Content area
Full Text
Traditional IT is moving more onto the plant floor. OT will have to accept a greater level of integration. Is that a problem or an opportunity?
You're a networking person who works in your plant in operations technology (OT), supporting the technology that keeps manufacturing going. An e-mail arrives with a message that strikes terror: Your corporate IT department has been assigned the task of updating networks and implementing new cyber security measures in the plant, and you are to cooperate. In other words, IT is moving into the plant. Is this necessarily bad news? It probably isn't good news, but the question is, why does the thought of combining IT and OT normally draw strong reactions?
"When you take people with an IT background and bring them into an industrial control system environment, there's a lack of understanding from operations why they're there and there is a lack of understanding of the specific controls environment needs from IT," says Tim Conway, technical director, ICS and SCADA for the SANS Institute. He points out that typically IT professionals are trained and driven to perform a task: "They work on a box, a VM (virtual machine), a storage area network, or a firewall. They don't realize that they're a part of a larger control system operation, and how the things that they do can impact others."
Conway's experience came from many years working in networking engineering and management at a mid-sized electric utility. He's seen how difficult it can be to develop IT personnel to realize the larger context: "If they're network guys, they see how a change affects their networks and the inter-dependent IT system functions, meaning active directory or workstation authentication, or monitoring and alerting, and all the other IT functions. But they don't think systemically from an operations perspective. For example, the impact out to the breaker in the substation if the communication path is lost. I compare the development challenge to what we do with our safety programs where we ask people to think about safety from the perspective of their work product. They have to think about...