ACCIDENTAL CONVERGENCE CAN QUASH THE MOST SECURE AIR-GAPS

Although isolating IT and OT systems by implementing an air-gap strategy is perceived to be bullet-proof, it’s not completely immune to breaches and hence, provides a false sense of security that no longer reflects reality in today’s business environment

- Dick Bussiere

Reading the news about several high-profile incidents of industrial sabotage in supposedly secure environments is like witnessing a sinister Hollywood scenario unfold. unfortunately, these scenarios of cyberattacks disrupting industrial environments and critical infrastructure are a reality that organizations have to contend with today. Based on a tenable study done by Forrester Consulting, 97 per cent of organizations in India suffered one or more business-impacting attacks and of those, 67 per cent of respondents said the attacks impacted operational technology (OT).

Scepticism around IT/OT convergence

More recently, many companies have opted to converge their It and OT systems to increase efficiency and efficacy. This was not without risk since melding It and OT systems can create new attack vectors and surfaces. Since It and OT environments are often interconnected, an attack that originates on an It network can move laterally to the OT environment and vice versa.

While some organizations readily embraced this convergence with open arms, others have remained sceptical for strategic, technical and business reasons. They have instead chosen to isolate It and OT systems by implementing an air-gap strategy.

Air-gapping is perceived to be bullet-proof given that Ot systems are physically isolated from online networks. In reality, air-gapped networks still have a large number of attack vectors. The introduction of one seemingly harmless variable such as a thumb drive or a compromised laptop can permanently destroy the most stringently enforced air-gap. This is known as “accidental convergence.”