It is becoming increasingly clear that no organization is safe from cybersecurity risk. Operational technology (OT) assets are increasingly proving to be appealing targets for malicious entities, evidenced by many high-profile attacks in recent years.
Further complicating this scenario, Emerson’s Alexandre Peixoto explains in his recent article in Smart Industry, is the fact that as OT adapts to this new normal, they are also seeing a parallel evolution in the way their architectures are now built. Today, traditional OT architectures are shifting, moving away from a siloed-by-design structure and toward integration between OT technology and external systems, including the cloud.
To meet this paradigm shift head on, OT teams need new cybersecurity tools designed to support—not simply limit—connectivity. That doesn’t mean they need to throw out everything they’ve already done; however,
“While the traditional defense-in-depth architectures will still apply, a move toward a foundational zero trust cybersecurity architecture is likely to happen in parallel.”
As Alexandre shares, the shift to zero-trust cybersecurity will not happen overnight, however, teams can already start planning the strategies that will make implementation of zero-trust solutions easier as they evolve in coming years.
A challenging path
Many organizations have heard of zero trust, but as they explore the marketplace to find zero-trust technologies they can implement, they come up empty handed.
Much of this challenge stems from the fact that zero trust is a new approach to cybersecurity. It’s not a device or appliance. It’s not a single piece of software.
“Instead, teams wanting to implement zero trust cybersecurity need to commit to a journey that will evolve in the coming years, and they must do so in collaboration with the solution providers supporting the technologies they rely upon. The journey will not necessarily be simple, but it will be worth the effort, and those who start today will be far ahead of the curve and much more secure as threats increase in intensity and cadence in coming years.”
So how does that journey start? Like any good journey, it starts with knowing where you are. Teams hoping to implement zero-trust cybersecurity solutions need to perform thorough assessments to understand their current cybersecurity posture—both what they are doing well, and the areas where they need improvement.
Once the team knows where it is, they can start implementing the solutions that already exist.
“To start this stage, the organization should ensure it has implemented the basic solutions that every team should have in place. Account management, segmentation of networks and duties, recovery and incident response plans, and endpoint protection are all elements of the baseline for success.”
When those basics are in place, they can finally begin exploring some of the more advanced technologies that are available today.
Every challenging journey needs a guide
Like any technology journey, the move toward a zero-trust cybersecurity posture will render some legacy technologies obsolete. However, that doesn’t mean teams should expect the zero-trust journey will require a complete rip-and-replace of their existing solutions. Many of the defense in depth strategies teams already use will be critical for maintaining security posture. Moreover, not every zero-trust solution will be ready from the earliest stages to support the demanding requirements of a real-time, low-latency, high-availability OT environment.
This, Alexandre explains, is where a trusted automation solutions partner can be invaluable.
“Teams should work closely with their automation solutions provider to be sure they are implementing the best protections available for their automation investments across the lifecycle. This type of partnership not only ensures the OT team is implementing technology appropriate for their unique architecture, but it also helps confirm the solutions provider is continually developing solutions designed to support zero trust architectures as part of their lifecycle development plan. The most advanced automation solutions providers will view cybersecurity as part of the design process—central to everything they do—rather than something they add on at the end of product development.”
For example, zero-trust cybersecurity is a core component of Emerson’s Enterprise Operations Platform (EOP). As Emerson designs (EOP) software for seamless integration and extensive data mobility from the intelligent field, through the edge, and into the cloud, secure communication is a critical enabler. EOP solutions teams implement today will not only provide the best cybersecurity posture available but will be designed as part of Emerson’s long-term zero-trust vision for OT cybersecurity.
