The convergence of IT and OT

As IT and OT converge to support expanding business needs, assessing risk and establishing a more secure relationship between IT and OT require consideration of several control measures. Air-gapped devices and perimeter security are no longer sufficient to address and defend against modern threats like sophisticated malware, targeted attacks, and malicious insiders. The growth of IoT malware threats, for example, reflects this landscape’s expansion and potential to overtake vulnerable systems. Analyzing 2022 threat data across different countries, Microsoft researchers found the largest share of IoT malware, 38 percent of the total, originating from China’s large network footprint. Infected servers in the United States put the U.S. in second place, with 18 percent of observed malware distribution.

Advanced attackers are leveraging multiple tactics and approaches in OT environments. Many of these approaches are common in IT environments but are more effective in OT environments, like discovery of exposed, Internet-facing systems, abuse of employee login credentials or exploitation of access granted to third-party suppliers and contractors to the networks.

The convergence between the IT world’s laptops, web applications and hybrid workspaces, and the OT world’s factory and facility-bound control systems brings severe risk consequences by affording attackers an opportunity to “jump” air gaps between formerly physically isolated systems. Thereby making IoT devices, like cameras and smart conference rooms, risk catalysts by creating novel entryways into workspaces and other IT systems.

In 2022 Microsoft assisted a major global food and beverage company, using very old operating systems to manage factory operations, with a malware incident. While performing routine maintenance on equipment that would later connect to the Internet, malware spread to factory systems via a compromised contractor laptop.

Unfortunately, this is becoming a fairly common scenario. While an ICS environment can be air-gapped and isolated from the Internet, the moment a compromised laptop is connected to a formerly secure OT device or network it becomes vulnerable. Across the customer networks Microsoft monitors, 29 percent of Windows operating systems have versions that are no longer supported. We have seen versions such as Windows XP and Windows 2000 operating in vulnerable environments.

Because older operating systems often don’t get the updates required to keep networks secure, and patching is challenging in large enterprises or manufacturing facilities, prioritizing IT, OT, and IoT device visibility is an important first step for managing vulnerabilities and securing these environments.

A defense based on Zero Trust, effective policy enforcement, and continuous monitoring can help limit the potential blast radius and prevent or contain incidents like this in cloud connected environments.

Investigating OT equipment requires specific unique knowledge and understanding the state of security of industrial controllers is crucial. Microsoft released an opensource forensics tool to the defender community, to help incident responders and security specialists better understand their environments and investigate potential incidents.

While most think of critical infrastructure as roads and bridges, public transportation, airports, and water and electrical grids, CISA recently recommended that space and the bioeconomy become new critical infrastructure sectors. Citing the potential for disruption within various sectors of the U.S. economy to cause debilitating impacts on society. Given the world’s reliance on satellite enabled capabilities, cyberthreats in these sectors could have global implications well beyond what we’ve seen thus far.

Learn more about how to help protect your organization with insights from David Atch, Microsoft Threat Intelligence, Head of IoT/OT Security Research.