Meet Cloud And Edge Challenges

OT cloud will increase over time but must come with secure-by-design and secure-by-default principles embedded from the start of any initiative/project.

By Peter Jackson, ISA

Cloud adoption and edge computing are two of the most significant trends shaping the future of technology. They also present several challenges and opportunities for industrial organizations and operational technology (OT) practitioners.

It would be difficult to find someone who doesn’t have at least a basic understanding of cloud technology. Cloud systems are basically third-
party computing, i.e., a divergence from operating on-premises solutions. Most organizations are well down the road with cloud adoption. These days, we find that some organizations are pivoting from a cloud-first strategy to a cloud-focused strategy, the nuance being that active decisions are made about where to host data, as opposed to arbitrarily “in the cloud.”

For industrial cloud, there are still many (often appropriate) hesitancies about moving non-ICS OT systems off-premises. In many cases, cloud adoption for OT creates more problems than it solves. Most organizations are considering some OT cloud use, for example with IIoT systems. Similarly, organizations are considering a cloud in their industrial DMZs (Purdue-like level ~3.5) where it can reduce business risk (informed by safety, security, and reliability risk factors), and solve more problems than it creates.

It’s expected that OT cloud hesitancy will erode over time as the benefits of cloud systems become overwhelming for OT and/or industrial use cases. This must come with secure-by-design and secure-by-default principles embedded from the start of any initiative/project. There is also a requirement for clear understanding of how the systems will operate when the cloud connectivity is lost.

Industrial Edge

One of the mechanisms for de-risking industrial cloud is industrial edge. Edge as a technology is designed to place computation and processing close to where the data is being generated. Edge solves some “client” problems associated with loss of connectivity with cloud or on-prem servers.

Some sectors are well along their industrial edge maturity journey, for example in logistics and manufacturing, where margins are tight and regulations are low. Other sectors, such as energy and utilities, are rightfully hesitant to adopt industrial edge technology because risk tolerance is low and inertia impacts digitization initiatives.

The world is becoming more digitized, including in OT, and practitioners (both security and non-security) who don’t consider the best business outcomes for industrial organizations may find themselves starting to work against the tide. Historically OT practitioners were hesitant to move from serial to Ethernet, and then from bare metal to virtualized infrastructure. In both cases, there was a maturity journey required for people, process, and technology. OT security and digitization can be an enabler, if done with the right approach to minimizing business risk (including security risk), maximizing outcomes, and solving more problems than you create. EP

Peter Jackson is OT Cyber Security Manager at SGS ECL, New Plymouth, New Zealand (sgs.com), ISA-99 committee member, and SANS ICS515 instructor. The SGS OT consultants and engineers support industrial organizations with hard problems in OT/ICS as pragmatists and enablers, supporting safe, secure, reliable industrial operations.