Operational Technology, or OT, is everywhere. It powers the conveyor belts that produce medicine, controls industrial machines, and continues to run on ageing systems like Windows XP in sensitive infrastructure such as nuclear facilities. Unlike IT, OT directly interacts with the physical world, making its security both essential and uniquely difficult.
Nice picture explaining the convergence of IT & OT - "While IT focuses on data and business processes, OT is dedicated to the control and monitoring of physical operations... Convergence of IT/OT generally means that the OT network is now accessible from the outside world via..." pic.twitter.com/i9RrWrr1hb
— Private Networks (@PrivNetTech) May 5, 2025
Michael Nee, a security researcher, recently delivered his first conference talk titled OT Security is Hard at BSidesROC. In his presentation, he explored the foundations of OT security and shared lessons from his own journey transitioning into this critical field. His focus began at the very first step of security: asset management. It is a step that is often underestimated but essential for protecting OT environments, many of which rely on hardware and software that have been in place for decades.
Traditionally, OT environments did not prioritise cybersecurity in the way that IT environments did. That began to change dramatically after incidents like Stuxnet highlighted the vulnerabilities of industrial systems. However, improving security in OT is not as simple as applying IT solutions. Systems are often fragile, designed to run for years without interruption, and frequently lack modern security architecture. Introducing updates or changes without breaking essential operations remains a significant challenge.
Michael's talk addressed how the OT industry is gradually moving towards adopting IT tools and techniques, but with caution. Success in this area depends on working closely with site teams and maintaining accurate, real-time inventories of assets. Many common IT approaches need to be adapted to account for the nuances and constraints of operational environments.
His story will resonate with anyone stepping into OT security from an IT background. It is an honest look at what works, what fails, and what still needs to be figured out. It also underscores the importance of building OT security practices on a foundation of understanding and respect for the systems already in place.
If you're working in or around OT, or thinking about shifting your focus toward securing industrial systems, this presentation is a valuable watch.
Watch Michael Nee's talk, "OT Security is Hard", embedded below:
Comments
Post a Comment