The Fog at the IT-OT Border
Digital Transformation
The threats from emerging dual-use technologies always appear farther in the rear-view mirror before becoming closer than they appear in the side-view mirror. Technologies such as quantum computing, post quantum cryptography, and the convergence of information (IT) and operational technologies (OT) are prime examples of this reality. The paradigm shift from a process-oriented to a digitally-transformed focus requires a unified doctrine for integrated governance from device manufacturers and application developers to the end users and operators.
Fear of Security Implications to Operations
Concerns over performance overheads and impact to core functionality with built-in (agent-based or agent-less) endpoint security has delegated protection to bolted-on network-centric countermeasures. Such cyber physical systems (CPS) protection platforms provide threat management with deep-packet-inspection based network and application firewalls, network segmentation, threat-intelligence based intrusion detection and prevention systems (IDS/IPS), anomaly detection, security operations center (SOC) analytics, and response. However, risk management requires designing cyber resilience at the core with application security by design and policy based remote controls for agility.
Artificial intelligence (AI) and data-driven insights require data pipelines from level-0/1 field devices to level-3 OT services and GPU-powered edge gateways and cloud hosted micro-services platforms for data-driven analytics. Change is the only constant, and yet change is a deterrent in mission-critical operational environments and risk-averse business cultures. The true risks are in the status quo, not change. The IT-OT divide is real and the complexity in modernizing a large fleet of pre-existing brownfield and greenfield devices is a challenging journey. This, however, only emboldens the cybercrime syndicate with the rich arsenal of AI generated tools and attack vectors (Mythos AI). In an ecosystem with porous perimeters, invisible supply chains, opaque software bill of materials (SBOM), and dark data the imminent risks are greater than the sum of all fears.
OT ≠ IT
This is the inconvenient truth. The difference between information technology (IT) and operational technology (OT) must be viewed from the perspective of visibility, control, and lifecycle orchestration. While these viewpoints may appear to be trivial the inherent dichotomy between IT and OT is profound. It is not what has “not changed” but what “has changed” that has caused the IT-OT divergence problem to begin with. IT-OT systems have coexisted for many decades across industry segments. However, what has evolved are the requirements for visibility and control of cyber-enabled devices driven by threat and risk management in a cyber physical and connected ecosystem. Therein lies the dichotomy of policies, processes, and technologies between IT and OT, and the need for convergence to optimize the costs, methods, tools, and resources.
Overcoming the Challenges in IT and OT Alignment
Categorical horizontal and vertical trust in digital elements is required to implement digital trust in connected devices and achieve cyber resilience. The core objectives of embedded digital trust are:
- Verifiable and trusted machine identities
- Ensure scalability and availability with certificates and keys
- Interoperability across communications protocols in industrial automation
- Secure content distribution with proof of trustworthiness for patch management
- Trusted devices and data (metrics, events, logs, telemetry) for AI-driven insights, digital twins, and device shadows
Over the past decade, the cybersecurity industry has tried to solve an operational technology (OT) problem on devices with an information technology (IT) solution on the network. The wiring closet with IT-OT convergence is complex plumbing. The weaknesses and vulnerabilities on OT devices must be addressed head-on by the manufacturers with device and application security by design. The attack surface on autonomous and distributed cyber physical systems behooves a risk model based assessment of exposures and countermeasures.
The four pillars for digital trust in IoT/OT are security, availability, scalability, and interoperability between heterogeneous and multi-vendor devices in open, restricted, roaming, and air-gapped environments. The emerging edge and cloud based data driven analytics and insights will require (a) hardening brownfield and greenfield devices, (b) harvesting device data, (c) generating trustworthy training data for AI/ML engines at the edge or in the cloud, and (d) enriched metrics, events, logs, traces, and non-text data for SIEM and SCADA services.
The emerging standards for protection of critical infrastructures and cyber resilience, such as the Cyber Resilience Act (CRA), IEC-62443, and NIST 800- 53 specifications, are aimed at securing field communications and millions of OT devices in live production environments. The technologies and methods to consider include verifiable machine identities, efficient use of cost-effective cryptography, device lifecycle management, and supply chain provenance for over-the-air/network updates. In the coming decade, transitive trust for enterprise digitalization will require establishing end-to-end trust in devices and data with mutual authentication, data protection, and risk classification (EU Artificial Intelligence Act) for ethical use of AI/ML. The well-known vulnerabilities in the management, control, and data planes on field devices in existing infrastructures must be addressed with robust engineering to enable device-to-cloud connectivity.
Symmera’s Distributed Intelligent Platform (DIN)
Symmera’s DIN platform enables risk management and data pipelines with software defined trust and automation to protect OT and IIoT devices, empower analytics with enriched device intelligence, increase operational efficiencies with simplified workflows from factory to field, and reduce operational costs with IT and OT convergence. The DIN platform helps to actively establish and persist trust between devices, applications, and data – enabling secure operations and digital transformation at scale. The DIN architecture enables zero-trust for IT and OT convergence based on the Open Process Automation Forum (OPAF) Open Process Automation Standard (O-PAS), NAMUR Open Architecture, Purdue, and ISA-95/IEC 62264 models. The DIN solution provides a distributed, zero-trust orchestration layer that secures OT and IIoT devices from onboarding through decommissioning – without disrupting operations.
Conclusion
Across industry segments, by adopting enterprise digitalization, application developers, original equipment manufacturers (OEMs), and end-users benefit from simplified zero or low-coding solution models, reduced recurring costs, increased operational efficiencies, and trust automation with data-driven insights. Beyond the fog at the IT-OT border are opportunities for adoption and integration of AI agents with agentic engineering.