What’s going on with manufacturing OT security?

OT security researcher Ben Book takes an unapologetic view on the state of OT security in manufacturing. He doesn’t blame anybody but provides a clear analysis of business dynamics and offers what many lack when talking OT security solutions: the right questions.

Duration:

23 min

Guest in this episode:

Ben Book

OT Expert

FAQ

Facts on the topic

Why is the OT security maturity level in manufacturing often lower than in critical infrastructure?

While operators of critical infrastructure (KRITIS/CI) often receive government funding and face stricter regulatory mandates, the manufacturing industry typically operates on razor-thin margins. In this sector, cybersecurity investments compete directly with investments in production capacity. Another hurdle is complexity: while small and medium enterprises (SMEs) often lack the resources to increase their maturity level, large corporations are often too slow to implement necessary changes quickly across vast infrastructures.

‍

Can "Zero Trust" work in an industrial manufacturing environment?

Zero Trust is a vital concept, but it is challenging to implement in OT (Operational Technology). Because many machines rely on seamless real-time communication, overly strict verification processes can disrupt production. Experts like Ben Book warn against relying on mere buzzwords. The first step toward Zero Trust in manufacturing is not buying software, but achieving full transparency regarding which assets exist and how they are interconnected.

‍

How do companies solve the problem of "Skills Shortage" in OT security?

The skills shortage is one of the biggest hurdles. Many companies cannot afford to build their own highly specialized in-house team for OT security. An efficient solution is partnering with a Managed Security Service Provider (MSSP). An MSSP provides the necessary expertise and tools as a service, allowing manufacturing companies to scale their security without having to compete for rare experts in a tight labor market.

‍

Why is the absorption of OT into IT (IT/OT Convergence) often a mistake?

While IT/OT convergence makes technical sense, simply "absorbing" the OT into the IT department often leads to a dead end. IT and OT have completely different priorities: in IT, data confidentiality is the top priority; in OT, it is the availability of the machine. Without a deep understanding of physical manufacturing processes, standard IT security measures can unintentionally cause production downtime.

‍

What role do machine builders and ICS vendors play in OT security?

A shift in mindset is occurring: manufacturing companies are increasingly demanding that the responsibility for security be reflected back to machine builders (OEMs) and ICS vendors. Integrated OT security is becoming a key competitive advantage and differentiator for equipment manufacturers. If a machine is delivered "Secure-by-Design," the integration effort for the end-user is significantly reduced.

‍