NEWS: Logpoint Acquires Muninn
Historically, information technology (IT) and operational technology (OT) environments were designed to operate independently, be managed by different teams with different objectives, and had no cross over between the two. However, this has changed dramatically over the past decades — mostly due to the acceleration of digital transformation. Organizations in all sectors have since become increasingly reliant on newer types of cyber-physical systems and other technologies that both require and continue to expand connectivity between IT and OT. As a result, these previously isolated environments are converging, giving rise to undeniable business benefits ranging from greater efficiency and sustainability to innovation. Unfortunately, this convergence is also fueling new risks and challenges — particularly when it comes to IT and OT cybersecurity.
In February 2022 Nvidia, the largest microchip manufacturer within the U.S., experienced a major supply chain attack, when the hacker group Lapsus$ caused outages within their internal network. Lapsus$ managed to steal 1TB of schematics, driver and firmware code, documentation, and SDKs. They also leaked a 19GB archive of those files online.
IT and OT
Both OT and IT network infrastructures share common components, including switches, routers, and wireless technologies. Given this similarity, OT networks can leverage the extensive expertise and stringent practices that IT has developed over time. By adopting IT's proven network management and security measures, OT can establish a robust and secure network foundation.
However, there are key differences such as network interfaces and protocols.
IT includes systems dedicated to data management ex. storage, retrieval, transmission, and manipulation. It encapsulates the vast infrastructure of servers, computers, networks, and databases that form the digital backbone of modern enterprises.
OT relates to systems that oversee the physical operations of machinery, including industrial control systems, SCADA systems, and PLCs. It represents the intersection of digital processes and production operations.
Tracing the Evolution of Cybersecurity in IT and OT
In the past, IT's cybersecurity paradigm was relatively straightforward, primarily addressing unauthorized access and potential data breaches. However, with the digital revolution, the threat surface has expanded massively, making it necessary to take advanced counter measures such as cloud security, endpoint protection, and sophisticated threat detection.
Conversely, OT, characterized by its traditionally isolated systems, prioritized physical safety and operational continuity. However, the advent of IoT (Internet of Things) and increased interconnectivity has ushered in a new era of challenges for OT.
Dissecting the Cybersecurity Challenges
The core imperatives in IT cybersecurity are defined by a crucial triad: data integrity, confidentiality, and data availability. These three elements remain of paramount importance in ensuring a secure and working digital environment.
However, the IT landscape grapples with a wide and diverse range of threats, from sophisticated malware to intricate phishing attacks. 2022 was a breakout year for ransomware and recent data indicates that ransomware attacks alone have accounted for financial losses of $49.2 million.
When looking at manufacturing sites system availability, safety, and performance optimization are of utmost importance.
Challenges within the OT landscape range from industrial espionage to sabotage and system malfunctions. The 2010 Stuxnet worm is a prominent example of such threats. Primarily targeting industrial control systems used in infrastructure facilities, its main objective was to disrupt Iran's nuclear program. Unlike typical malware, Stuxnet does little harm to computers and networks and aims at causing physical damage to the machinery it’s infecting, specifically centrifuges used in uranium enrichment.
Tailoring Cybersecurity Solutions
For IT, a multifaceted approach is requisite. This includes deploying firewalls, network detection and response systems, encryption protocols, and multi-factor authentication mechanisms. Moreover, the regular updating of software and systems is non-negotiable.
For OT, the strategy is more specialized. Measures such as network segmentation, real-time monitoring, strict access controls, and safety protocols are imperative.
IT/OT Convergence: A Story of Integration
The merging of IT and OT marks a major change in the tech world. This combination, motivated driven by the wish for better operations and data-informed decisions, has led to new business approaches.
While OT experts know how to handle equipment and ensure smooth operations, combining IT and OT offers greater monitoring and thereby allows them to take actions based on specific situations. This could range from planning maintenance when performance drops to turning off machines in unsafe conditions.
The automation of certain processes helps prevent damage and costs from delays, lets OT teams handle more tasks simultaneously, and significantly cuts down routine expenses.
With the continuous data collection that IT/OT integration offers, businesses can identify regular operational patterns. For instance, a factory might have specific days or hours when it uses more resources or runs certain machines longer. Recognizing these patterns helps OT staff spot irregularities more quickly.
However, besides all the benefits this integration also brings heightened security risks, the need for mixing the two work cultures, and technical challenges. IoT devices, for example, have often been easy targets for hackers. Some send data without encryption, making it easy to capture and alter ex. manufacturing processes. As industries adapt to this merged approach, comprehensive security measures, diverse training, and strategic collaborations will be crucial.
Moving Forward: Best Practices
Navigating the intricate landscape of IT and OT demands a greater focus on cybersecurity. It's essential for IT and OT teams to collaborate closely, using their expertise to swiftly identify and counteract threats.
Regular training sessions are vital, ensuring that teams are consistently updated and equipped to handle the newest cybersecurity challenges.
Beyond the routine risk assessments and penetration tests, it's crucial to have a system such as network detection and response (NDR) in place. Besides legacy cybersecurity tools such as firewalls and anti-virus software a NDR will recognize any abnormalities and help prevent further damage caused by hackers that are already inside your network, thereby strengthening the overall security framework.
Learn about the most common use cases for network detection and response here.
Summary
Today the increasing convergence of IT and OT presents both unparalleled opportunities for internal processes, decision-making, and productivity but it also creates new challenges. As industries transition into this integrated future, it is important to adopt a comprehensive cybersecurity strategy, ensuring smooth operational processes within a secure digital framework .
By utilizing and analyzing all real-time data generated within the OT network, we are able to proactively counteract potential security threats, ensuring both data integrity, confidentiality, and continuous production. The synergy between IT and OT is unveiling novel opportunities for growth and innovation, but their different approaches within cybersecurity needs to be addressed as we move forward.
How Can Muninn help?
Powered by ourself-Learning AI, Muninn AI Detect uses anomaly-based detection to detect new and unpredictable attacks in their earliest stages.
Muninn's AI is learning the normal patterns of your network for every device and operator in the industrial environment. Using raw packet data to understand the behavior of your network, Muninn does not need any information from external sources to perform to analyze and see abnormalities. The approach is perfectly suited to spot cybercriminals that already are inside your network and stop supply chain attacks or ransomware.
