IT/OT security: security in a hybrid world

1. Ensure full understanding

Good security starts with knowing what you have. Without a complete overview of all IT and OT assets, it is impossible to effectively manage risk. This means:

• Inventory: the CMDB must be current and complete to identify all IT OT assets including: servers, workstations and network infrastructure. OT equipment such as PLCs, other systems and sensors and legacy systems critical to production processes.
• Monitoring: Implement tools that provide real-time visibility into what is happening within your networks, including new devices being added.
• Analyze vulnerabilities: Identify vulnerabilities in hardware, software and connections, and create a plan to address them.

 A well-managed CMDB is an indispensable tool for gaining full visibility into your IT/OT environment and establishing a strong security foundation.

2. Segment networks

Network segmentation is one of the most effective methods of minimizing the impact of an attack. By separating IT and OT systems physically and logically, you can limit the damage if something does go wrong. Consider:

• Physical separation: Use different networks for IT and OT to prevent attacks from IT from directly affecting OT systems.
• Firewalls and zones: Use firewalls and configured zones to allow only the absolutely necessary traffic between IT and OT.
• Limited Access: Implement access based on the least privilege principle, so that users or systems have access only to the resources they really need. See also Third Party Access in the next block.

A well-segmented network is a critical step in limiting the spread of attacks such as ransomware.

3. Clear and complete Third Party Access policy.

Managing access to critical systems is essential to prevent unwanted breaches. External parties, such as vendors, can unknowingly introduce risks if access is not properly managed. Important measures include:

• Limit access to the strictly necessary: Give outside parties access only to the systems strictly necessary for their work.
• Granular Delegated Admin Privileges (GDAP) gives you even more control over third-party access. GDAP allows you to give external parties access only to specific systems or data they need, with limited privileges and for a predetermined period of time. This prevents excessive access rights, strengthens security and provides full control and visibility over all actions of external users.
• Using VPN and MFA: Make access more secure by using Virtual Private Networks (VPN) and Multi-Factor Authentication (MFA).
• Access logs: Keep detailed logs of who accessed, what actions were performed and on which systems.

A clear policy around third-party access and GDAP not only reduces risk but also helps with audits and regulatory compliance.

4. Automate and test updates and patches.

Timely implementation of updates and patches is crucial to close vulnerabilities in systems and protect your IT and OT environment. In production environments, this is often a challenge because updates should not lead to disruptions of critical processes. Effective solutions are:

• Automated patch management: Use tools to deploy updates and patches efficiently and securely without human error.
• Scheduled maintenance windows: Align patch activities with production cycles to minimize downtime.
• Regular review: Ensure that all systems, including legacy, are regularly updated and secured.
• Use an OTAP strategy: Use an OTAP (Develop, Test, Accept, Produce) environment to test patches and updates first in a secure, simulated environment. This prevents untested changes from directly impacting your production processes and reduces the risk of unexpected failures.

A solid patch management process ensures that your systems remain protected from known threats while maintaining production continuity.

5. Collaborate with experts

IT/OT security is a specialized field that requires constant attention and expertise. Working with an experienced partner offers benefits such as:

• Industry knowledge: Outside experts understand the unique challenges of industrial environments and provide solutions that fit your specific situation.
• Proactive support: From risk assessment to incident response, a partner helps you effectively manage security challenges.
• Compliance assistance: Partners can guide you in complying with regulations such as ISO 27001 and IEC 62443.

By working with a specialist, you can leverage best practices and gain access to tools and knowledge that your internal team may not have.

6. Other IT/OT security best practices.

Of course, the above best practices are not exhaustive and depend on each company's complexity, different variables and priorities. In addition to the steps described, the following measures can also help improve security:

• Continuous monitoring and threat detection: Use SIEM and OT-specific monitoring tools to detect abnormal activity early.
• Incident response plans: Ensure that there is a well-defined incident response plan for both IT and OT.
• Awareness training: People often remain a weak link; training minimizes human error.
• Backup and recovery strategies: Provide regularly tested, isolated backups to recover quickly in the event of an incident.
• Pentesting: Conduct regular security testing specifically for IT/OT environments.
• Securing IoT devices: IoT, such as printers, sensors and smart devices, often interface directly with OT systems. Often these devices have weak security or default passwords, making them a major vulnerability. Implement strong authentication and place IoT devices in a separate network segment.