Australian Industries Need OT-IT Convergence to Beat Attacks

Australian critical infrastructure organizations must enable greater convergence between their information technology and operational technology teams to better respond to cybersecurity threats to their OT infrastructure, according to a new study by Palo Alto Networks.

See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge

The cybersecurity company said cyberattacks on OT systems owned and operated by critical infrastructure organizations could result in “significant and immediate business impact” and cause a shutdown lasting days or even weeks – something that such organizations or governments can ill-afford.

As critical infrastructure companies provide essential services to the wider public – such as railroads, electric power, water supply and transportation – a successful cyberattack on these organizations could mean significant financial gain or geopolitical impact for attackers.

“The high-risk nature of industrial operations means that safeguarding an OT environment is essential not only for business continuity, but also for national security,” the company said.

Palo Alto Networks’ warning arrives a few months after a major cyberattack forced Dubai-based DP World, which handles roughly 40% of Australia’s international container cargo each year, to close ports in Sydney, Melbourne, Brisbane and Fremantle. The national cybersecurity coordinator said the cyberattack was “nationally significant” (see: Major Australian Ports Affected by Cyber Incident).

Earlier in May, Australian east coast electricity provider Ausgrid said it could lose up to $2 billion a day if a major cybersecurity incident causes a complete shutdown of its infrastructure and disrupts people’s livelihoods (see: Aussie Energy Giant Fears Losing Billions to Cyberattacks).

Researchers said 3 in 4 organizations have experienced a cyberattack on their OT environment, and some have experienced a number of attacks that is above the global average. Considering the scale at which industrial facilities operate, a shutdown could mean lost “revenue opportunities, as well as damage control and event remediation costs, which can include additional security technologies and services, communications with customers and suppliers, law enforcement, and public relations,” Palo Alto said.

“Longer-term costs can include reputational damage, regulatory penalties, higher insurance premiums, and supplier and customer costs due to late or non-deliveries, among others,” the researchers warned.

Palo Alto said OT infrastructure operators need to understand the threat landscape and the factors that motivate hacking attacks and find appropriate solutions to counter the threats and minimize the risks to OT. “Industrial environments can differ significantly, presenting a highly fragmented ecosystem with different risk tolerance. Understanding the target, as well as the threat landscape, goes a long way to building an effective defense,” it said.

The foremost challenge in building a resilient OT infrastructure, the company said, is that OT and IT teams typically operate in silos and have different priorities to address. While IT teams have traditionally been in charge of security companywide, OT teams have exclusively focused on industrial operations.

Because of the discrepancy in their historical roles, IT and OT teams rarely collaborate when making purchase decisions for OT cybersecurity products – a factor that goes against the concept of shared responsibility for the security of industrial assets.

A survey of technology leaders by Palo Alto Networks found that in a majority of industrial organizations, IT and OT teams make independent cybersecurity decisions and even when they meet, they struggle to align their views or make joint decisions.

“This difficulty in coordination is a significant obstacle that can impede the successful deployment and operation of OT cybersecurity,” Palo Alto said. “A piecemeal approach to cybersecurity will help neither IT nor OT, regardless of the caliber of solutions invested in, resulting in the continued exposure of vulnerable OT assets.”

A Rockwell Automation-Claroty survey also found that only 1 in 5 industrial organizations in Australia reported a high level of collaboration between IT and OT teams, based on the perception that disconnected OT systems operated independently of IT systems. But with the influx of internet-connected OT devices, that assumption no longer holds true.

“It has therefore become incumbent on OT operators to ensure they are operating in line with security standards that apply across the broader IT environment,” the survey said.