A CISO is developing a new information security strategy for a manufacturing company that employs a mix of legacy operational technology (OT) systems and modern IT infrastructure. To ensure the strategy effectively supports business objectives, which of the following is the MOST critical initial consideration?
- APrioritizing the replacement of all legacy OT systems with modern IT solutions.
- BFocusing solely on advanced persistent threat (APT) detection for the IT network.
- CImplementing a comprehensive security awareness program exclusively for IT staff.
- DUnderstanding the unique risk profiles and interdependencies between OT and IT environments.
Show answer & explanationAnswer & explanation
Correct answer: D. Understanding the unique risk profiles and interdependencies between OT and IT environments.
In an environment with both OT and IT, understanding their distinct risk profiles, operational requirements, and interdependencies is paramount. OT systems often have different vulnerabilities, patch cycles, and availability requirements than IT. A successful strategy must address these nuances and how they interact to support overall business objectives, especially production continuity.
Why the other options are wrong
- A. Replacing all legacy OT systems is often impractical due to cost, downtime, and operational impact, and might not be the most critical initial step.
- B. Focusing solely on IT threats ignores the critical and often more vulnerable OT environment, which can directly impact physical operations.
- C. Security awareness should include OT personnel, and it's a control, not the initial strategic consideration for a converged environment.
IT/OT Convergence Security
The practice of securing environments where information technology (IT) systems and operational technology (OT) systems (e.g., industrial control systems) coexist and interact, recognizing their distinct characteristics and interdependencies.
- Addresses unique vulnerabilities of OT.
- Balances IT security with OT availability/safety.
- Requires integrated risk management.
Memory trick: Secure the factory floor, not just the office.