#42 IT vs OT in Cyber security

How do IT and OT Cyber security Differ?

Operational technology (OT) is hardware and software that detects or causes a change through the direct monitoring and control of industrial equipment, assets, processes, and events. In contrast, information technology covers the entire spectrum of technologies for information processing, including software, hardware, communications technologies, and related services

related services. Before we delve into the cyber security challenges affecting the maritime industry, let’s take a step back and examine some of the differences between IT and OT systems. Some of the differences in system requirements include:

Differences in System Requirements

	IT System Requirements	OT System Requirements
Performance	Non-real-time Response must be consistent Less critical emergency interaction Tightly restricted access control can be implemented to the degree necessary for security	Real-time Response is time-critical Response to human and other emergency interaction is critical Access should be strictly controlled, but should not hamper or interfere with human-machine interaction
Availability/Reliability	Responses such as rebooting are acceptable Availability deficiencies can often be tolerated, depending on the system’s operational requirements	Responses such as rebooting may not be acceptable because of operational requirements Availability requirements may necessitate redundant systems
Risk Management	Manage data Data confidentiality and integrity is paramount Fault tolerance is less critical – momentary downtime is not a major risk Significant risk impacts may lead to delays in ship clearance, loading/unloading, business operations	Control physical world Human safety is paramount, followed by protection of the process Fault tolerance is essential; even momentary downtime may not be acceptable Major risk impacts are regulatory non-compliance, environmental impacts, harm to the crew on board, equipment and/or cargo
System Operations	Systems are designed for use with typical operating systems Upgrades are straightforward with the availability of automated deployment tools	Differing and possibly proprietary operating systems, often without security capabilities built-in Software changes must be carefully made, usually by software vendors, because of the specialized control algorithms and modified hardware and software involved
Resource Constraints	Systems are specified with enough resources to support the addition of third-party applications such as security solutions	Systems are designed to support the intended industrial process and may not have enough memory and computing resources to support the addition of security capabilities
Communications	Standard communications protocols Primarily wired networks with some localized wireless capabilities Typical IT networking practices	Many proprietary and standard communication protocols Several types of communications media used, including radio, satellite Internet, ship to shore, ship to ship, VoIP Networks are complex and sometimes require the expertise of control engineers
Component Lifetime	3 to 5 years	10 to 15 years
Component Location	Components are usually local and easy to access	Components can be isolated, remote, and might require extensive physical effort to gain access to them

From a cyber-security perspective, OT and IT are different in several ways. On staffing, there is a cyber-security specialization on the IT side. Professionals have been specifically trained and certified in application security, network security, or other security disciplines. In OT, those tasked with security are usually operational technology people. As part of their day job, they have to also deal with security it's an add-on, not a specialization.

OT and IT are different, especially in attack outcomes. An attack on IT could lead to data theft, while an attack on OT could lead to injury or loss of life, asset damage, or environmental impact. Traditional cyber security measures fail to protect vessels from cyber-attacks and leave the OT network exposed, falling short on providing the visibility and protection required for cyber-physical processes underlying in the maritime industry. And with the convergence of IT and OT, organizations must balance the use of traditional IT security tools at the network and endpoint layer with specialized security tools designed for OT requirements.