Considering OT Security relevance of IT Systems, as consequence of IT-OT Convergence

The key difference between Information Technology (IT) and Operational Technology (OT) is that while the former is processing information, the latter automates and controls business processes, like production and infrastructure services. IT and OT security has different priorities [1]. While IT security is focusing on protecting confidentiality and integrity of data, OT security is more focused on the availability of Industrial Automation and Control Systems (IACS). The reason for the difference in priorities is obvious: the temporary loss of availability of an IT system, like an ERP system, is usually an acceptable risk, but loss or compromise of confidential data is unacceptable. In an industrial process, like, for instance, an oil refinery, consequences of losing availability of an OT system, like a Distributed Control System (DCS), or an emergency shutdown system (ESD), are not tolerable; it can cause in best case substantial financial consequences through business interruption, but can have even worse impact, like damage in human lives or environmental consequences.In the last years, however, that demarcation between OT and IT has been fading [2]. A lot has been discussed in the past years about the convergence of IT and OT and about bringing down the wall between them- and, though "IT-OT convergence" is often used as a buzzword, in fact, it is much more than that. This paper describes IT-OT convergence from the point of view of cyber security.The most challenging thing about IT-OT convergence is to establish which system is considered OT, and which system is IT. The most obvious differentiation is that any system, which’s heuristic behavior through a security incident can have immediate effect on the availability of time critical business processes, like production, critical infrastructure services, is considered OT. On the other hand, systems which are indifferent from this point of view, as they are believed to have no effect on the availability of business processes, are considered as information processing IT tools only. But what happens if an IT system acquires a latent role in maintaining the business process; what happens if, with this new role, the unavailability of an IT asset causes immediate shutdown of a production process? This paper demonstrates two examples, how a system considered IT can become, unexpectedly, a player of the OT game, how this can be detected and how this can be handled from OT cyber security point of view. Those systems in this paper will be referred to as OT relevant IT systems.