“Information Technology (IT) and Operational Technology (OT) security require varying approaches, but both are crucial to maintaining a safe and secure healthcare environment. As a result, organisations should not forget to prioritise OT security alongside its IT security efforts.”
IT and OT cyber security require varying approaches, but both are crucial to maintaining a safe and secure healthcare environment. From a traditional CIA triad perspective, IT and OT are fundamentally different, while IT security focuses on safeguarding electronic data confidentiality, OT security focuses on device availability and data integrity. But as digital transformation efforts and the Internet of Things (IoT) take hold across the healthcare sector, many organisations have and continue to converge IT and OT in order to streamline workflows and increase functionality through the connectivity of digital and physical environments. While this convergence can reduce inefficiencies and help organisations reduce costs, it also presents additional cyber security risks.
With increasing cyber security risks, tougher regulations, and complex interconnected system environments, organisations need a simple, centralised way to administer enterprise cyber security that encompasses both OT and IT.
Perception (What is happening?)
Comprehension (Why do I care?):
In the context of an organisation with no or limited OT cyber security risk management, CNB Tel recommends a holistic approach when defining an effective OT cyber security risk management strategy/programme.
The first step in this journey is to understand risk and consequences to the organisation. At a basic level, this means identifying the most critical OT functions essential to fulfilling the organisation’s business operations, and the potential consequences of a cyber attack against them. The knowledge of an organisation’s system custodians and engineers should be leveraged to identify methods an adversary could use to compromise critical OT functions. This valuable knowledge includes technical system architecture details, procedural and ways of working insights, like logical user access, third-party service provider scope, supply chain considerations, physical security etc. Real-world cyber scenarios seen across industries should be considered, of course, not all will be applicable, but to ensure completeness and due diligence they should be considered.
The ultimate aim of this initial analysis is to identify and prioritise risks that result in high-consequence events for the organisation. It also provides a high-level snapshot of current risk exposure and whether this exposure is within or out of organisational risk appetite/tolerance. Any subsequent OT cyber security strategy/programme and risk mitigations should be aligned accordingly with this analysis to ensure tangible risk reduction that is outcome focused. This approach helps organisations justify OT cyber security improvements and the associated costs by being armed with better information and understanding of “What, Why and How?”
The second stage in the journey sees the definition and establishment of an overarching OT Cyber Security Framework (OT-CSF) that delivers formalised policies, procedures, datasets, work instructions and best practice guidance designed for OT cyber security risk management. The OT-CSF should be aligned accordingly with guidance provided within industry frameworks such as:
The scope and depth of the OT-CSF must be realistic and defined based on factors such as plausible operational business risk and regulatory compliance requirements. An overburdensome OT-CSF may deliver perfect cyber security on paper, but in reality, will likely be ignored or worked around rendering it ineffective. At a minimum, an OT-CSF should include:
The above represents a foundational level of controls that can be supplemented as organisational OT cyber maturity increases. Supplementary controls can be procedural or technology-based and include:
Knowing which business risks, regulatory drivers, and real-time operational insights to focus on is only the start of the OT cyber security journey. Organisations must also be realistic about their ability to execute and sustain a strategy/programme, therefore they should ask:
The ultimate aim is to reduce an organisation’s exposure to weaknesses and vulnerabilities that could be exploited by malicious threat actors. Additionally, greater awareness of cyber risk and formalised ways of working reduce the likelihood of cyber incidents caused by workforce error or misuse of OT assets.
Of course, one size does not fit all, therefore a focused process of discovery and risk assessment is paramount to identify an effective but sustainable blend of controls that meet business needs and address the cyber risks being faced.
Operating a Healthcare or medical asset without an appropriate OT cyber security strategy and relevant controls is high risk. To help you discover your level of risk exposure and to illustrate how we can support effective OT cyber security return on investment, get in touch for a free 30-min consultation.
Mon – Fri : 09:00 – 17:00
General Enquiries
Whatsapp/Telegram
Dubai – UAE
Seoul – Korea
Zhejiang - China
© Copyright 2024 CNB Tel. All rights reserved