At the moment, the convergence of operational expertise (OT) and IT networks is accelerating as a result of organizations can use the information collected by bodily tools and Industrial Web of Issues (IIoT) units to establish points and improve effectivity. With much less siloed IT and OT departments, convergence reduces area necessities and bodily {hardware}. Different advantages embrace shorter deployment instances, price financial savings, and better efficiency.

Nevertheless, IT/OT convergence additionally means cybersecurity is much more vital. Ever-evolving and damaging cyberthreats can goal beforehand air-gapped OT environments and hold many organizations from totally benefiting from OT/IT community integration.

To realize a complete view of the present OT and cybersecurity panorama, Fortinet accomplished and printed the fifth version of our 2023 State of Operational Expertise and Cybersecurity Report. This annual research offers knowledge and outcomes primarily based on a worldwide survey of 570 operational expertise (OT) professionals performed by third-party analysis firm InMoment.

Cybersecurity enhancements and challenges

The brand new report reveals an encouraging pattern. Many OT organizations have made vital strides in enhancing their cybersecurity posture. Nevertheless, the report additionally reveals the necessity for additional enchancment. The worldwide survey contains a number of key takeaways.

• OT continues to be focused by cybercriminals at a excessive price. Though the variety of organizations that didn’t incur a cybersecurity intrusion improved dramatically year-over-year (from 6% in 2022 to 25% in 2023), there’s nonetheless vital room for enchancment. In reality, three-fourths of OT organizations reported at the very least one intrusion within the final yr. Intrusions from malware (56%) and phishing (49%) had been as soon as once more the commonest sort of incidents reported, and almost one-third of respondents reported being victims of a ransomware assault within the final yr (32%, unchanged from 2022).
• Cybersecurity practitioners overestimated their OT safety maturity. In 2023, the variety of respondents who take into account their group’s OT safety posture as “extremely mature” fell to 13% from 21% the yr earlier than. This drop signifies a rising consciousness amongst OT professionals and the usage of simpler instruments for self-assessing their organizations’ cybersecurity capabilities. Respondents additionally indicated that when a cyberattack did happen, almost one-third (32%) of respondents point out each IT and OT techniques had been impacted, up from solely 21% final yr.
• The explosive development in related units underscores the complexity challenges for OT organizations. Almost 80% of respondents reported having greater than 100 IP-enabled OT units of their OT setting. This quantity signifies simply how vital the problem is for safety groups to safe an ever-expanding menace panorama. Survey findings revealed that cybersecurity options proceed to help within the success of most (76%) OT professionals, notably by bettering effectivity (67%) and suppleness (68%). Nevertheless, report knowledge additionally signifies that answer sprawl makes it tougher to persistently incorporate, make use of, and implement insurance policies throughout an more and more converged IT/OT panorama. Getting older techniques compound the issue, with the bulk (74%) of organizations reporting that the common age of ICS techniques throughout their group is between 6 and 10 years outdated.
• Alignment of OT safety beneath the CISO. Though almost each group faces an uphill battle in relation to discovering certified safety practitioners as a result of rising cybersecurity expertise scarcity, report findings counsel OT organizations are persevering with to prioritize cybersecurity. A key indicator is that almost each (95%) group plans on inserting the duty for OT cybersecurity beneath a chief info safety officer (CISO) within the subsequent 12 months quite than an operations govt or group. The findings additionally reveal that OT cybersecurity professionals now come from IT safety management quite than product administration. The affect on cybersecurity selections is shifting away from operations and to different leaders, particularly CISO/CSO roles.

International developments and insights

An in depth evaluation of the 2023 report knowledge reveals some distinguished international developments.

• Though there could have been an total decline in intrusions resulting from fewer insider breaches, ransomware, and phishing are nonetheless main threats. And cybercriminals appear to be adopting a extra focused strategy.
• Almost all organizations have positioned the duty for OT cybersecurity beneath a CISO quite than an operations govt or group.
• Cybersecurity level merchandise and answer sprawl could make it tougher to use insurance policies and implement them persistently throughout the converged IT/OT panorama.
• OT professionals now appear to have a extra life like self-assessment of their group’s OT cybersecurity defenses.

After 5 years of surveying OT professionals, this yr’s report has the constructive information that OT cybersecurity now has the eye of enterprise management groups and C-suites. However CISOs and their organizations nonetheless have a lot to do concerning cybersecurity.

Defend networks by adopting finest practices

Organizations can proceed to enhance their IT and OT community safety by adopting the perfect practices outlined on this yr’s Fortinet 2023 State of OT and Cybersecurity Report.

• Develop a vendor and OT cybersecurity platform technique. Consolidation reduces complexity and accelerates outcomes. Step one is to start constructing a platform over time by partnering with distributors that engineer their merchandise with integration and automation in thoughts to allow organizations to persistently incorporate and implement insurance policies throughout an more and more converged IT/OT panorama. Search to interact with distributors with a large portfolio of options that may present the essential options of asset stock and segmentation and extra superior options, comparable to an OT safety operations heart (SOC) or the flexibility to help a joint IT/OT SOC.
• Deploy community entry management (NAC) expertise. Fixing the challenges related to securing industrial management techniques (ICS), supervisory management and knowledge acquisition (SCADA), Web of Issues (IoT), carry your individual gadget (BYOD), and different endpoints requires superior community entry management to be a part of a complete safety structure. An efficient NAC answer additionally helps to take care of full management of a corporation’s community by managing new units that wish to join or talk with different elements of the group’s infrastructure.
• Make use of a zero-trust entry strategy. Implement the essential steps of asset stock and segmentation, and supply steady verification of all customers, purposes, and units searching for entry to vital belongings.
• Incorporate cybersecurity consciousness schooling and coaching. Cybersecurity coaching stays vital as a result of the cybersecurity battle would require that every one staff have the information and consciousness to work collectively to guard themselves and their group’s knowledge. Organizations ought to take into account together with non-technical coaching that’s focused towards anybody who makes use of a pc or cellular gadget—everybody from teleworkers to their households. 

To be taught extra concerning the present state of OT, the continued convergence of IT and OT networks, and one of the best ways to safe them going ahead, obtain the complete report.

Copyright © 2023 IDG Communications, Inc.