Representative End User Clients
Representative Automation Clients
Representative Software Clients
Overview
Cybersecurity end users from major industrial companies shared their views on the challenges and benefits of converging IT and OT cybersecurity teams and processes.
Many industrial cybersecurity leaders are pushing for convergence of IT and OT cybersecurity programs. They recognize that this can be a cost-effective way to address resource challenges, improve defenses against sophisticated cyber-attacks, and institute the end-to-end protection required for secure digital transformation. But many are unsure about how to achieve an effective convergence of people, processes, and technologies. What should be their final goal? How do they overcome cultural and technological differences?
The 2021 ARC Industry Forum included two workshops to help end users develop effective convergence strategies. Each workshop included polls of attendees on key aspects of IT/OT cybersecurity convergence and a roundtable discussion of the results and other issues. Roundtable participants included IT/OT cybersecurity leaders from various industries who shared what their own companies were doing.
This ARC insight discusses the workshop on people and process convergence. A separate insight discusses the workshop on cybersecurity technology convergence.
Convergence Drivers Reflect Growing Cyber Concern
Today, most industrial companies have two separate cybersecurity programs. Cybersecurity professionals within the 
CIO’s organization are responsible for ensuring the security of all corporate data, IT assets, networks, and apps. People in operations and engineering take care of the security of OT networks and assets, with or without corporate level guidance and support.
Differences in underlying technologies, goals, and security management strategies led to these siloed cybersecurity programs. While these differences remain, separate programs are creating a variety of problems for many companies. Most OT cybersecurity teams lack the resources and supporting technology to manage today’s sophisticated attacks, shifts to remote workers, and the many technology changes occurring in OT systems. Lack of visibility into OT systems is frustrating CISO efforts to understand and manage corporate cyber risks.
Concern about all these challenges were reflected in the polls and roundtable discussions. While the definition of end-to-end security varies among companies and facilities, panelists agreed that the real issue and goal of convergence should be to ensure that security is being consistently managed across every device, app, and data store that plays a part in business activities.
The importance of convergence was also reflected in the poll results and this is consistent with other ARC research that shows that cybersecurity concern has increased top management support for more security controls and stronger CISO involvement in OT cybersecurity programs. Panelists’ experience aligned with these poll results and they noted how top management support is helpful for their efforts.
Convergence Is in the Eye of the Beholder
Almost 70 percent of attendees indicated that their companies were already on IT/OT cybersecurity convergence journeys, with a large percentage of these companies indicating they were already converged. Panelists were quite pleased, but surprised, by these poll results. Their consensus was that companies must have different definitions as to what convergence means.
ARC’s presentation at the start of the workshop highlighted the need for companies to establish convergence goals at the outset of their efforts. Three different convergence models were described, Collaboration, Integration, and Unification. These models balance the tradeoffs between convergence and isolation in different systems, and programs should include all these approaches in their strategies. These models can be used to set site-specific program goals and as mile markers for journeys to unified programs.
ARC Advisory Group clients can view the complete report at ARC Client Portal
If you would like to buy this report or obtain information about how to become a client, please Contact Us
Keywords: IT/OT Cybersecurity Convergence, ARC 2021 Industry Forum, ARC Advisory Group.