Many changes and emerging trends are taking place in the energy and manufacturing industries. These trends are affecting these industries’ economic, social, and working environments and providing opportunities to improve business performance in their current, highly competitive conditions. One such trend is a combination or convergence of information technologies (IT) and operational technologies (OT).
Information and communication technology (ICT) has advanced significantly over the past two decades in terms of power, bandwidth, and cost-effectiveness. Industry after industry has found advantages in cost and capability by transforming from systems based on proprietary computing and communications to those based on open standard computing platforms.
A false sense of security
Industrial systems have often relied on obscurity and lack of interconnection for their security. Repeated incidents have shown that this has been a false security. Obscure, unconnected systems may be more vulnerable due to lack of identity management, authentication, or secure encryption. Stuxnet was a cyber weapon specifically aimed at an unconnected control system.
Engineers managing compute and communications for industrial applications have been faced with growing complexity of their industrial control systems. To keep pace, they are challenged to evolve their process maturity, especially processes for security and quality.
Leading IT organizations have the experience and process maturity that industrial engineers desperately need. At the same time, IT must recognize and learn the gaps between their business context and the engineers who develop, maintain, and operate industrial control systems.
Both sides need to find common ground to bring their unique knowledge and skills to bear in addressing the needs of industrial control systems that comprise critical infrastructure.
What is IT/OT convergence?
Before addressing IT/OT convergence, let’s first understand these two terms.
Information technology: This term refers to the use of computers, software, hardware, and other telecommunication devices to perform business operations. These devices are mainly located at office locations, server rooms, and data centers, often known as the “carpeted office” environment.
IT is associated with back-end functions used to perform various business operations such as enterprise resource planning, billing, revenue collection, asset tracking, maintaining customer information, and so on.
Operational technology: OT is associated with front-end, field-based devices used to perform actual operations. These OT systems are based on vendor-specific, proprietary technologies. They are operating in real-time or near real-time environments. These are “non-carpeted” environments.
IT/OT convergence means integrating operational technologies such as SCADA, remote terminal unit, programmable logic controllers, and meters and sensors, which work in real time or near real time with IT systems.
IT and OT teams have typically had separate, complete control of their strategies and budgets. They possess vast experience and competence in their own domains. Imagine the power of leveraging the strengths of both. Convergence doesn’t mean converting IT engineers into plant engineers or vice versa. It means building common ground between the organizations such that they can come to rely on one another as specialists within a larger organization whose collaboration is essential to success.
What’s driving the convergence is the increasing complexity of networking and computing in OT and the need for a significant increase in process maturity in areas that are normally within the domain of IT, especially network security and identity management.
The value proposition is more than cost savings of eliminating duplicate resources running the IT functions in OT. The value is in material improvement in the effectiveness and capability of the cross-functional team to fulfill the core mission of secure, reliable, and streamlined operations.
Why has OT been separate from IT?
Manufacturing, building controls, industrial process control, communications, physical security, and countless other fields all began long before there were inexpensive microprocessors and high-speed, low-cost standard communication protocols. In earlier times, engineers connected remote dials or indicators so operators or engineers could see dial readings without having to travel to where the sensor was located. Control rooms today echo those origins with displays of telemetry data tiling wall-sized displays.
Computing and communication associated with controlling physical systems have always had physical devices as their primary focus. Specialized computing and communication were often required to meet unique needs that were very different from the needs of business computing addressed by IT. The astounding growth in capability and decrease in price has made technologies from IT compelling options for industrial control systems.
The challenge was, and continues to be, understanding the physical systems and making sure general-purpose IT is up to the job.
The result has been what’s sometimes referred to as “operations IT departments” – data centers and networks – architected, purchased, and operated by engineering departments or systems specialists rather than IT. Challenges arise as computers and networks required for these systems become larger, more complex, and more interconnected. Examples of complexity include:
- Requirements like failover, redundancy, and resilient network designs
- The need for remote access and security
- IT processes that meet or even exceed the complexity of the engineering requirements
As these and other challenges arise, different organizations respond to them in different ways. But it is very difficult for OT engineers and control system operators to open up access to critical systems.
There is also a frequent lack of appreciation by IT departments of the specific, unique requirements of industrial control systems. These include systems that cannot be taken down, rebooted, or even subjected to simple tests like a port scan without sometimes disastrous consequences.
The driving forces for implementing IT/OT convergence include:
- Availability of large amounts of data, which can be converted into some meaningful, actionable information
- Large assets spread around multiple locations and geographies
- Open standards and network connectivity that facilitate data-sharing across an organization
- Need for a single, integrated, actionable platform to deliver the right information, at the right time, in the right format, to the right person, so strategic decisions can be made
- Controlling and streamlining system operations and maintenance costs due to aging infrastructure and workforce nearing retirement
A new paradigm
Here are a few of the challenges for OT:
- Multiple versions of software or firmware
- Upgrading hundreds, thousands, or even millions of devices to new firmware versions
- Adequate testing and quality assurance prior to production rollout
In addition, OT must keep up with the rapid increase of networking features, capabilities, and standards. These are being introduced at a speedy pace to an IT industry exploding with new mobile communications, consumerization of IT, virtual desktops, cloud computing, and new computing/communication platforms such as tablets and smartphones.
Traditional methods for development and management of industrial applications have been overtaken by growing system complexity. It’s no longer feasible to effectively scope, architect, design, build, and maintain operational systems in groups of silos using ad-hoc approaches. The roles for industrial engineers and ICT professionals have evolved based on five key requirements:
- System development involving complex systems requires rigorous system engineering methods and formal lifecycle development processes.
- Modern control systems require significant expertise in embedded systems and security to architect, design, build, and maintain.
- Industrial applications require a multidisciplinary approach involving subject expertise, software, computing, and communications.
- Operational effectiveness requires integrated business planning, portfolio management, project delivery, and ongoing operations governance.
Of all of these challenges, one of the most critical is security. Security and cyber-attacks with IT/OT can lead to devastating consequences, which may include power failure, blackouts, and loss of confidential information and documents. With continuous efforts to devise adequate policies, procedures, and culture throughout the organization, these challenges can be overcome and avoided.
The case for converging IT and OT
While it’s possible for OT departments to develop parallel and equivalent capabilities, this requires personnel and resources that most companies cannot afford and leaves the company vulnerable to critical inconsistencies. IT/OT integration results in a more optimized and less costly technology deployment.
In bringing IT processes and capabilities to OT, IT needs to recognize the unique requirements of critical control systems and the equivalent process capabilities that OT provides for the engineering and operation of critical control systems.
Successful companies will find ways to establish common ground and combine the expertise and value of both IT and OT environments.