The real danger isn’t always a threat actor crashing your systems with a decade-old PLC. Sometimes, it's your own employee doing their job. End of life (EOL) equipment is more than old hardware or software. It’s a risk to compliance, insurers and regulators, and uptime.
Obsolescence is something you can’t ignore because it'll inevitably impact your cyber risk. This article will help set you on the path to avoiding disasters by breaking down:
- What is obsolescence risk in OT environments?
- The safety risks associated with obsolescence in OT.
- The role visibility and context plays in obsolescence management.
- 5 most overlooked aspects of OT obsolescence management.
- Actionable steps to set your organization up for success.
What is Obsolescence Risk in OT Environments?
Obsolescence risk occurs when aging hardware and software are no longer supported by the manufacturer. Once they reach their end of life, they become a security risk. If they break, replacements are near impossible to secure. Some of the most critical consequences of obsolete equipment are unplanned downtime and increased operational costs.
Safety is Central to Obsolescence in OT
Aging equipment introduces significant safety risks. As the equipment nears its end of life, the trained personnel who know how to operate and maintain it also dwindle. This transforms a typical obsolescence challenge into a security and operator safety issue.
This is why maintenance must not only encompass the physical upkeep and updates of hardware and software. It must also include establishing clear policies and procedures for operating equipment safely at the end of its life cycle.
The Role Visibility Plays in Obsolescence Management
Asset visibility is the foundation of obsolescence management since you can’t address what you don’t know you have. Understanding the breadth and depth of what you have helps you determine the obsolescence risk.
Building a Base Foundation for Visibility
When conducting an audit of your assets, there are a few foundational pieces of information you need to provide:
- What is the equipment?
- Where is it located physically and logically?
- What does the equipment do?
- What is the equipment's function?
- What systems is it apart of?
- Who owns the system?
Once you’ve built the foundation, you can dive into the next level of visibility.
Understanding Multi-Dimensional Visibility
True visibility is multi-dimensional and it requires going beyond inventory to provide the necessary context for each asset.
Building on the starting point above, you must also understand the specific impact each asset has on your operation. This requires a deeper look into an asset's criticality, redundancy, and its role within your safety systems.
For example, a failure in a critical safety system or a vibration monitoring unit in a power plant carries a much higher risk—potentially including the loss of life—than a failure in a coal conveyor belt that can be manually bypassed with a front loader.
By identifying these intricacies of the operation, you can move from an equipment list to a meaningful map of operational risk.
Prioritization Through Data
It’s impossible to engineer every single risk out of a system. This is why prioritization is key. Visibility provides the data necessary to rank an asset list and determine which one requires immediate attention based on the contextual data you compile about that asset.
Your prioritization should be mapped directly against your corporate risk appetite. This includes taking geography, brand recognition, revenue generation, and financial impact of a specific production line or site in addition to the asset specific risk into account.
Using data to calculate empirical risk, your organization can make informed decisions about where to allocate its budget to protect the bottom line and ensure safe, continuous operations.
