Do We Really Need IT-OT Integration?

One team quotes Shakespeare. The other speaks in Morse Code. Now, imagine forcing them to write a play together. Yet IT and OT organizations are being asked to work as one. Is full integration really possible, or should we keep them at respectful distance for security reasons?

See Also: AI vs. AI: Leveling the Defense Playing Field

In a modern industrial setting, each technical team has different priorities. One team prioritizes uptime and physical safety; the other, data integrity and cyber hygiene. One operates systems that must never go down; the other moves fast, updates faster. Yet, under the banner of digital transformation and IT-OT convergence, IT and OT teams are not just being asked to collaborate, but unify. On paper, it sounds like a logical evolution. In practice, it could be a recipe for friction and operational chaos.

The two organizations need a “bridge and not a merger,” said Maryam Shoraka, head of OT cybersecurity operations with Sydney Trains. “I am all for sharing cybersecurity intelligence and have a coordinated incident response, but do not make me push IT policies to a system that is controlling a chemical process just because some executive wants unified management,” Shoraka said.

For years now, CISOs and other C-level executives have been pushing for integrating cybersecurity practices for IT and OT with good intentions. But the integration push assumes IT and OT are the same with different labels, which they aren’t.

While IT security teams focus on maintaining the confidentiality, integrity and availability of data, OT security teams emphasizes safety first, then availability and reliability. This fundamental difference in priorities is often overlooked during the convergence of processes such as patch management, vulnerability management, upgrades and risk management.

As IT security teams typically take the lead in safeguarding the environment, “their lack of a comprehensive understanding of the specific priorities and constraints inherent to OT can hinder effective collaboration,” said Tanvinder Singh, director, cybersecurity and privacy at PwC South East Asia Consulting. This disconnect can result in approaches that do not meet the unique needs of the OT landscape, leading to suboptimal outcomes and frustrations for both IT and OT security teams, Singh said.

Shoraka has attended many meetings where IT teams proposed enterprise-wide policies that included maintenance windows, and these windows simply don’t exist in continuous process industries. “It is not because they don’t care, they just don’t live in a world where just restart it isn’t an option.”

As a result of this forced convergence, organizations often face operational disruptions and attackers targeting this converged infrastructure. Various PwC reports on the state of OT security show that ransomware attacks targeting OT systems are on the rise. Around 27% of companies that experienced OT attacks have reported financial impacts of over $1 million and 72% of targeted OT cyberattacks originate from IT environments.

Shankar Karthikason, group head of cybersecurity strategy, operations and advisory at Averis, said he experienced operational disruptions during the CrowdStrike incident from a faulty software update. When IT-led initiatives are introduced without fully considering OT needs, such incidents could become common. “At least for now, the maturity of SecOps is not yet to that point. IT may not realize that even a small change or scan can cause a production halt,” he said.

According to recent reports, organizations experienced intrusions impacting their OT systems, a sharp increase from 49% in 2023, as revealed by Fortinet’s 2024 State of Operational Technology and Cybersecurity Report.

Microsoft identified unpatched, high-severity vulnerabilities in 75% of the most common industrial controllers in customer OT networks. SentinelOne found that 25% of data breaches involve lateral movement – a primary method attackers use to move from compromised IT systems to OT environments.

To be fair, the disruptions usually aren’t because the security changes were wrong. They happen because we apply security changes without understanding how the work actually gets done. “When a temperature alarm of a reactor goes off, the operator needs access to the control system right away and not after completion of a two-factor authentication process,” Shoraka said.

The Model That Works

While complete separation is not realistic in today’s digital world, experts are calling for coordinated autonomy that has joint risk ownership, reality-based incident response and embedded translators.

“Let OT teams own the operational risks and IT teams help figure out how to mitigate it. Nobody gets to make unilateral decisions that affect the other side,” Shoraka said. She also recommends including security professionals in both environments who can speak both languages – “someone who understands that when an OT person says we can’t patch that system, it is not because they are being difficult. It is because that system has not been shut down in three years and there is a very good reason for that.”

Traditionally, the onus of cyber protections has typically fallen on CISOs, CIOs and IT teams, but many organizations lack sufficient rigor and investment in cybersecurity surrounding OT systems, Singh said. “This is an evolving domain with more and more organizations realizing the importance of adopting a formal IT and OT security convergence operating model to identify unique convergence opportunities.”

AJ Eserjose, regional director with OT-ISAC, shared his experience of bridging the gap between these two teams. “We brought IT and OT teams into the same room. At the start, there was a clear sense of unfamiliarity and misalignment. IT and OT came in with different mindsets, different vocabularies and very different expectations,” Eserjose said.

As the days progressed, they started to understand each other’s constraints and what each team was trying to protect. That shift not only improved incident response, but it also fostered mutual respect and paved the way for more constructive collaboration, he said.

While it can take months to ensure smooth coordination, experts caution against forced coordination.

“Trying to force these two worlds together without respecting what makes each one work is like trying to merge a hospital emergency room with a Formula One pit crew. Both are high-pressure environments where people know their stuff, but the playbooks are completely different,” Shoraka said.