Which three areas are the classic hard cases for cyber security, and what makes each of them hard?
OT, legacy IT and cloud services — the first two are stuck in an earlier era whose isolation has since been broken open, and the third was built for a different model entirely.
* None of the three is careless — each is doing what it was designed for in a world that changed around it. *
| OT — operational technology | Legacy IT (on-premises) | Cloud service | |
|---|---|---|---|
| What it is | Networked cyber systems that control production plants | Grown on-premises IT running the core business | A service "as it is", designed to appeal to as many customer groups as possible |
| Technology era | Early perimeter security or before | The era of perimeter security | Its own — the technology is as it is, take it or leave it |
| What broke | Isolation opened up by business demands for interconnectivity | Network security broken open by manifold interactions | Nothing broke — it was never designed for your perimeter |
| Why security is hard | Insufficient hardware performance for security payload; compliance with production regulations, operational safety, Rückwirkungsfreiheit (no reaction back onto the controlled process) | Pronounced attack surface; the design never anticipated interconnectivity in public environments | Not compatible with perimeter security; public back doors such as admin portals and public-only services; security is not the primary selling point |
The unifying insight: none of the three is hard because someone was careless. Each is a system doing exactly what it was designed to do, in a world that changed the assumptions underneath it. OT was isolated and then connected; legacy IT was bounded and then interconnected; cloud was designed for many tenants and then asked to sit inside one company's border.
Tip: the OT constraint that surprises IT people most is Rückwirkungsfreiheit — a security measure must not act back on the controlled process. An agent that pauses a server for a scan is an inconvenience in IT and a safety event in a plant.
Go deeper:
Wikipedia — Operational technology — the OT column in depth, including the isolation that business demands broke open.