When Information Technology and Operational Technology Collide
Blog - IOT
Many organizations these days want to build up smart factories due to the advantages they bring to their organization, but they need to first have a proper understanding of what makes smart factories so unique. Organizations must learn that along with its advantages, smart factories also bring in risks and threats that come up due to the convergence of environments – both virtual and physical.
In setting up smart factories, there is a necessary convergence of Information Technology (IT) and Operational Technology (OT), and these need to integrate with the Industrial Internet of Things (IIoT). With a set up like this, now the smart factory is capable of monitoring threats in real-time, interoperability and virtualization. However, with these advantages comes the threats to the expanded attack surface. Cyberthreats now become even more dangerous as they can damage physical equipment and systems. An example of this is the attack surface of industrial robots. In some cases, the software running on industrial robots might be outdated and even more vulnerable.
IIoT is the possible solution to all these threats as it can play an important role in creating and running these smart factories. In order to let IIoT do its job properly, it must be properly embedded into the architecture of the smart factory.
Data-driven Smart Factories
As the title of this section suggests, smart factories are driven by data. How much data can be utilized directly depends on how much raw materials the smart factory has in storage, how quickly the machines can work in production, where the deliveries need to be made and other such factors. This also depends on the type of industry that is utilizing the smart factory.
Thanks to big data, smart factories can create a virtual copy of their physical operations. This allows for prediction of possible outcomes and autonomous decision making. If an organization is not ready for the large volumes of data required to carry out these procedures, it is not ready for a smart factory. The organization should identify the different types of data that will be used and be able to chart out its course. This means from collection to transfer to processing to storage. Charting the course also means to note all the entrance and exit points.
For example, an employee can move the data from their office premises to the smart factory through USB file transfer. An employee can take out terminals for servicing. However, all the tools used should be without any viruses. So, it is not just important to train employees in security protocols but also check that the tools being used are not bugged while they are constantly connected and reconnected to the smart factories.
Channels of Communication
The data being used is shared or communicated through the network that connects the smart factory. These network devices and the cloud might have several vulnerabilities which can be easily exploited if there are no proper cybersecurity measures in place. There might also be denial-of-service (DoS) attacks on the network or malware infections that can be prevented by using the proper cybersecurity measures.
If there are certain IT systems within the organization that are not connected to the smart factory, they should be updated to avoid entry point attacks. They should be properly monitored so that the organization is alert and aware of any incoming threats and can beat them easily.
For those network communication channels used within the smart factory, including those involving industrial control systems (ICSs), the organization must keep a proper note of these channels so they can easily pinpoint the areas of exposure to threats. The organization must be aware of the kind of information being transferred through these channels so that sensitive information channels can have stricter security measures in place. Using strong firewalls, encryption methods and authentication can also avoid intrusion into external channels of communication.
Indeed, security should not only be a major concern in the case of smart factories, but it should also be periodically updated and maintained. All the parts of the factory must be updated with the latest patches and firmware to avoid intrusion.
Where there is convergence of Information Technology (IT) and Operational Technology (OT) in smart factories, there should be a layered security approach that will protect network endpoints and the cloud. This means that every component of the smart factory is protected, especially where there are converged systems.
It is important to note the role of individual employees here. Since employees directly interact with the machine and data, there should be standard operating procedures (SOPs) in place on how to handle the machine and data without disrupting them or weakening security. There must be policies in place regarding how to handle the equipment and systems. For this, representatives from Information Technology (IT) and Operational Technology (OT) departments should be included.
However, these security measures must be implemented at the design phase itself and not at a later stage of building the smart factory. Security in smart factories must always be the first thought. Weak defenses can leave room for threats and cybersecurity risks and negate the profits of the organization in implementing the smart factory in the first place. In fact, if the organization implements smart factories without security in place at the design stage, it might have to spend lots of money in product recall due to unseen threats and risks resulting in a poor outcome.