IT vs. OT
What’s the difference?
Operational technology (OT) cybersecurity is a fairly new and challenging field. Traditional informational technology (IT) is well established with many resources that can and should be used for OT, but traditional IT misses out on the nuances of OT that make it different from the more modern and mature IT systems. IT and OT systems have a lot in common, but they are different enough that diverse skill sets are required for each. Defining what IT and OT are and how they relate to one another allows for a better understanding of these nuances and solutions.
Informational Technology (IT)
IT includes familiar and essential systems like email, website hosting, database storage, etc. These systems must run to keep the enterprise operating.
IT systems often include:
- Workstations
- Servers
- Printers
- Personal devices
- Network switches & routers
- Onsite & cloud storage devices
IT systems are heavily guarded, with dedicated teams of people whose sole focus is to keep the IT teams up and running and productivity at its highest possible level. Because IT teams, particularly in larger global companies, are attacked daily, and likely deal with thousands of service requests per week, their records and metrics often speak directly to the necessity of the IT team and their need to expand or gain funding. The IT technician’s most common service ticket might be for someone who can’t log in to their email service because they forgot their password. If a major mistake is made on the IT network, services may be offline for a while, but the data is generally still there when the service returns. In the event of an attack, corporate intellectual property or client personally identifiable information (PII) may be compromised and sold to facilitate fraud or encrypted to extort payment from the institution (ransomware).
IT Cybersecurity Risks
Downtime or compromise due to a criminal attack or data breach can result in:
Operational Technology (OT)
OT includes control systems and their networks in our physical environment, such as HVAC and lighting, that perform various tasks around the facility, not just data.
OT systems often include:
- Environmental control (HVAC)
- Elevators
- Lighting control
- Access control
- Video surveillance
- Digital signage
If OT systems stop operating, the lights may go out, doors may not unlock (or may remain unlocked), human-occupied spaces may see extreme temperature fluctuations, IT equipment may overheat, elevators may stop running, etc. Chain events can also occur, such as the range hoods in the kitchen stop evacuating smoke, which may cause the fire alarm to trip, which may cause the building to be evacuated. While the average facilities manager, who is generally responsible for the building OT systems and networks, will more often have to answer calls for service due to a hot or cold occupied space, there is a lot more to these systems than the normal day-to-day metrics might indicate.
OT Cybersecurity Risks
Downtime or compromise due to a criminal attack or data breach can result in:
IT-only cybersecurity is not enough to address OT risk
Many IT firms have attempted to provide smart building solutions and services related to controls systems and have failed. This is because:
- Cybersecurity differs from enterprise IT at the building level, and traditional technology and practices simply do not work.
- Vulnerability, fragmentation, and inconsistency from building systems and contractors are evident in the disorder of the IT components in building systems.
- Traditional IT and IoT solutions, companies, and professionals lack the technical knowledge and contextual awareness to properly manage and monitor OT systems.
IT-OT Managed Services
OT specialists should be brought on or developed to complement the IT team and focus on the specific peculiarities and criticalities of OT environments. Our subject matter experts can help ensure that the specific needs of your OT systems are being met. This means protecting your enterprise (IT) and operational systems, ultimately enhancing your business.
IntelliNet managed services continuously monitor your OT systems to identify and address both IT and OT issues that may impact your building risk and operations.