Trends in IT and OT: grip on growth or 'out of control'?
Vulnerabilities of our IT and OT infrastructure to cyber attacks are a major reason for limiting the growth of industrial Ethernet. Further digitization of operational technology seems to be slowing down. Current growth in the OT market comes more from the development of Internet of Things (IoT). Gartner predicts that by 2020, around 20 billion devices will hang on "the IoT network," with vendor revenue exceeding $300 billion.
Gartner also listed 10 IT trends for 2018 and beyond. Gartner's analysis shows that the world is seeing a growing interaction between the 10 trends listed. An interaction that is driving and strengthening innovation across industries. This is good news for the security of the world of Operational Technology (OT, (I)IoT, ICS/SCADA) but also for the necessary interoperability between the growing number of systems communicating with each other and high availability. Wonderful, all those opportunities and innovations: but how do you keep a grip on the growth and prevent a proliferation? Especially when it comes to OT security, you can't be too careful! The answer is architecture. Architectural thinking gives this direction, structure and handles prioritization.
What is the impact of all the innovations?
First, the main impact of the innovations mentioned:
More and more smart devices, sensors, networks are being connected. This is already no longer news. We do see an acceleration from industrial factories to software-led factories, to mobile monitoring and factory management being done more and more remotely; with IoT providing the ability to have insight into data from any location, so that better and better, faster and "remote" decisions can be made.
The trend of Artificial Intelligence (AI) is supported by collecting data from machines and sensors. But combining huge types of data in different formats requires a new data infrastructure with new technologies for data transport and analysis. Related to this is the trend from central and Cloud solutions for data storage and processing to Edge computing.
Information processing comes closer to the source of this information, or distributed in the (own) network, meeting challenges for connectivity, latency, bandwidth limitation and functionality. Keeping this all under control requires a good governance framework. Besides simple tasks such as updates, this also involves the complex management of devices and of the use of all that information. This is one of the (main) reasons for IT and OT to work better together, up to the CIO level; where traditionally IT and OT are separate domains.
Besides governance, the second reason for collaboration is the trend of making analytics tools more accessible to end users, domain experts and operators at a plant. Meanwhile, security remains the biggest concern for organizations. Organizations often have little control over their hardware and software, for the new (IoT and Industrial IoT), as well as the old (ICS/SCADA, legacy systems). This relates to the trend toward more trusted hardware and software combinations in the OT, with learning from IT and collaboration with security information officers in system acquisition decisions.
The impact mentioned above shows that there is still some organizing and arranging to be done before opportunities arising from the new IT trends can actually be monetized in OT systems.
Keep a grip on IT and OT with the help of architecture
Working under architecture is not new. This means that there is already a lot of experience, but mainly in the IT domain and actually hardly in the OT domain. A well-known framework for architecture is TOGAF. TOGAF provides a structure and processes through which architecture can be created and managed. The situation determines which TOGAF handles are appropriate. However, for the use of architecture in the OT domain, it is necessary to complement the chosen handles with best practices and standards for architecture and governance, as we are already familiar with from the ICS/SCADA world. Examples include NIST (SP800-82), Center for the Protection of National Infrastructure (CPNI), NCCIC/ICS-CERT. For IT-OT governance, the frame of reference is a combination of ITIL, ASL and Asset management.
The biggest gain from the proposed approach to architecture in the IT/OT domain will be improved decision-making, with access to a greater amount of high-quality data in both "traditionally separate" worlds. This requires a new way of thinking on both sides, for example (source: The Industrial Ethernet Book): making explicit differences between OT and IT hardware and software, naming benefits in IT and OT alignment, the challenges in this alignment, how to deal with data-intensive solutions, as well as the management and security of this technology, just to name a few.
Getting started with architecture in the OT domain will be quite difficult at first, but is highly necessary. The trends mentioned above are pushing through and will really create growth in the OT domain. The choice is yours: controlled growth or rather proliferation?
Related insights
