Simplifying Processes Helps to Enable Acceleration and Resilience and Optimizes Your Resources
Over the past eight months, I’ve been impressed by the agility of so many companies to quickly pivot to new solutions and processes to address a distributed environment. Every company has become a technology company as they’ve accelerated digital transformation and introduced change to everything – from communication and collaboration, to how infrastructure is organized, to support huge shifts in business and operating models. Security teams have worked around the clock to protect systems, processes, and data while maintaining productivity and driving competitive advantage.
As we look ahead, we know that COVID isn’t going away any time soon and that the current remote work environment will continue. Not simply out of necessity, but also because many employees and employers find it is working well for them and makes good business sense. Microsoft is letting employees work from home permanently, following examples from other technology companies. But even across critical infrastructure sectors like finance, manufacturing, oil and gas, energy, mining and chemicals, companies are planning for hybrid working environments. They’ve seen their operational technology (OT) environments could be supported, at least partially, through remote workers, and some have even stated company performance has improved.
We also can expect that adversaries will continue to increase threat activity against all critical infrastructure, as they seek to take advantage of an expanding attack surface and legacy devices, which are now being connected to the internet but were never designed to withstand internet-related security threats. A few months ago, the U.S. National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) issued an alert stating, “We are in a state of heightened tensions and additional risk and exposure” across OT and control systems, which are critical to operations and therefore valuable for attackers. Also, the security gap between the risk posture of IT and OT networks makes them a weak spot for organizations.
So, while we’ve quickly pivoted to put in new solutions and processes to address a new, distributed model, what do we do next? How do we take what we’ve learned this year, capitalize on the change in mindset that it is possible to move fast, and apply it to seize the OT security opportunity in 2021? Here are three areas of focus to help you build on your progress.
1. Budget. Digital transformation is a necessity and, increasingly, Fortune 500 companies have the support of their board of directors and the budget to reduce risk and ensure the uptime and availability of their OT networks. In fact, over the next 12 months large enterprises will spend even more on the core security controls that enable a distributed workforce and infrastructure, according to a recent McKinsey & Company survey. However, if buy-in and budget remain an issue for your team, do a security posture assessment to evaluate the state of your OT network’s security and the delta with where you need to be to mitigate risk. Map the findings to actions that will help the organization optimize remote work, communication, collaboration, and the OT environment itself, with security as a necessary component. Showing what is required to continue to drive productivity and competitive advantage securely will help you build a case for the budget you need.
2. Acceleration and resilience. The next year is pivotal for businesses, presenting a sizeable opportunity to accelerate digital transformation and increase resilience. Start by thinking about security and your networks holistically. Adversaries don’t think of these networks separately and neither should you. To them, a network is a network, so attacks are intertwined. The NSA/CISA alert includes broad warnings of an imminent and serious threat across all 16 critical infrastructure sectors, and lengthy, detailed sets of recommendations for how to protect OT environments that encourage a holistic approach to risk mitigation. Acceleration and resiliency require that processes be implemented across the board, not piecemeal. Think how to extend your core security controls and your governance processes to cover OT as well without risk to productivity or downtime, and look for solutions that provide the platform approach, so you can minimize friction and accelerate implementation.
3. Simplify processes. The days of a “crawl, walk, run” approach are gone. Our experience over the last several months has shown us we can go straight to run. The key to continuing to move fast is to simplify where you can – don’t over think it. Use existing processes and the infrastructure you have, and capable OT security providers will build their solutions into the rest of your technology stack. They’ll leverage the natural characteristics of your OT networks, which capture data-rich traffic, to provide all the security information you need to monitor for threats. They’ll also integrate relevant OT information equally well into the rest of the processes that run your infrastructure, such as asset discovery and management, workflow management, and consolidated threat detection platforms. Instead of doubling efforts, IT and OT teams can work together, leveraging a complete picture across the attack surface to govern OT networks with the same processes and reporting metrics.
We’ve all been through a lot this past year, but we’ve risen to the occasion. Looking ahead to 2021 and a continuation of current constraints can seem daunting. But when you focus on these three areas, the synergistic benefits will propel you even further. Simplifying processes helps to enable acceleration and resilience and optimizes your resources – talent, time, and budget. We’re looking at a breakaway year for businesses, where you can seize the OT security opportunity and accelerate digital transformation into the future.
