Organizations are placing OT cybersecurity responsibility on CISOs

Protecting operational technology (OT) systems is now more critical than ever as more organizations connect their OT environments to the internet, according to Fortinet.

Although IT/OT convergence has many benefits, it is being hampered and handicapped by advanced and destructive cyberthreats. The spillover of these attacks is increasingly targeted at OT environments.

“Fortinet’s report shows that while OT organizations have improved their overall cybersecurity posture, they also have continued opportunity for improvement. Networking and IT teams are under extraordinary pressure to adapt and become more OT-aware, and organizations are shifting to find and employ solutions that implement security across their entire IT/OT environment to reduce their overall security risk,” said John Maddison, EVP Products and CMO at Fortinet.

OT continues to be targeted by cybercriminals

While the number of organizations that did not incur a cybersecurity intrusion improved dramatically YoY (from 6% in 2022 to 25% in 2023), there is still significant room for improvement. In fact, three-fourths of OT organizations reported at least one intrusion in the last year.

Intrusions from malware (56%) and phishing (49%) were once again the most common type of incidents reported, and nearly one-third of respondents reported being victims of a ransomware attack in the last year (32%, unchanged from 2022).

In 2023, the number of respondents who consider their organization’s OT security posture as “highly mature” fell to 13% from 21% the year before, suggesting growing awareness among OT professionals and more effective tools for self-assessing their organizations’ cybersecurity capabilities.

32% of respondents indicated that both IT and OT systems were impacted by a cyberattack, up from only 21% last year.

Complexity challenges for OT organizations

80% of respondents reported having greater than 100 IP-enabled OT devices in their OT environment, highlighting just how significant a challenge it is for security teams to secure an ever-expanding threat landscape.

Survey findings revealed that cybersecurity solutions continue to aid in the success of most (76%) OT professionals, particularly by improving efficiency (67%) and flexibility (68%).

However, report data also indicates that solution sprawl makes it more difficult to consistently incorporate, employ, and enforce policies across an increasingly converged IT/OT landscape. And the problem compounds with aging systems, with the majority (74%) of organizations reporting that the average age of ICS systems across their organization are between 6 and 10 years old.

OT cybersecurity responsibility

While nearly every organization faces an up-hill battle when it comes to finding qualified security practitioners due to the growing cybersecurity skills shortage, report findings suggest OT organizations are continuing to prioritize cybersecurity.

A key indicator is that 95% organization plans on placing the responsibility for OT cybersecurity under a CISO in the next 12 months rather than an operations executive or team.

The findings also reveal that OT cybersecurity professionals now come from IT security leadership rather than product management, and influence on cybersecurity decisions is shifting away from operations and to other leaders, especially CISO/CSO roles.

Best practices for OT security

Fortinet’s report indicates ways organizations can strengthen their overall security posture. Organizations can address OT security challenges by adopting the following best practices:

Develop a vendor and OT cybersecurity platform strategy. Consolidation reduces complexity and accelerates outcomes. The first step is to begin building a platform over time by partnering with vendors that engineer their products with integration and automation in mind to enable organizations to consistently incorporate and enforce policies across an increasingly converged IT/OT landscape.

Seek to engage with vendors with a wide portfolio of solutions that can provide the basic solutions of asset inventory and segmentation and more advanced solutions, such as an OT security operations center (SOC) or the ability to support a joint IT/OT SOC.

Deploy network access control (NAC) technology. Solving challenges associated with securing ICS, SCADA, IoT, BYOD, and other endpoints requires advanced network access control to be part of a comprehensive security architecture. An effective NAC solution also helps to maintain complete control of an organization’s network by managing new devices that want to connect or communicate with other parts of the organization’s infrastructure.

Employ a zero-trust approach. Implement the basic steps of asset inventory and segmentation, and provide continuous verification of all users, applications, and devices seeking access to critical assets.

Incorporate cybersecurity awareness education and training. Cybersecurity training remains critical as the cybersecurity battle requires the collective empowerment of all employees to have the knowledge and awareness to work together to protect themselves and their organization’s data. Organizations should consider including nontechnical training targeted toward everyone who uses a computer or mobile device, from teleworkers to their families.