How do IT and OT cybersecurity differ in priorities, and why?
IT protects the confidentiality, integrity and availability of information. OT protects the safety, reliability and availability of physical processes. Because OT downtime can endanger people or equipment, OT tolerates almost no downtime and is updated with great caution.
* IT puts confidentiality first; OT puts safety and availability first, and lives four times as long. *
| Aspect | IT | OT |
|---|---|---|
| Focus | Data, information, systems | Industrial control systems, automation, processes |
| Purpose | Confidentiality, integrity, availability of information | Safety, reliability, availability of processes and equipment |
| Endpoints | Servers, PCs, laptops | PLCs, SCADA systems, sensors |
| Protocols | Standard networking | Specialised industrial and proprietary protocols |
| Updates | Regular patching is normal | Updates need careful planning to avoid disruption |
| Downtime tolerance | Brief downtime acceptable | Very low, because of safety and operational risk |
| Regulation | Data protection and privacy | Industry-specific (IEC 62443, NIST) |
| Incident response | Restore data and systems | IT plus engineering skills, for digital and physical consequences |
| Lifespan | Hardware 3 to 5 years | Hardware 10 to 20 years |
The priorities follow from the consequences. A breached office server leaks data. A manipulated PLC can injure people or destroy a plant. This is also why the long product lifecycle is the biggest challenge in OT security. A controller installed today will still run in 2045, on software that nobody wants to stop the plant to update.
Go deeper:
NIST SP 800-82r3 — Guide to Operational Technology (OT) Security — the reference on how OT security differs from IT- Operational technology (Wikipedia) — OT systems, protocols and IT/OT convergence