2023 was an exceptionally active period for ransomware groups , posing significant threats to industrial organisations . time data of consumption can allow precise supply of power in real-time , especially in situations where demand is higher than supply .

Households that reduce power below certain levels can benefit from having a constant supply of power , to run essential systems such as lights and critical low power appliances during their load-shedding phase without being subjected to a total black-out or power cut .

As is evident , this convergence enables Industry 4.0 by turning automation functions into Internetof-Things ( IoT ) through connectivity to business processes and applications . While these benefits are positive , there may be challenges faced with the implementation of IT / OT convergence due to either obsolete technologies being used in OT environments or the slow adoption of more recent advanced technologies that are often quickly deployed in IT environments .

These challenges are mainly driven by differences in objectives when it comes to the application of cybersecurity within the two environments ; IT is driven mainly by security of the systems while OT is driven by the safety and availability of the systems . Furthermore , IT can afford planned downtime to apply the required patches or software updates , however , the OT systems need to operate around the clock to avoid business impact .

According to a recent study done by Microsoft , 75 % of the OT systems / ICS devices are unpatched and feature high-severity vulnerabilities . The Redundancy Principle of designing systems with replicated components , operating in parallel , so that the system can continue to operate despite errors or excessive loads could be applied with strong procedures to perform online upgrading and testing .

A 2023 global survey on OT cybersecurity leadership confirms that protecting critical operational assets is a paramount priority for organisations , driven by the rapidly evolving cyberthreat landscape and an increase in OT security breach incidents .

Ransomware attacks are still prevalent . 2023 was an exceptionally active period for ransomware groups , posing significant threats to industrial organisations . A report by McKinsey shows that OT cyber-events have increased by 140 % from 2020 to 2021 . Of those events , 35 % sustained physical damage with an estimated impact of US $ 140 million per incident .

Supply chain risks due to too much dependency on the OEMs ( Original Equipment Manufacturers ) also increase the risk hence a need for an effective third-party security management programme . Cloud providers are also targeted as part of a supply chain attack , a compromised provider increases the attacker ’ s gain by compromising multiple victims at once .

IEC 62443 addresses security considerations throughout the supply chain of industrial products . A secure supply chain reduces the risk of compromised or counterfeit products . This helps to ensure the integrity and reliability of goods traded between countries .

As a seasoned CISO , what overarching strategies do you recommend for effectively managing cybersecurity risks within critical infrastructure environments ?

A risk-based cybersecurity strategy that uses a defence-in-depth holistic approach which includes governance , technology , training , collaboration and continuous improvement should be adopted . The strategy should opt for more proactive cybersecurity measures to maximise ROI , shifting investment into capabilities that continuously improve cyberresilience and demonstrate cyber-risk reduction .

It should also ensure that digital technologies , systems , applications and IT / OT convergence are designed with security in mind and should include information security throughout the life cycle . Information security should not be retrofitted as this can be costly and may prevent the proper controls from being implemented in the future which can compromise security .

Breaking down silos between IT and OT departments is fundamental , a mutual relationship of trust must be formed , and the concept of separate isolated environments should be discouraged . Silos can lead to security oversights that can increase complexity , duplicate efforts , increase operating costs and expose security flaws which can be exploited by cybercriminals .

In your experience , what are the fundamental elements of a successful cybersecurity framework that can be applied across various industries to protect against evolving cyberthreats ?

A defence-in-depth strategy is fundamental . Digital assets visibility and protection are paramount since it is not possible to protect what you do not know . Identifying potential malicious activities in the early phases of the cyber kill chain through real-time

52 WWW . INTELLIGENTCISO . COM