Modernizing and protecting our critical infrastructure has become a paramount concern. From a traditional information technology perspective, the term “critical infrastructure” implies what I call the “tech trifecta:” Cloud, data center and on-premise. Together, this triad provides the services we know and love, from LinkedIn to Slack to ChatGPT and beyond. Sure, the primary impulse is to use cloud services in every case, but we’re going to be using data centers and even good old-fashioned server rooms, as well.
But that’s not the whole story. The “tech trifecta” has become the “critical quad.” That fourth new member, operational technology, is a big deal. Let me explain.
More about the fourth member of the “quad”
OT is the term used to describe hardware and software systems that monitor and control physical devices. When it comes to OT, most folks will talk about how OT manages critical infrastructure elements such as our water systems, fuel pipelines and the electrical grids. OT comprises a stunning array of technologies and acronyms.
Each is vital to running the critical services we have come to expect, from highways to the shipping that enables world commerce. So, if you want to talk about “critical infrastructure,” you can’t leave OT out of your thinking. This is a tough thing for IT and OT professionals to process. These things seem as abstract to you as they did to me. To help with some context, let me tell you about the time when OT saved my family.
The significance of OT to the critical quad: One perspective
In the fall of 2018, I was traveling with my wife, Sandi, in London. While we were on an escalator in the Waterloo Underground “Tube” Station, someone above us fell, accidentally pushing my wife down the escalator. She fell head over heels. The fall broke her arm, and she suffered a concussion. But that wasn’t the end of the story. It was a cold day, so she was wearing a scarf. After she fell and was incapacitated, the scarf got caught up in the “teeth” of the escalator steps. Slowly, as those steps traveled inexorably up to the top, the scarf quickly began tightening around her neck. I tried desperately to tear that scarf out of the escalator steps, but it kept getting tighter around her neck. I tried to lift the scarf up, and lift her away from its stranglehold, but nothing worked. We were helpless.
Then, a miracle happened: The escalator stopped all by itself. Sandi was free from the grips of the escalator, and with the aid of wonderful people who helped us and an ambulance crew, we were off to the hospital. While we were in the hospital emergency room, I had a chance to scan the incident report. I originally thought that someone physically at the scene had pushed one of those big, red Emergency Stop buttons that are prominently placed at the top, middle and bottom of any escalator. That’s not actually what happened though.
A worker monitoring the scene remotely via a well-placed network camera saw what was happening and used their computer to stop the escalator remotely. To me, that’s the miracle of operational technology and the “critical quad.” Thanks to OT and the quick actions of that worker, a year later, we were able to take a triumphant picture in front of that very same escalator.
To me, this is the meaning of OT and IT convergence: It’s tech that makes and saves lives.
Problems with the quad
This a great use case, but the reality is we still have a few issues when it comes to the quad. The first is what I call the “IT/OT disconnect.” You see, the IT and OT worlds used to be completely separate concerns. IT folks did their thing in their own departments, and OT folks had their own, as well. Each lived in their separate countries, as it were, with their own cultures and concerns. That’s no longer the case: Those worlds have converged.
IT and OT “cultural differences”
And there’s the heart of the matter: IT professionals are increasingly asked to understand the relatively foreign – even undiscovered – OT world, and vice versa. Strangely, combining the worlds of IT and OT has actually revealed a critical cultural gap. This gap centers on the “CIA Triad,” which is composed of:
- Confidentiality: Keeping information secret, using encryption.
- Integrity: Ensuring systems and data are free from improper modification and tampering.
- Availability: Making sure that systems and data are accessible and fully functional at all times.
IT and OT professionals emphasize different elements of this triad because they look at risk in different ways. As a result, the gap between their sensibilities has become quite apparent – even acute.
Understanding CIA nuances in each culture
OT workers place a greater emphasis on availability and response time. They are natural “systems thinkers” because they know that multiple elements must work together well and quickly. If not, terrible things happen. Nothing can get in the way of availability. The time required to stop an escalator, conveyor belt, or pipeline, for example, is measured in seconds. Anything, including two-factor authentication, access control, and the possible network latency created by security measures, is, in their minds, unacceptable. It’s not that OT workers are necessarily old-fashioned and don’t understand security; it’s that they know that response time is everything. As a result, they perceive risk very differently compared to an IT professional.
An IT professional focuses on confidentiality and integrity, as well as availability. After all, the IT pro knows that the systems they manage transport and store critical information. Privacy and cybersecurity regulations focus on making sure that this information remains confidential and unaltered both in transit and at rest. In these early days of AI implementation, integrity has become even more important; if data feeds the AI beast, then it is all the more critical for IT workers to ensure that data remains unmolested. Tampering is a major concern. They know that if a system has weak authentication, then terrible things happen.
Any IT worker knows that systems patching is vital. That’s why every IT worker expects a “patch Tuesday,” which is a process that they manage. Yet, to an OT worker, patching is something that vendors do; it’s not part of their routine. If an OT worker were to go rogue and patch a system themselves, it’s likely that an entire OT system would go offline for an extended period of time.
Different languages
IT and OT workers both understand risk, but they have different priorities. There’s another issue: Each culture speaks different languages. IT workers tend to talk in terms of HTTP, SMTP, TCP/IP, UDP and TCP. OT workers talk about Modbus, DNP3 and RTU.
Bridging the disconnect: Focusing on critical skills combinations
We need leaders to identify and manage cultural expectations and different languages. Instead of allowing workers to speak past each other and inadvertently create toxic combinations, it is time to increase communication. In some cases, organizations need to do this by reorganizing themselves to facilitate communication and manage expectations.
In every case, education is the answer. We need more workers who understand both worlds and their associated nuances. Recently, I spoke at an event called AFCEA TechNet Cyber. While there, I met a Navy technician who supports nuclear-powered ships. I learned that she was effectively raised as an OT worker. Over the years, she acquired a strong understanding of how to use Supervisory Control and Data Acquisition systems to monitor cooling systems. As IT-based technologies started entering the picture, she found these elements to be completely different from her experience.
The solution? She found a talented IT worker who became her mentor. She started asking simple questions about IT technology. Her mentor then started learning about her OT world. Very quickly, they both concluded that they needed formal education about each other’s worlds.
I’ve witnessed this process happen many times over the years. It starts with two critical elements: Curiosity and communication. That then opens up the door to education. That’s the best way to turn IT workers into systems-based thinkers, and the best way to transform OT workers into network administrators who can enforce confidentiality without sacrificing availability. Nothing is more transformational to an organization than education; it’s the best way to overcome the IT/OT disconnect and modernize our critical infrastructure.
