Overcoming the Myths About 5G and OT Security

The field of operational technology security is full of myths that persist throughout the industry. One widely held belief that OT systems are air-gapped and immune to cyberthreats. But digital transformation programs are adding potential attack vectors in unexpected places such as AI-enabled devices, digital twins and 5G-connected autonomous mobile robots.

See Also: OnDemand | Navigating the SEC Rules for Enhanced Cybersecurity in IT and OT Environments

“We are fundamentally challenging the traditional air gap,” said Suresh Venkat, head of IoT/OT, Asia Pacific, at Palo Alto Networks, speaking on the second day of the 5G OT Security Summit in Malaysia.

Digital transformation – which now includes a convergence of cloud-based applications, AI and OT systems – introduces new threat vectors particularly as legacy systems struggle to adapt. Venkat pointed out that modern enterprises need remote access even though it introduces risks. He warned about falling prey to other myths – that firewalls alone can secure OT environments and that compliance ensures protection.

“Compliance is a baseline. Attackers don’t care about your compliance, they exploit your gaps,” he said.

Common Frameworks for 5G and OT in ASEAN

Attendees from both the IT and OT fields also focused on the fragmentation of security standards across the ASEAN region, and the need for a broader regulatory posture to safeguard critical infrastructure.

Security leaders advocated for harmonized frameworks across ASEAN to overcome cyber maturity disparities and foster ecosystem trust. “There is a valid business case for macro-level consistency,” said Suresh Srinivasan, CISO and DPO of Axiata Group. “ASEAN countries are interdependent. Without alignment, it is like blind men defining an elephant.”

While he acknowledged that countries are at different stages of maturity, he stressed the importance of all nations working toward common standards.

Connie McIntosh, head of security with Ericson, cautioned that the lack of standards leads to fragmentation. “It becomes like open source with no rules, varying levels of security, hardcoded passwords and baked-in vulnerabilities,” she said. “Standards build trust, and trust drives adoption.”

While the government can focus on setting goals, implementation must be left to operators and OEMs. “5G is no longer just a telecom issue, it is an ecosystem issue,” Srinivasan said.

Putting Cybersecurity Governance in the Spotlight

In most organizations today, cybersecurity governance typically sits under broader IT or enterprise risk management functions, often as a subset of technology governance, compliance or operational risk. While this structure brings alignment with business priorities, it can also dilute the strategic focus on cyber risk, experts said.

“There is no doubt that cybersecurity governance is its own pillar,” said Alex Ooi, CISO at Certis Group. “Cybersecurity must be independent from traditional IT and report to the board or CEO.”

Amani Ibrahim, CISO at Deep AI Consulting, said AI-specific governance is needed. “We need new skills, new structure, and AI risk should be owned by either the chief AI officer or chief risk officer, not just by the CISO.”

Baljit Singh Dhillon, head of strategy, planning and engineering at Digital Nasional Berhad, called for governance frameworks that prioritize visibility, accountability and communication. “Technology is a means of delivering a service. What matters is its impact on the end user,” he said, adding that effective communication between stakeholders is often the weakest link in cyber governance.