IT vs. OT Differences, Superficial vs. Fundamental

What is the difference? Ransomware hits our IT network and what do we do? We detect, respond, and recover. We identify the affected computers and isolate them. We take forensic images for the security analysts, and we erase the equipment. We restore from backups. We repeat. This costs time and effort. The attack may have stolen intellectual property and/or personally identifiable information (PII), and we suffer lawsuits as a result. These are all business consequences. Said another way, on IT networks, the goal for managing cyber risk is to prevent business consequences by protecting the information – protecting the confidentiality, integrity, and availability of business information.

On OT networks, however, the worst-case consequences of compromise are very often physical. Explosions kill people, industrial malfunctions cause environmental disasters, the lights go out, aircraft drop out of the sky, or our drinking water is contaminated. The cyber risk management goal for OT networks is generally to assure correct, continuous, and efficient operation of the physical process. The goal is not to “protect the information” but rather to protect people, the environment, physical assets and physical operations from information, more specifically from cyber attacks that may be embedded in information. The fundamental difference between IT and OT networks is that neither human lives, damaged turbines, nor environmental disasters can be “restored from backups.”