Divide between IT and OT teams hindering unified cybersecurity strategies

There is a cultural divide between IT and OT teams that are blocking organisations from having unified cybersecurity strategy, a new report has found.

Cybersecurity firm Dragos released "The 2021 State of Industrial Cybersecurity: The Risks Created by the Cultural Divide Between the IT - OT Teams" report from the Ponemon Institute, which found only 21% of organisations have achieved full maturity of their ICS/OT cybersecurity program, in which emerging threats drive priority actions and C-level executives and the board are regularly informed about the state of their OT security.

As the frequency and severity of attacks increase, organisations are struggling to keep ahead of these threats, according to the survey of 603 IT, IT security, and OT security practitioners at the managerial, director, and C-level.

The report finds that 63% of organisations had an ICS/OT cybersecurity incident in the past two years, and it took an average of 316 days to detect, investigate and remediate the incident.

Digital transformation and trends in Industrial Internet of Things have greatly expanded cyber risk to the OT and ICS environment according to 61% of respondents who either agree or strongly agree.

The study reveals a cultural divide between IT and OT teams that affects the ability to secure both the IT and the ICS/OT environment. Only 43% of organisations have cybersecurity policies and procedures that are aligned with their ICS and OT security objectives. Thirty-nine percent have IT and OT teams that work together cohesively to achieve a mature security posture across both environments. Just 35% have a unified security strategy that secures both the IT and OT environments, despite the need for different controls and priorities.

"Most organisations lack the IT/OT governance framework needed to drive a unified security strategy, and that begins with the lack of OT-specific cybersecurity expertise in the organisation," says Steve Applegate, chief information security officer, Dragos.

"Bridging the cultural divide between IT and OT teams is a significant challenge. But organisations must not fall into the trap of thinking that OT can just be tacked onto an existing IT program or managed under a general IT umbrella," he says.

"There are fundamental differences between the problems and goals of a corporate IT environment—data safety and security—and industrial environments, where human health and safety, loss of physical production, and facility shutdowns are real risks.

"Deep domain expertise as well as ICS/OT-specific technologies are both required to truly safeguard industrial systems.

D r. Larry Ponemon, chairman and founder at Ponemon Institute, says a majority of C-level executives and boards of directors are uninformed about the efficiency, effectiveness and security of their ICS/OT cybersecurity programs.

"If the board isn't keenly aware of the impact a cybersecurity incident would have on the bottom line, securing the appropriate amount of budget for OT programs is much more difficult," he says.

"As evidenced by the report, this stems from a lack of clear ownership for ICS/OT risk and who reports that to the board between engineering, IT, and CISOs.

The report reveals cultural differences, technical barriers, and lack of clear ownership are primary challenges for OT and IT collaboration.

The findings of the report suggest that misunderstanding between the groups, rather than conflict, is the significant issue. Only 32% cite competition between IT and OT for budget dollars and new security projects and only 27% have difficulty in converging security teams across IT and OT as an enterprise-wide security program.

Half of respondents state that cultural differences between engineers, security professionals, and IT staff are the main challenge.
44% say there are problematic technical differences between traditional IT-specific best practices and what is possible in OT environments, such as patch management and unique requirements of industrial automation equipment vendors. Some 43% of respondents say there is a lack of clear "ownership" on industrial cyber risk and uncertainty around who leads the initiative, implements the controls and supports the program.
 
The level of cybersecurity maturity for ICS/OT is inadequate to meet today's challenges. Only 21% of respondents say their ICS/OT program activities have achieved full maturity, where emerging threats drive priority actions and C-level executives, and the board of directors are regularly informed about the state of their program. Half of organisations are in the early and middle stages, while the remaining 29% are late-middle stage.

C-level executives and the board of directors are not regularly informed about the efficiency, effectiveness, and security of the program. Only 35% of respondents say someone responsible for ICS and OT cybersecurity reports IT and cybersecurity initiatives to the board of directors.

Of these respondents, 41% say such reporting takes place only when a security incident occurs.

Many senior managers lack awareness of the risks and threats to the OT and ICS environments, resulting in inadequate resource allocation to manage risk. Less than half (48%) of respondents say their organisations understand the unique cyber risks and have specific security processes and policies for OT and ICS environments. Only 43% of respondents say senior management understands the cyber risks and provides enough resources to defend OT and ICS environments.

The report found reporting relationships and accountability for OT security are not properly structured and become deterrents to investing in OT and ICS. Fifty-six percent of respondents say the reason for blocking investments is that OT security is managed by the engineering department which does not have security expertise, and 53% of respondents say OT security is managed by an IT department without engineering expertise. Only 12% of respondents say the CISO is most accountable for the security of the ICS/OT program.
 
According to the report, the loss of confidence in the system was the number one consequence of a cybersecurity incident, reported by 54%, followed by sustained process inefficiency (49%), and loss of control availability (47%).

Additional consequences include:

• Loss of visibility in the physical process; 41%
• Loss of revenues; 40%
• Loss of public confidence; 32%
• Unintended, catastrophic process failures; 30%
   

Despite the challenges, organisations are focused on making investments to improve the cybersecurity posture of ICS and OT environments. Investments in areas that assess weaknesses in the security posture of OT environments are the top priority according to 60% of respondents. Contributing to the security posture is gathering threat intelligence specific to their industry, ICS and OT devices, and geography, (56%), and hiring experts in OT and ICS cybersecurity (49%).