Operational Technology
Page 11 of 37
Principle 1: Balance the risk and opportunities
Before you undertake any design work for new or existing connections to your OT environment, you must ensure you are equipped to make risk-informed decisions about when, how, and where connectivity is permitted within OT systems and to external/third party systems. Ensure these decisions are thoroughly documented to allow the reasoning to be auditable.
The first step for all OT connectivity should be the documentation of a formal business case to support decision-making. This should be stored centrally and referred to regularly during the design process. At a minimum the business case should document the following:
-
Requirement:
is the connection required and what does it aim to achieve?
-
Business Benefit:
what benefits arise from the added connectivity?
-
Risk Tolerance:
what cyber and operational risks are acceptable?
-
Potential Impacts:
what are the potential impacts of a compromise to this connectivity?
-
Introduced Dependencies:
will the connection make the system reliant on external services, making isolation harder in an incident?
-
Senior Accountability:
who is the senior risk owner for the new connectivity?
| Tip: Define risk thresholds in the business case so future design and review decisions can be measured against agreed limits. |
| Note: To be able to effectively assess introduced dependencies and impacts you will require a definitive view of your OT architecture. To achieve this, use the NCSC guidance on creating and maintaining a definitive view of your OT architecture. |
For OT environments it is critical to give additional consideration within the business case for both risks to obsolete products and operational risks that could arise from increased connectivity:
At each stage of the design process you should assess if the connectivity is able to meet the risk-thresholds defined in your business case and that it aligns with your organisational threat context. In order to do this effectively you will need to verify your organisation has existing knowledge and processes to support this.
A comprehensive risk management framework
A risk management framework helps decision-makers identify, assess, and prioritise potential threats, enabling more informed and resilient systems. It also ensures consistency and accountability by providing structured processes for evaluating risks and implementing mitigation strategies. Use of a comprehensive risk management process ensures that connectivity decisions:
are evaluated against organisational risk appetite and threat context
consistently factor in cyber, safety, and physical risks
Your risk management framework should enable a holistic approach to risk that looks beyond the directly involved assets and data flows and considers the whole system architecture; its dependencies, existing security measures, and the policies and processes that govern it. To facilitate this creating and maintaining a definitive record of your OT architecture is critical. Building whole-system understanding will aid the selection of appropriate security controls that address the unique risks and constraints of your environment.
A whole-system understanding is essential for effective threat modelling. This approach enables you to evaluate how technical controls can mitigate connectivity-related risks and supports a proactive cyber security posture.
Further reading
|
Effective control and oversight of your supply chain
The supply chain plays a critical role in OT security, with a wide range of third parties often involved in the design, integration, and ongoing maintenance of systems. The NCSC has established supply chain principles for managing this risk.
It is particularly important to manage supply chain risk when procuring new products. Ensuring that devices are secure by design and developed following a secure product development lifecycle. This helps reduce the risk of introducing vulnerabilities through third-party components or insecure design practices. Supply chain factors that may affect your ability to implement effective secure connectivity could include:
-
Ability to influence:
Do you have the ability to influence the security controls architected into the suppliers solution?
-
Contractual controls:
Does your contract allow you to define and enforce minimum product security requirements, including capabilities for updating, access control, digital forensics and protective monitoring?
-
Component visibility:
Do you know all technologies in the supplied product? Hidden or undocumented devices may alter your connectivity model. This sometimes is referred to as a bill of materials.
-
Supplier trustworthiness:
Consider the supplier's policies, how they protect development and maintenance environments, and how they handle your designs/configurations.
-
Supplier track-record:
Has the supplier previously demonstrated that they respond to security issues and incidents in a mature manner, and do they positively engage with vulnerability researchers.
Further reading
|
