Culture divide blocks unified security strategy

Dragos, Inc. has released “The 2021 State of Industrial Cybersecurity: The Risks Created by the Cultural Divide Between the IT & OT Teams” report from the Ponemon Institute. The new annual report found only 21% of organizations have achieved full maturity of their ICS/OT cybersecurity program, in which emerging threats drive priority actions and C-level executives and the board are regularly informed about the state of their OT security.

As the frequency and severity of attacks increase, organizations are struggling to keep ahead of these threats, according to the survey of 603 IT, IT security, and OT security practitioners at the managerial, director, and C-level. The report finds that 63% of organizations had an ICS/OT cybersecurity incident in the past two years, and it took an average of 316 days to detect, investigate and remediate the incident. Digital transformation and trends in Industrial Internet of Things (IIoT) have greatly expanded cyber risk to the OT and ICS environment according to 61% of respondents who either agree or strongly agree.

The study reveals a cultural divide between IT and OT teams that affects the ability to secure both the IT and the ICS/OT environment. Only 43% of organizations have cybersecurity policies and procedures that are aligned with their ICS and OT security objectives. Thirty-nine percent have IT and OT teams that work together cohesively to achieve a mature security posture across both environments. Just 35% have a unified security strategy that secures both the IT and OT environments, despite the need for different controls and priorities.

“Most organizations lack the IT/OT governance framework needed to drive a unified security strategy, and that begins with the lack of OT-specific cybersecurity expertise in the organization,” said Steve Applegate, Chief Information Security Officer, Dragos, Inc. “Bridging the cultural divide between IT and OT teams is a significant challenge. But organizations must not fall into the trap of thinking that OT can just be tacked onto an existing IT program or managed under a general IT umbrella. There are fundamental differences between the problems and goals of a corporate IT environment—data safety and security—and industrial environments, where human health and safety, loss of physical production, and facility shutdowns are real risks. Deep domain expertise as well as ICS/OT-specific technologies are both required to truly safeguard industrial systems.”

“A majority of C-level executives and boards of directors are uninformed about the efficiency, effectiveness and security of their ICS/OT cybersecurity programs,'' said Dr. Larry Ponemon, Chairman and Founder, Ponemon Institute. “If the board isn’t keenly aware of the impact a cybersecurity incident would have on the bottom line, securing the appropriate amount of budget for OT programs is much more difficult. As evidenced by the report, this stems from a lack of clear ownership for ICS/OT risk and who reports that to the board between engineering, IT, and CISOs.”

Cultural differences, technical barriers, and lack of clear ownership are primary challenges for OT and IT collaboration

The findings of the report suggest that misunderstanding between the groups, rather than conflict, is the significant issue. Only 32% cite competition between IT and OT for budget dollars and new security projects and only 27% have difficulty in converging security teams across IT and OT as an enterprise-wide security program.

• Half of respondents state that cultural differences between engineers, security professionals, and IT staff are the main challenge.

• 44% say there are problematic technical differences between traditional IT-specific best practices and what is possible in OT environments, such as patch management and unique requirements of industrial automation equipment vendors.

• 43% of respondents say there is a lack of clear “ownership” on industrial cyber risk and uncertainty around who leads the initiative, implements the controls and supports the program.

The risks created by the cultural divide between the IT and OT teams

• The level of cybersecurity maturity for ICS/OT is inadequate to meet today’s challenges. Only 21% of respondents say their ICS/OT program activities have achieved full maturity, where emerging threats drive priority actions and C-level executives and the board of directors are regularly informed about the state of their program. Half of organizations are in the early and middle stages, while the remaining 29% are late-middle stage.

• C-level executives and the board of directors are not regularly informed about the efficiency, effectiveness, and security of the program. Only 35% of respondents say someone responsible for ICS and OT cybersecurity reports IT and cybersecurity initiatives to the board of directors. Of these respondents, 41% say such reporting takes place only when a security incident occurs.

• Many senior managers lack awareness of the risks and threats to the OT and ICS environments, resulting in inadequate resource allocation to manage risk. Less than half (48%) of respondents say their organizations understand the unique cyber risks and have specific security processes and policies for OT and ICS environments. Only 43% of respondents say senior management understands the cyber risks and provides enough resources to defend OT and ICS environments.

• Reporting relationships and accountability for OT security are not properly structured and become deterrents to investing in OT and ICS. Fifty-six percent of respondents say the reason for blocking investments is that OT security is managed by the engineering department which does not have security expertise, and 53% of respondents say OT security is managed by an IT department without engineering expertise. Only 12% of respondents say the CISO is most accountable for the security of the ICS/OT program.

Consequences of an OT cybersecurity incident

The loss of confidence in the system was the number one consequence of a cybersecurity incident, reported by 54%, followed by sustained process inefficiency (49%), and loss of control availability (47%). Additional consequences include:

• Loss of visibility in the physical process; 41%

• Loss of revenues; 40%

• Loss of public confidence; 32%

• Unintended, catastrophic process failures; 30%

Despite the challenges, organizations are focused on making investments to improve the cybersecurity posture of ICS and OT environments. Investments in areas that assess weaknesses in the security posture of OT environments are the top priority according to 60% of respondents. Contributing to the security posture is gathering threat intelligence specific to their industry, ICS and OT devices, and geography, (56%), and hiring experts in OT and ICS cybersecurity (49%).