Focus on OT Security: Why Companies Must Take a Holistic Approach to IT, OT, and Physical Security

Protect OT with IT tools alone, and you've already lost. The interconnection of production facilities, building systems, and corporate IT creates new opportunities but also increases the attack surface for cybercriminals. In this interview, Cassian Ewert, Solution Engineer at Claroty, explains why traditional IT security approaches are often insufficient in industrial environments, the role that asset visibility plays, and how companies can strengthen their cyber resilience in the long term.

Written by Nicole Wörner

Interviewer and Cassian Ewert sit facing each other with microphones in a studio

Digitalization is transforming not only corporate IT but also production facilities and building systems. Formerly separate areas are increasingly giving rise to interconnected infrastructures.

This opens up new possibilities for more efficient processes but also creates additional points of vulnerability for cybercriminals.

Cassian Ewert, Solution Engineer at Claroty (a provider of cybersecurity solutions for industrial environments and critical infrastructure), explains why proven IT security concepts cannot be readily applied to industrial environments. The conversation also covers asset visibility, cyber resilience in OT, and the impact of NIS2 on OT security.

Watch the video to find out why a blast furnace that's already running can't simply be restarted – and what that means for OT security.

assian Ewert smiles while speaking into a microphone and gesturing

Chapter Overview

0:00 Intro: Digitalization is bringing IT, OT, and physical security together
0:27 What is OT – and how does it differ from classic IT?
1:36 Why are once-separate worlds converging today?
3:48 What new risks come with this growing connectivity?
4:55 Why IT security concepts don't simply transfer to OT
7:28 When cyberattacks have physical consequences: a changed view of security
10:04 Asset visibility: do companies really know their own OT systems?
12:07 Cyber resilience in OT compared to classic IT
14:03 What worries security leaders the most right now?
16:26 How NIS2 is driving OT security
19:29 Outlook: IT, OT, and physical security in five years
22:02 Three recommendations for sustainable OT security

Insights at a Glance

A blast furnace can’t simply be restarted: the cleaning required before firing it back up alone costs a seven-figure sum. That’s why, according to Ewert, IT security concepts don’t just transfer to OT.
Real visibility into your own OT systems? At best, there’s usually just an outdated spreadsheet. Ewert’s takeaway from a BSI conference: “You can only protect what you know.”
A security incident in OT can cost human lives, for instance if a hijacked production robot goes haywire next to employees. Ewert’s comparison: he’d rather lose his vacation photos than have a colleague hit by a robotic arm.
NIS2 is an important driver for Ewert because it makes leadership demonstrably liable. His warning: some companies just commission a concept for the drawer – presentable to the auditor, but never actually lived.
Ewert’s three recommendations: really know your OT environment, separate IT and OT as far as possible – and don’t just write an incident plan, practice it too, if necessary with a 2 a.m. pager call.

Author

Nicole Wörner

Redakteurin

Componeers GmbH

Focus on OT Security: Why Companies Must Take a Holistic Approach to IT, OT, and Physical Security

Chapter Overview

Insights at a Glance

Further Reading:

Author