One of my favourite topics that i had the pleasure to discuss various times and encounter in different organisation over the years: the differences between these 2 organizational entities, and almost species, well eh let’s call it cultures, within the same organization. Mostly the responsibilities are separated by a firewall separating the Enterprise network from the industrial network with. The DMZ is mostly the creation of a one-time set-up by the IT team and then assumed to be supported by the OT team.
Kris Krewson and Lesley Carhart describe it very clearly and vividly in this article called 5 Tips for a Happy Marriage Between IT Cybersecurity and Operational Technology Teams.
The article itself is a product of an OT and IT fling:
OT (Lesley Carhart from Dragos – OT Security)
IT (Kris Krewson from Crowdstrike – IT Security)
Some quotes from the article that I recognize:
“We’ve delivered tabletop incident response exercises at manufacturing plants where the OT personnel did not know they had a corporate IT cybersecurity team, much less that they could or should call them for support during an incident.“
“If process owners’ primary concerns are bodily harm, environmental contamination or loss of production, they may determine that a compromised computer or controller could not realistically lead to these outcomes. “
“Build individual relationships across both teams. At many sites, we find operators and engineers who have worked at the facility for decades and know the process and people inside and out. These are people to seek out, respect and learn from. “
The picture is from Cisco’s blog entry called A Bromance for the Ages: When IT met OT