Enterprise Security Approach for Securing IT OT assets
Published on : Tuesday 09-02-2021
Dr Makarand Sawant highlights key areas to cover in securing IT OT assets.
When considering enterprise security, the following are the key areas to be covered:
i. Compliance monitoring
ii. Secure access
iii. Secure content transfer
iv. Asset discovery
v. Inventory monitoring and alerting
vi. Software patch and vulnerabilities management, and
vii. Risk and compliance management.
Things to do
a. Increase cybersecurity of IT/OT assets for service delivery, troubleshooting and operations.
b. Increase cybersecurity by moving to intelligent solutions with built-in threat detection to inspect files transferred between sites for potentially malicious material and using IT/OT centric data for file delivery, analytics and more.
c. Solution for getting a comprehensive list of assets on the network using active or passive discovery.
d. Monitor assets for potential cybersecurity issues and alert operators with notifications for items that require resolution. Patch IT/OT assets and manage vulnerabilities as per organisational standards.
e. Visibility into an intuitive asset risk score, with drill-down capabilities to fully view information on risk factors and compliance with predetermined security policies.
Some of the key features and controls to be considered while implementing security solutions:
1. Simplify access to cross vendor assets
2. Centralise control over all access sessions enterprise wide
3. Standardised access procedures
4. Supervise and audit sessions
5. Control via role-based and device specific access permissions and privileges
6. Lower cost and complexity for managing third-party resources and maintenance personnel
7. Reduce data leaks by securely distribute files within/in/out of IT/OT
8. Analyse and act on insights by transfer logs and performance data to SIEM at a corporate SOC
9. Improve recovery time sending large files to/from file backup and restore
10. Accurately identify assets, including specific configuration details
11. Automate the maintenance of asset inventory with device information to expedite future risk determination
12. Proactively manage IT OT networks
13. Automate data collection of key cybersecurity indicators
14. Automate notifications specific to customer environment and organisation
15. Reduce vulnerabilities by centrally manage software updates
16. Comply with internal standards
17. Scheduling and Control update timing, approach and configuration to protect uptime
18. Update IT OT systems and historians
19. Control patching across IT OT network environments
20. Gain visibility into site cybersecurity status
21. Easily identify related actions to improve security posture
22. Simplify security reporting
23. Focused operations resource efforts on site assets that are most at risk or out of compliance with security policies
24. Gain visibility into process control network security status
25. Focus cyber operations resource efforts on assets that are most at risk or out of compliance with security policies.
Security solutions must provide an enterprise level view into site compliance and risk levels with drill down capabilities to fully gain information on risk factors, compliance with predetermined security policies and remediation advice. Risk mitigation plans must be in place as a preventive measure to tackle risks that are getting detected and identified. Adoption of standards like ISO 27001, COBIT and best practices can help in better management and sustenance of the implemented security solutions.
Dr Makarand Sawant is a PhD in Analytics, he is a technology and business visionary with 22 years of executive and hands on experience in automating multi-billion dollar enterprises. He is a Computer Science engineering graduate with MBA and a Doctorate in Management Studies, Information Technology. He has led Innovation and alignment of IT with business by driving Digital Transformation through Analytics, Process Automation, Mobility, and Cloud including leading Smart Factory, IoT and Industry 4.0 initiatives.
