Building OT Security That is Stronger Than IT: Increasing Resilience

When operational disruption, safety impacts, or environmental consequences are unacceptable, OT security must deliver a higher standard of resilience than is reasonable to expect of our IT security program.

But – OT environments face structural constraints – difficulty patching, legacy assets, and uptime requirements – constraints that make OT programs weaker, not stronger.

This presentation outlines practical ways to build OT security programs that go beyond IT-equivalent controls. We survey techniques ranging from the simplest deny-by-default rules to cyber-informed engineering measures that eliminate entire classes of consequences and attack vectors. We finish with a deeper dive into alternatives and cost scenarios for the most recent  “emergency OT isolation” requirements from authorities in the UK, Denmark, Canada, and the United States.

Back to the program overview