Theresa: Does the convergence of IT and OT make it more or less vulnerable to cyberattacks?
Grant: That's an interesting question because historically, OT environments were air-gapped from IT environments. I once heard that an air gap is a low-latency network, meaning that if business needs to happen, people will figure out a way of connecting the environments, whether it's having a workstation with an Ethernet cable into the IT network and another Ethernet cable into the OT network. Or they'll have a rogue access, or they'll put in USBs.
The advantages to be gained through digital transformation and convergence, whether they're in the public or private sector, are too high to be ignored. The key is how organizations do it safely and securely with good safe architectures in mind.
We're going to see a lot of converged OT/IT architectures where it will be important to have virtual zones, microsegmented environments, and what are known as zero-trust network architectures. These let users get to the assets they need, but you can prove they’re who they claim to be, and they have the rights to access those assets.
Theresa: What are other lessons learned not just from these two high-profile incidents, but also from the many cyberattacks we don't hear about in the headlines?
Grant: What is clear for any asset owner or operator is that you're going to have a variety of brownfield equipment that can’t be easily replaced due to technology obsolescence periods. It may not be patchable due to maintenance windows.
So, it’s clear that air gap is not the answer. You need to benefit from digital transformation efficiencies, but it needs to be done in a secure way.
Another lesson is understanding that it's a journey. Know your inventory of assets and which of those are vulnerable. It's a long game of reducing the inherent risks of those assets, and then monitoring for threats for the residual risk that remains.
A third lesson is how important it is to make sure your remote access is secure remote access. Make sure a users’ credentials to get into the environment can't be stolen by cyberthieves.