why security debt is risky and how it can be managed effectively.

Defining Security Debt

In some ways, security and technical debt are similar: If you don’t pay the debt off, you’ll end up paying just interest without getting to the principal. But security debt doesn’t just “impede future development” of a project. Instead, an accumulating pile of vulnerabilities puts your organization at a much greater risk of malicious cyber exploits. Just as financial debt accrues interest over time, security debt can accumulate increased risks, leading to significant consequences if not addressed promptly.

Security debt is caused by a failure to “build security in” to software from the design to deployment as part of the SDLC. Security debt accumulates when a development organization releases software with known issues, deferring the redressal of its weaknesses and vulnerabilities. Sometimes the organization skips certain test cases or scenarios in pursuit of faster deployment and in the process failing to test software thoroughly. Sometimes the business decides that the pressure to finish a project is so great that it makes more sense to release now and fix issues later. Later is better than never, but when “later” never arrives, existing security debt becomes worse.

Consequences of Security Debt

1. Increased Vulnerability to Attacks: Neglecting security measures can leave your systems exposed to cyber-attacks like data breaches, ransomware, and insider threats. It broadens the attack surface and thus increasing the likelihood of cyber attacks. It is needless to stress that such attacks can result in loss of sensitive data, financial damage, and reputational harm.

2. Regulatory Non-Compliance: If your organization bypasses security protocols, you might find yourself on the wrong side of compliance regulations such as GDPR, HIPAA, or CCPA or such other applicable regulations. Any compromise on non-compliance such regulatory requirmenets can result in hefty fines and legal repercussions including impact on brand reputation.

3. Higher Remediation Costs: Like in case defects, fixing defects early in the lifecycle of the software would be a lot cheaper. Also, the longer security debt goes unpaid, the software complexity would increase, makint it harder and more expensive to address it. Fixing vulnerabilities retroactively often requires more resources than if they had been managed proactively. This holds good for process related gaps as well.

4. Erosion of Customer Trust: Customers are increasingly aware of privacy and security issues. A security breach not only impacts operations but also damages customer trust and loyalty, which can be difficult to rebuild.

5. Decreased Resilience: The more debt an organization carries, the less resilient it becomes to new threats. New vulnerabilities continue to emerge, and if an organization is already burdened with significant security debt, it will struggle to keep up with the evolving threat landscape.

Strategies to Manage and Mitigate Security Debt

1. Assess and Track Security Debt: Assessing an organization's in-depth security situation is the first step toward paying off security debt. Organizations should locate and record and track any security gaps, weak points, and vulnerabilities in their networks, systems, and applications. Such known security gaps shall be managed as a risk.

2. Incorporate Security into Design & Development Cycles: Emphasize a DevSecOps approach where security is integrated into every phase of development. Integrate automated vulnerability scanning and penetration testing into your workflow to identify and address potential security flaws early in the SDLC. Regular security assessments and automated testing can catch vulnerabilities early in the cycle. Make Security as a business priority, so that security gaps are not compromised in favour of other business priorities. 

3. Prioritize Risk Assessments: Conduct regular and thorough risk assessments to identify and rank potential threats. This helps in directing resources towards the most pressing security concerns. This way, the accumulated security debt can be kept under check.

4. Collaborate with External Security Experts: Organizations may find it advantageous to work with outside security specialists or consultants to address challenging security problems and pay off security debt in certain situations. Penetration testers, security reviewers, and external security assessors can offer insightful analysis and helpful suggestions for strengthening safeguards and resolving vulnerabilities.

5. Invest in Continuous Monitoring: Implement continuous security monitoring tools to detect and address vulnerabilities in real-time. This proactive approach minimizes the potential for unaddressed issues to evolve into major threats.

6. Foster a Security Culture: Encourage a company-wide security mindset. Educate employees at all levels about the importance of security practices and provide regular training to keep security at the forefront of everyone’s mind. Foster an environment where team members feel comfortable reporting potential security issues without fear of retribution. Transparency is key to addressing vulnerabilities effectively.

7. Allocate Budget for Security Improvements: Ensure that your organization allocates sufficient budget for ongoing security initiatives. Recognize that investing in security today can save substantial costs and risks in the future. Invest in regular and periodic training so that the employees stay updated with the latest security trends and threats. Knowledge is the first line of defense.

Leadership's Role in Addressing Security Debt

Great leadership is the beacon that not only charts the course but also ensures your crew – your IT team, support staff, and engineers – are well-prepared to face the challenges ahead. It instills discipline, vigilance, and a culture of security that can withstand the fiercest digital storms.

The Board and leadership must understand and champion the importance of security for the organization. By setting the tone at the top, they can drive the cultural and procedural changes needed to prevent the accumulation of the security debt. Periodic review and monitoring of security metrics, and identifying & tracking security debt as a risk can help keep the organization accountable and on track.

Conclusion

Security debt may be an unseen burden, but its impacts are real and potentially devastating. For Boards and executive teams, recognizing and addressing security debt is not just a technical necessity but a critical component of strategic resilience. Investing time and resources into managing this debt will not only safeguard your organization today but also fortify it against the evolving challenges of tomorrow. By recognizing the challenges presented by security debt, employing a side-by-side approach to remediating both critical and other vulnerabilities, and employing appropriate risk scoring, vulnerability intelligence and related techniques, organizations can reduce both their security debt and exposure to potential attacks.

Setting up a Security Operations Center (SOC) for Small Businesses

In today's digital age, security is not an option for any business irrespective of its size. Small Businesses equally face increasing cyber threats, making it essential to have robust security measures in place. A SOC is a dedicated team responsible for monitoring, detecting, and responding to cybersecurity incidents in real-time. It acts as the frontline defense against cyber threats, helping to safeguard your business's data, reputation, and operations. By establishing a SOC, you can proactively address security risks and enhance your overall cybersecurity posture.

The cost of setting up a SOC for a small business may be prohibitive, in which case, the businesses may look at engaging Managed Service Providers for the whole or part of the services. For instance, if the business can afford to have its own team, then they can consider subscribing to cloud based technology services / tools to facilitate the SOC operations.

Here’s an attempt to provide guidance in setting up a SOC, even on a limited budget.

The Objectives

Before setting up a SOC, it's crucial to outline the objectives. The People, Process and Technology to be used for the SOC largely depends on the objectives. Here are some common goals for a small business SOC:

• Protecting assets: The SOC monitors and protects the organization's assets, such as intellectual property, personnel data, and business systems.
• Responding to incidents: The SOC identifies and responds to security incidents, analyzing suspicious activity and taking action to contain and remediate the incident.
• Gathering threat intelligence: The SOC gathers and analyzes threat intelligence to stay up to date on cyber threats and vulnerabilities.
• Managing vulnerabilities: The SOC identifies and assesses vulnerabilities in the organization's IT infrastructure and systems, and prioritizes and remediates them.
• Ensuring compliance: The SOC ensures that the organization complies with relevant security regulations and standards.

The SOC Team

Building a competent SOC team is essential for the success of security operations. Depending on the budget and resources, the SOC team may include:

• SOC Manager: Develops the organizzaation's security strategy, including hiring, processes, and technology. They provide technical guidance and managerial oversight.
• Threat Hunters: Proactively look for threats that may have evaded automated detection. They use data analysis, threat intelligence, and experience to uncover potential breaches and hidden vulnerabilities.
• Security Analysts: Monitor security events and alerts from various sources, such as intrusion detection and prevention systems (IDPS), security information and event management (SIEM) systems, and endpoint detection and response (EDR) solutions.
• Incident Responders: Focus on containment, eradication, and recovery of confirmed cybersecurity incidents. They need specific skills in incident management, crisis control, and restoring systems to normal operations.
• Threat Intelligence Analysts: Use threat intelligence to perform assessments to discover the primary aim of the attack and which systems were affected.
• IT Support: Assist with deploying and maintaining security tools and technologies.
• Complince Auditor: Ensures that SOC members are following protocols and adhering to government or industry regulations. They play a key role in standardizing processes within a SOC.

If staffing a full team is not feasible, consider outsourcing certain functions to managed security service providers (MSSPs) or utilizing part-time consultants. Alternatively, depending on the volume of work, some roles may be combined and rolled up to one employee.

Essential Tools & Technologies

Equipping your SOC with the right tools and technologies is critical. Here are some essential components:

• Security Information and Event Management (SIEM) System: Collects and analyzes logs & other associated data from various infrastructure assets including applications for the purpose of providing real-time alerts and insights. SIEM is a fundamental technology that forms the core of a SOC. Modern SIEM tools have the ability to leverage Artificial Intelligence capabilities so as to correlate data from different sources and help the SOC team make a better decision.
• Intrusion Detection and Prevention Systems (IDPS): Analyzes network traffic to identify and prevent cyber threats. IDPSs can be either a hardware device with pre-loaded software tools or a virtual service, and they can use various methods including to identify attacks, such as signature matching, anomaly detection, behavioral analysis, and threat intelligence. Here again, AI is being explored to play a vital role to improve the efficiency and effectiveness of the detection and prevention.
• Endpoint Detection and Response (EDR) Tools: Helps organizations detect, contain, and respond to cyberattacks. EDR tools can collect endpoint data from various sources, including on-premises and cloud services. They can also provide SOC teams with remote control over endpoints to perform immediate mitigation.
• Incident Response Tools: Facilitates the investigation and remediation of security incidents. Modern tools can help SOC teams automate routine response tasks, such as isolating compromised endpoints.
• Vulnerability scanners: Detect weaknesses in systems and applications before attackers can exploit them. They can scan networks, systems, and applications for known vulnerabilities and misconfigurations.

In case, you have hosted your applications on the cloud infra, it is likely that your Cloud Service Provider (CSP) offers some or all of the above tools as a service. Ofcourse, subscribing to such services may result in additional cost. While budget constraints may limit the number of tools you can acquire, prioritize those that address your most critical security needs.

SOC Processes

Establishing clear, well-defined processes is vital for the smooth functioning of your SOC. NIST Cyber Security Framework could be a good fit for all businesses and one can define the processes that are essential and relevant considering the size, threat landscape and risk tolerance of the business. Key processes include:

• Incident Detection and Reporting: Define steps for identifying and reporting incidents, including automated alerts and manual reporting procedures.
• Incident Response and Remediation: Outline the actions to take when an incident occurs, including containment, eradication, and recovery.
• Threat Hunting: Proactively search for potential threats and vulnerabilities within your network.
• Regular Audits and Assessments: Conduct periodic reviews to evaluate the effectiveness of your security measures and identify areas for improvement.

Training & Up-skilling

Continuous training and development are essential for keeping your SOC team prepared to handle evolving threats. Offer regular training sessions, certifications, and workshops to enhance their skills and knowledge. Encourage your team to stay updated on the latest cybersecurity trends, tools, and best practices.

Continuous Improvement

Once your SOC is operational, regularly monitor its performance and effectiveness. Collect and analyze data on incidents, response times, and resolution success rates. Use this information to identify areas for improvement and make necessary adjustments. Continuously updating and refining your SOC processes will help you stay ahead of emerging threats.

Conclusion

Setting up a Security Operations Center may seem daunting, especially for small businesses with limited resources. However, by defining clear objectives, assembling a skilled team, investing in essential tools, and establishing robust processes, you can create an effective SOC that enhances your cybersecurity defenses. Proactive monitoring and continuous improvement will help protect your business from cyber threats and ensure long-term success.

Securing the Operational Technology (OT) - The Challenges

OT - Overview

Operational Technology(OT) is generally technology used in the manufacturing or operational floor. The OT has evolved considerably in the recent years from pure mechanical technology to data-driven technologies like Robotic Process Automation (RPA) leveraging IOT, Machine Learning and Artifiial Intelligence. The impetus from the Industrial IOT (IIOT) brings more and more automation capabilities and the connected behavior into the manufacturing floor. Thus the adoption of IT and related technologies in OT is now the common norm and so the need for alignment and convergence with the IT function. 

IOT sensors are deployed everywhere, inside a manufacturing floor, or along the gas pipelines, inside a moving automobile, to monitor the stock movements, etc. Though these dispersed IOT devices perform small functions, the data it produces and the decisions taken based on sucgh data are critical and thus it is being realized that the OT could lead to critical security issues, depending on the size, and critical nature of such enterprise.  

The adoption of IIoT and related technologies brings many benefits to businesses such as smart machines and real-time intelligence from the factory floor - but it also increases the attack surface and requires continuous connectivity between IT and OT. The differing culture and mindset between the IT and OT functions, combined with few other factors often leads to conflicts. 

Hackers and Cybercriminals are now looking at critical infrastructure systems as the targets.  Motivations include holding systems hostage for a ransom, stock price manipulation, denial of production operations, etc. For example, the hackers may take control of your car when on a high way and demand a ransom, which could be life threatening. Similarly, Hackers may get hold of the Energy Grid and shut down the power supply for a region or even nation as a whole. The connected nature of these devices and systems involved in the modern day OT poses serious challenges as they get hooked on to the IT owned network infrastructure, wireless access points, and mobile networks.

Securing the OT

The introduction of new technologies to drive improvements such as production and supply chain efficiency and asset management has led to closer and more open integration between IT and shop floor systems. But the increasing connectivity of previously isolated manufacturing systems, together with a reliance on remote supporting services for operational maintenance, has introduced new vulnerabilities for cyber attack. Not only is the number of attacks growing, but so is their sophistication. As OT security becomes a widely discussed topic, the awareness of OT operators is rising, but so is the knowledge and understanding of OT-specific problems and vulnerabilities in the hacker community.

It’s true that the systems and devices involved in OT are often based on the same technologies as that of IT and as such many of the threats they face are exactly the same. However, it is an open secret that OT security is not the same as IT security. While securing OT systems requires an integrated approach similar to IT, its objectives are inverted, with availability being the primary requirement, followed by integrity and confidentiality. There are certain other important differences as well that mean that the OT infrastucture can not be managed as an extension of the IT infrastructure

Here are some of the areas that makes OT different from IT and thus pose a challenge for the IT Security experts:

1. Visibility:

From the perspective of the organizational units responsible for IT Security function, OT has been somewhat off the radar. This is so, because, the IT function is not involved in the evaluation and selection and procurement of the OT systems. More so, as such OT systems come with a dedicated-networked IT system(s), which could mean even isolated data-centers being setup within the manufacturing floor without the knowledge of the IT function.  Until recently, or even now in certain cases, the IT systems involved in OT are treated as an integral part of production machinery rather than computerized information systems, so the ultimate responsibility of its operation and maintenance, regardless of the cause of potential failure, was assigned to the OT function and not IT function. In most cases, the OT staff often don’t know what types of IT, or IoT devices or equipment that they have as part of their OT ecosystem. 

2. Skill Gap:

One of the biggest challenges facing the industry is deciding who is responsible for OT security - should it be the IT or OT function? Given their background and resources, in many cases IT security teams are being asked to take ownership of coordinating security for OT. However, they typically lack OT specific skills. Defining the security controls / processes for OT systems require indepth knowledge on the OT systems, so that the interests and priorities of the OT function is also taken care of. The cybersecurity industry is projected to reach 1.8 million unfilled roles by 2020. The added complexities of a converged IT/OT security environment could amplify perceived barriers to entry, as organizations struggle to manage the aging workforce of their plant teams with the Millennial generation of new cybersecurity talent.

3. Availability and Safety:

For a Manufacturing company, the production line is very important and its smooth functioning always is very important. Companies lose revenue when their production line is shut down for maintenance, be it planned or unplanned. Nobody wants to disturb OT equipment because any downtime can turn into millions of dollars in lost productivity, highly vocal, disgruntled customers and regulatory fines. Machines must reach a high OEE (overall equipment effectiveness). There is no time to allow IT-style updates and patches that take down equipment.

In many cases, where OT systems are involved in delivering essential services, such as electricity or water, or maintaining safety systems at chemical plants or dams availability is a significant parameter. Even momentary non-availability could lead to catastrophy in certain cases. Enabling high availability of OT systems and maintaining the confidentiality of some sensitive information processes by those systems require additional security controls. Not only are many of these now-connected OT system components are quite vulnerable to compromise, a failure in one of these also has the possibility of causing a catastrophic effect on human life and property. 

4. Processes:

Safety and security for employees and customers have always been top priorities for the OT function and the processes and guidelines are usually defined keeping that in mind. IT function doesn’t even factor plant or employee physical safety in, except where physical access systems are under their domain. IT’s top priority is to protect the data. OT’s top priority, however, is to protect the availability and integrity of the process with security (confidentiality) coming last. At the same time, the OT system components designed for direct control, supervisory control or the safe operation of manufacturing processes,  could turn out to be a safety hazard, even if any component or subsystem  involved compromised. Business systems are also critical but their failure is unlikely to result in the uncontrolled release of hazardous materials or energy. 

5. Legacy: 

It is not uncommon that the computer and related software systems used as part of the OT are used over a decade without being replaced or made any change. These computers and softwares are designed for certain specific functions of interfacing with the other plants and equipments involved in the manufacturing process. It largely depends on the plant or equipment vendor to come out with software and related IT hardware enhancements, otherwise, such systems may not be compatible with the upgraded IT hardware or the OS. Consequently, such systems would be vulnerable to a wide range of cyber-threats that have already been mitigated on the systems used in IT function. This is more so

6. Disparate Technologies:

Until recently, or even now in most cases, the OT architectures run on a separate and isolated infrastructure and as such they have been traditionally isolated from the Internet. One of the reasons for this is because these systems are often hard wired to work with a plant / equipment and to receive and process signlas received and disseminate instructions back to various components. Some OT systems are already only supporting obsolete, insecure operating systems. OT system vendors also do not feel obliged to increase the security capabilities of their systems. Something as benign as an active system scan can cause these devices to fail, which can have serious if not catastrophic results.

System-dedicated networks, multiple domains and dedicated supporting systems require more resources to achieve a maturity level comparable with IT. It also greatly increases the complexity in monitoring and maintaining security levels. The sophisticated nature of OT infrastructure technologies means that most IT security and threat intelligence solutions don’t have visibility into, let alone the ability defend against attacks on critical infrastructures. This creates a challenge in defining and implementing coherent security policies across production plants

7. IIoT Impact: 

The Industry 4.0 revolution is having a great impact on the manufacturing environments. It offers significant opportunities for improving production effectiveness; in particular, based on continual, online information about manufacturing processes and equipment. However, the utilization of new IoT technologies also has an impact on security. It’s not just about networks of course, there are loads of components, including things like sensors and actuators (transducers) and ‘smart things’, fog nodes,(industrial and intelligent) IoT gateways, IoT platforms and so forth. And for IT some of these components are “different” from the cyber security perspective they are used to by the way. New protocols (including wireless) or mesh network architectures increase the number of potential access points to the network and require a different approach to security.

8. Culture:

The IT function responsible for maintaining and securing the Information and related Resources, help ensuring the data Confidentiality, Integrity and Availability aspects and in the process protect corporate information and related assets including networks from cyberattacks. They're less familiar with the OT space, and often display little interest in knowing what their counterparts do to keep it safe and operational. In contrast, OT function monitors and fixes issues in highly complex and sensitive industrial plants with maintaining operational safety, reliability, and continuity as the top priorities. They don't deal or work with IT function, and certainly don't want them to get involved in their operational issues.

Each group is concerned that the other side will wreak havoc in their environment. When there is a need to secure OT against cyberthreats, plant engineers worry that if IT team members get involved, they'll compromise system safety and stability. Unsanctioned changes to these systems might cripple the plant, cause an explosion, or worse. These concerns are justified. After all, when it comes to OT, IT staff members are in uncharted waters. At the same time, the IT function is concerned that vulnerable OT networks will introduce new threats into IT networks, threatening corporate assets, data, and systems.

Conclusion:

As industrial organizations begin to connect their machines to the network, the differences in security requirements for IT versus operational technology (OT) are becoming more important to understand.

There were no good practices and formal regulations for manufacturers on how to provide even minimal security protection on medical devices. 

IT and OT teams are discovering the need to work together in order to deploy cybersecurity solutions throughout the enterprise; from headquarters to remote locations, and the factory floor. Hackers are going after intellectual property, financial data and customer information. CIOs report that intellectual property can constitute more than 80% of company value. Now is the time for OT and IT leaders to develop strong partnerships to promote operational efficiency, safety and competitive advantage.

Neither OT team members nor IT team members are experts in defending OT systems against emerging cyberthreats. Because OT networks were previously disconnected from the external world, engineering staff never had to deal with such threats. Meanwhile, IT staff members who deal with cyberthreats on a daily basis don't fully understand how these new threats will affect OT systems.  Nevertheless, both sides must cooperate, because neither group can protect industrial systems singlehandedly. Given the divergent cultures, technologies, and objectives of IT and OT, the two groups must overcome a significant divide, including mutual suspicion.

To ensure IT and OT collaboration, business-level oversight and leadership is required. More and more organizations are taking senior, experienced engineers from OT business units, usually from under the COO, and moving them under the CIO hierarchy. This interdisciplinary model combines expertise and roles that straddle and unify both sides of the IT-OT fence. Some organizations have taken this one step further. Instead of aligning IT roles under the CIO, they're creating a new C-level role to facilitate this management strategy. 

The higher up the organizational ladder that IT-OT convergence decisions are being made, the better the chances for success in bridging the gap.