This audio was created using Microsoft Azure Speech Services
The convergence of OT (Operational Technology) and IT (Information Technology) in industrial environments has opened the operational side to cyber dangers that traditionally targeted IT. Yet, despite all the warning signs about the need to protect OT environments, many organizations still have a lot of work to do. A recent Claroty global survey of 1,100 IT and OT security professionals revealed that 80% of the respondents reported being impacted by ransomware attacks targeting critical infrastructure.
This could be a case of “old habits die hard,” but it is more urgent than ever to address. Unless data center managers start placing more emphasis on reducing risks to the operational side, they could be leaving the door open for breaches that seriously disrupt operations. Given how essential centralized compute is to our day-to-day lives — it’s how we connect, work, learn, and produce — we need to treat OT infrastructure that supports data centers at the same level of criticality as those associated with energy and utilities, water and wastewater plants, and transportation.
The consequences of an interruption to these “heavy industries” caused by cyber activity is clear. We got a taste of it during the Colonial Pipeline breach in May 2021. It disrupted fuel supplies along the U.S. Eastern Seaboard. Earlier, in February, a hacker had attempted to tamper with a water treatment plant in Oldsmar, Fla.
It’s easy to forget that data centers exist at the intersection of IT and OT, which can expose them to additional cybersecurity threats. Increasingly, connected devices and IoT bring the data center much closer to industrial endpoints, which may be large rotating motors, drive systems, and other assets utilized for industrial operations. But with digitalization (often referred to as Industry 4.0) and edge computing networks, it’s important to recognize the interplay between OT and IT technologies.
Why OT environments are targeted
The increased exposure of OT environments to cyber dangers is an unfortunate side effect of digitalization. The addition of digital applications and IoT connections to capture and analyze data from OT equipment has widened the cyberattack surface. Meanwhile, industrial operations continue to rely on legacy equipment that wasn’t designed with protections against cyber dangers.
These issues create vulnerabilities that threat actors are only too happy to explore. Hacker groups sponsored by nation-states or terrorist organizations are of particular concern because they may choose high-profile, critical infrastructure targets.
How to bolster IT/OT cybersecurity
There are ways to address the situation. Hardening critical infrastructure is possible through planning and investment at the data center. Effective OT cyber defenses require a multilayered, integrated approach that considers the environment’s vulnerabilities and addresses internal and external threats.
Existing cybersecurity frameworks should start to play a bigger role in decision making for data center managers. For example, IEC 62443 is a comprehensive set of cybersecurity standards for industrial automation and control systems that can be applied to the data center’s critical infrastructure.
Access cybersecurity resources
Organizations grappling with how best to secure their OT environments can get help from technology and service providers, including Schneider Electric, which offers a full set of services designed to protect OT environments. Schneider Electric’s Cybersecurity Application Platform (CAP) provides an integrated cybersecurity solution, enabling operations teams to have real-time visibility of their cybersecurity environment while reducing the complexity of OT environments. Schneider Electric also has developed partnerships with leading technology vendors, including our collaboration with OT cybersecurity leader Claroty.
To develop a game plan on how to strengthen IT/OT security, access White Paper 216, Cybersecurity Guidance for Data Center Power and Cooling Infrastructure Systems. It features a checklist to minimize cybersecurity risks in data center operations.
