All right, now, what is OT?
Iot, Internet of Things, OT operational technology.
This is where we start talking about
industrial control systems, managing water, gas, electric, sewer, and so forth.
Ot is the software and hardware designed
to detect or cause changes in industrial operations, direct monitoring and
controlling of industrial physical devices.
It consists of industrial control systems
to monitor and control industrial operations.
In general, your ICS, the security in industrial control systems is oftentimes
pretty reliant on the fact it's a closed network.
Like everything else, it evolves with functionality and ease of use.
A lot of your OT systems run on legacy platforms.
For example, remember the colonial
pipeline hack not too long ago, the systems that are running the legacy
software are often no longer supported by the vendor.
The reason for that, typically, is it costs a lot of money to redevelop these
applicationsto run on newer operating systems, and they'd rather not pay for the
coding of the new applications, and they'll still work with older, non
supported versions of Windows, for example.
You might see some 2003 systems still out there or even older.
Those, again, have reached the end of their support life cycle.
If vulnerabilities are discovered, they're not typically patched.
A lot of this stuff is dependent on the fact that you can't get to it.
But there's almost always a pivot point somewhere where you can get to an admin
workstation, for example, and then use that to pivot to the OT network.
Essential terminology, assets.
Assets, again, are anything of value.
Ot systems typically consist of physical
assets, sensors, actuators, servers, workstations, network devices, and again,
they all work together in an OT environment.
Zones and conduits.
Network segregation technique used to isolate the networks and assets imposed
and maintain strong access control mechanisms.
Industrial network, network of automated control systems, and a business network,
systems that offer information infrastructure to the business.
The protocols.
Protocols used for serial communications and communication over standard Ethernet.
Network perimeter is the outermost boundary of a network zone.
We've talked about that before.
Electronic security perimeter, the
boundary between secure and insecure zones.
Critical infrastructure, any collection of physical or logical systems that will
severely impact the safety security economy or public health.
Now, not too long ago, we had an event
here in Florida that had to do with the water treatment plant.
That wasn't good.
It or OT Convergents.
Integration of IT and OT systems into a single model bridge the gap between the
technologies for improving overall security, efficiency and productivity.
There's probably not much more to talk about on that slide here, but you're
talking about the combination or the consolidation of both or interoperability.
Introduction to ICS.
Industrial control systems.
Probably your best examples of ICS is SCADA.
Scada stands for supervisory control and data acquisition.
It communicates with the entire network,
modems, programmable logic controllers, PLCs themselves will typically interface
with the physical world and perform some programmatic function.
The PLC is a module power supply and I O modules, and it's a little solid state
computer where instructions can be customized to perform a specific task.
These touch the physical world.
Okay, so if it's computer controlled and I can talk to it, I can hack it.
If it interfaces with the physical world,
that means I can reach out and hack the physical world.
That's what that all boils down to.
Again, when you think of things like biomedical devices, pace makers, insulin
pumps, things like that, you could actually kill somebody.
That's scary.
If it has to do with power grids and pipelines and electric grids, gas, sewer,
water, electric, and so forth, or water treatment plants, again, you can
introduce toxins to the supply area, whatever, shut things down.
We're pretty heavily dependent on electrical grids these days.
So if it's computer controlled, I can talk to it, I can hack it.