DCSG1 - Actual OT Cyber Security - Dillon Lee

BLUF: Effective Operational Technology (OT) cybersecurity prioritizes physical safety and reliability, requiring a mature, iterative approach to the five critical controls rather than a rigid, IT-centric implementation 2:15.

Key Takeaways:
• Safety First: Unlike IT, where confidentiality is often paramount, OT security’s primary goal is preventing physical harm to people and communities, with reliability and availability as secondary priorities 0:50.
• Incident Response Context: OT incident response plans must involve physical process teams to ensure that cyber mitigation actions, such as patching or wiping machines, do not inadvertently cause greater harm to industrial processes 3:25.
• Iterative Segmentation: Attempting to segment OT environments in one shot often fails due to complex dependencies; instead, organizations should start by physically separating IT and OT on different switching infrastructure to avoid disrupting operations 6:35.
• Passive Monitoring: Visibility is achieved through passive monitoring of network traffic to map assets and detect threats without impacting the sensitive industrial processes, focusing on both north-south and east-west traffic 10:20.
• Secure Access & MFA: A significant gap exists in OT secure remote access; implementing Multi-Factor Authentication (MFA) and breaking protocol chains for remote access is a critical, immediate step to reduce breach risks 12:35.
• Risk-Based Vulnerability Management: Prioritizing vulnerabilities requires understanding the device's role (e.g., safety-critical vs. maintenance shop) and its lifecycle, as some devices may be replaced soon, rendering immediate patching less urgent than for critical "crown jewel" systems 13:30.

Closing Statement:
OT cybersecurity is not a linear checklist but a continuous feedback loop where each control informs the others, requiring deep collaboration with physical site personnel and an understanding of industrial constraints.

Sources:

• 0:50 Discussion of OT security priorities: safety, reliability, and availability.
• 3:25 Importance of involving physical teams in incident response to prevent process harm.
• 6:35 Strategy for gradual network segmentation to avoid operational disruption.
• 10:20 Use of passive monitoring for asset inventory and threat detection.
• 12:35 Critical need for MFA and secure remote access in OT environments.
• 13:30 Contextual risk assessment for vulnerability management based on device role and lifecycle.