View Issue Details

IDProjectCategoryView StatusLast Update
001042210000-002: SecuritySpecpublic2025-07-08 22:44
ReporterPaul Hunkar Assigned ToPaul Hunkar  
PrioritynormalSeverityminorReproducibilityalways
Status assignedResolutionopen 
Product Version1.05 
Target Version1.05.06 RC1 
Summary0010422: Describe difference in IT vs OT security concern
Description

Since IT is becoming more involved in OT security, it is important to include a section describing the varying priority of security concern for IT installation vs OT installations. for OT the running process is most important, even momentary down time can be fatal.

TagsNo tags attached.
Commit Version
Fix Due Date

Activities

Paul Hunkar

2025-07-08 22:34

developer   ~0023098

The following is a propose start to the text

4.3 OT vs IT – differences in security requirements
When looking at security there are a number of different concepts, including confidentiality, integrity and availability. The importance of these varies between the IT world, the higher level OT systems and lower level OT system. Figure 2 illustrates the relative importance of these concepts.

Figure 2 - IT vs OT Security priority
The key point that is illustrated in the figure is that in the OT environment availability of a system is most important. For example, in a process plant, the most important item is the process itself i.e. this maybe the refining of crude oil to gasoline or the processing of iron ore to steel. In a manufacturing system, the most important item typically is safety.
Other key difference, in an OT world, it is common that various controllers are communicating and sharing information. This communication and interaction has no user involvement. The importance in the OT world is the identity of the controller and that it is a trusted controller that another controller can trust and obtain information from or push information to. Operators do interact with the controllers and then have user identification, but the controller to controller communication is usually more important.

Paul Hunkar

2025-07-08 22:39

developer   ~0023099

ITvsOT.jpg (31,035 bytes)   
ITvsOT.jpg (31,035 bytes)   

Paul Hunkar

2025-07-08 22:44

developer   ~0023100

NIST Special Publication NIST SP 800-82r3 Guide to Operational Technology (OT) Security

As OT systems adopt IT solutions to enable corporate business systems connectivity and remote access capabilities and are designed and implemented using industry-standard computers, operating systems (OSs), and network protocols, they have begun to resemble IT systems. This integration supports new IT capabilities, but it provides significantly less isolation for OT from the outside world than predecessor systems, creating a greater need to secure OT systems. The increasing use of wireless networking places OT implementations at greater risk from adversaries who are in relatively close physical proximity but do not have direct physical access to the equipment. While security solutions have been designed to deal with these issues in typical IT systems, special precautions must be taken when introducing these same solutions to OT environments. In some cases, new security solutions that are tailored to the OT environment are needed.

Although some characteristics are similar, OT also has characteristics that differ from traditional information processing systems. Many of these differences stem from the fact that logic executing in OT has a direct effect on the physical world. Some of these characteristics include significant risk to the health and safety of human lives, serious damage to the environment, and severe financial issues, such as production losses, negative impacts to the Nation’s economy, and the compromise of proprietary information. OT has unique performance and reliability requirements and often uses OSs and applications that may be considered unconventional to typical IT personnel. Furthermore, the goals of safety and efficiency sometimes conflict with security in the design and operation of OT systems.

Issue History

Date Modified Username Field Change
2025-07-08 15:19 Paul Hunkar New Issue
2025-07-08 15:19 Paul Hunkar Status new => assigned
2025-07-08 15:19 Paul Hunkar Assigned To => Paul Hunkar
2025-07-08 22:34 Paul Hunkar Note Added: 0023098
2025-07-08 22:39 Paul Hunkar Note Added: 0023099
2025-07-08 22:39 Paul Hunkar File Added: ITvsOT.jpg
2025-07-08 22:44 Paul Hunkar Note Added: 0023100