Cyolo, in partnership with Ponemon Institute, recently released a global study exploring how organizations that operate critical infrastructure, industrial control systems (ICS), and other operational technology (OT) systems are managing access and risk in an era of rising connectivity.
The report, Managing Access & Risk in the Increasingly Connected Operational Technology (OT) Environment, reveals that many industrial organizations lack the resources, expertise, and collaborative processes to effectively mitigate threats and ensure secure access to OT systems.
OT systems were historically isolated for security reasons, but are now facing increased connectivity. At the same time, more third-party vendors and contractors are being given remote access to OT environments. These shifts introduce serious new risks that can leave organizations exposed to safety and security threats if access and connectivity are not properly controlled.
Key findings from report include:
- Organizations allow dozens of third-party users to access OT environments, with 73 percent permitting third-party access to OT environments, with an average of 77 third parties per organization granted such access. Challenges to securing third-party access include preventing unauthorized access (44 percent), aligning IT and OT security priorities (43 percent), and giving users too much privileged access (35 percent).
- Visibility into industrial assets is dismal, with 73 percent lacking an authoritative OT asset inventory, putting organizations at significant risk.
- IT and OT teams share responsibility for OT security, but do not communicate enough to achieve optimal outcomes. The report found that 71 percent report that IT or IT and OT together are responsible for securing OT environments. However, collaboration and communication are lacking, with 37 percent reporting little or no collaboration, and 19 percent reporting that teams talk about OT security issues only when an incident occurs.
- Security is seen not only as a goal of IT/OT convergence, but also as an obstacle. Reducing security risk is the top objective of companies pursuing IT/OT convergence (59 percent), and yet one-third (33 percent) of organizations not pursuing convergence cite security risk as a top factor for their decision.
“We are at a crucial point in the evolution of OT security, and the need to secure access to critical systems from internal and external threats is more urgent than ever. The stakes are exceptionally high, as a breach could jeopardize not just data but also the functioning of critical infrastructure, risking the safety of workers and the environment,” said Joe O'Donnell, Executive Vice President of Corporate Development and General Manager of OT at Cyolo.
“This research reveals a pressing need for new approaches, especially in areas like third-party and privileged access, the security of legacy systems, and collaboration between IT and OT teams. Cyolo is dedicated to supporting organizations in navigating these challenges and working towards a secure, resilient future for OT environments.”
Access the full report here.
