OT security is gradually improving, but security gaps still exist in many organizations. When asked about the maturity of their organization’s OT security posture, only 21% of organizations have reached level 4, which includes leveraging orchestration and management. Notably, a larger proportion of Latin America and APAC respondents have reached level 4 compared to other regions.
The report found that a vast majority of organizations use between two and eight different vendors for their industrial devices and have between 100 and 10,000 devices in operation, adding complexity. For Indonesia, the report found that 12% of Indonesian OT organizations have between 1,000 – 10,000 IP-enabled OT devices in operations. Local organizations face challenges with using multiple OT security tools, further creating gaps in their security posture.
OT Security is a Corporate-Level Concern
As OT systems increasingly become targets for cyber criminals, C-level leaders recognize the importance of securing these environments to mitigate risks to their organizations. Industrial systems have become a significant risk factor since these environments were traditionally air-gapped from IT and corporate networks, but now these two infrastructures are becoming universally integrated. With industrial systems now being connected to the internet and more accessible from anywhere, organizations’ attack surface is increasing significantly.
With the IT threat landscape becoming more sophisticated, connected OT systems have also become vulnerable to these growing threats. This combination of factors is moving industrial security upward in many organizations’ risk portfolio. OT security is a growing concern for executive leaders, increasing the need for organizations to move toward full protection of their industrial control system (ICS) and supervisory control and data acquisition (SCADA) systems.
Best Practices to Overcome OT Security Challenges
Fortinet’s global 2022 State of Operational Technology and Cybersecurity Report indicated ways organizations can address OT systems’ vulnerabilities and strengthen their overall security posture. Organizations can address their OT security challenges by:
Establish Zero Trust Access to prevent breaches. With more industrial systems being connected to the network, Zero Trust Access solutions ensure that any user, device or applications without proper credentials and permissions are denied access to critical assets. To advance OT security efforts, Zero Trust Access solutions can further defend against both internal and external threats.
Implementing solutions that provide centralized visibility of OT activities. Centralized, end-to-end visibility of all OT activities is key to ensuring organizations strengthen their security posture. According to Fortinet’s report, top-tier organizations – which make up the 6% of respondents who reported no intrusions in the past year – were more than three times as likely to have achieved centralized visibility than their counterparts who suffered intrusions.
Consolidating security tools and vendors to integrate across environments. To remove complexity and help achieve centralized visibility of all devices, organizations should look to integrate their OT and IT technology across a smaller number of vendors. By implementing integrated security solutions, organizations can reduce their attack surface and improve their security posture.
Deploying network access control (NAC) technology. Organizations that avoided intrusions in the past year were more likely to have a NAC in place, ensuring that only authorized individuals can access specific systems critical for securing digital assets.
Securing OT Environments with the Fortinet Security Fabric
For more than a decade, Fortinet has protected OT environments in critical infrastructure sectors such as energy, defense, manufacturing, food, and transportation. By designing security into complex infrastructure via the Fortinet Security Fabric, organizations have an efficient, non-disruptive way to ensure that their OT environment is protected and compliant.
