IT and OT need to communicate, especially when responding to threats

Listen up—let’s have a conversation.

That’s what IT and OT divisions should be saying to one another, but all too often wires get crossed. And that presents opportunities for attackers, Dragos SVP of Intelligence and Services Kurt Gaudette told IT Brew at last month’s RSAC.

“Hey, we’ve got to get this done together,” Gaudette said. “Let’s build security for IT and OT.”

Closed off. Most departments would reach out to IT for help. But OT has traditionally been stubborn and resistant to an open door between the two—an attitude that Gaudette said is unfortunately shared by their counterparts. And with OT, often the way that attack is manifesting itself just looks like an error that they can manually change. That’s a management problem, and one that has some major hurdles to get past.

“There’s definitely a divide between IT and OT,” Gaudette said, “a general understanding, both from the IT side of the house, of what OT is, and from the OT side of the house, a trust perspective of ‘Why are these IT guys messing in my environment?’”

Industrial OT has long been a problem area for defenders. And with the increase in usage of technology like robotics across the entire economy, the threat surface is only increasing. Communication is key.

Open the channels. To Debbie Gordon, co-founder and CEO of attack simulator Cloud Range, this is in large part because the OT side tells IT cyber is their job and IT has no interest in meeting with their OT counterparts. One exercise her team led at a large energy company, Gordon said, was the first time the OT and IT teams had ever met.

“They’re dealing with an attack that came from one side to the other, and it was kind of scary,” Gordon said.

There are solutions available, and they all start with communication, Gaudette said. Dragos is often asked to broker the relationship between the two sides, leading to giving advice on how to establish an action plan if the OT side is attacked.

“Having an incident response plan forces everybody to actually talk about things,” Gaudette said.