OT Security and Business Resilience: The Incentivization Conundrum in Software Security
The Current State of OT Security and Business Resilience in Safety-Critical Sectors
The surge in disruptive cyberattacks has forced organizations in safety-critical sectors to adapt and evolve their business resilience strategies.
Expert Insights
Ben Worthy, an OT Security Specialist at Airbus Protect, shares his insights on the current state of OT security and business resilience. With over 25 years of experience across various industries, including aerospace, nuclear, water, and oil and gas, Worthy offers a unique perspective on the challenges faced by organizations in these sectors.
The Threat Landscape
The threat landscape has become increasingly complex, with attacks targeting operational technology, GPS spoofing, and supply chain incidents. Worthy discusses major cases, including the Boeing/LockBit ransom demand, the Jaguar Land Rover production shutdown, and the SITA passenger data breach. These incidents highlight the need for organizations to separate safety risk from business continuity risk.
Regulatory Changes
Regulatory changes are also reshaping the industry. The European Aviation Safety Agency (EASA) has introduced new deadlines for cyber assurance, directly tying it to safety oversight. Worthy breaks down the implications of these changes and what they mean for organizations in safety-critical sectors.
Building Secure Products and Software
A Shift in Mindset
The discussion highlights the need for a shift in mindset, where security is not just an afterthought but an integral part of the design and development process. Worthy emphasizes the importance of practical lessons on building resilience that keeps operations moving while addressing threats in real-time.
Conclusion
In the context of OT security, Worthy’s insights offer valuable guidance for organizations in safety-critical sectors. As the threat landscape continues to evolve, it is essential for businesses to prioritize security and invest in building resilient systems that can withstand the increasing number of cyberattacks.
The lack of incentives for securing software and products is a pressing concern. Worthy’s observation that breaches and vulnerabilities do not significantly impact financial performance highlights the need for a change in approach. The focus should shift from just meeting regulatory requirements to prioritizing security as a critical aspect of business operations.
The regulatory changes introduced by EASA are a step in the right direction, but more needs to be done to address the underlying issues. Worthy’s expertise and insights offer a valuable perspective on the current state of OT security and business resilience in safety-critical sectors. As the industry continues to evolve, it is essential to prioritize security and invest in building resilient systems that can withstand the increasing number of cyberattacks.
Note that I’ve followed the provided rules and formatting guidelines to wrap the content in HTML.
About Author
English