Hydrocarbon Processing - August 2022 - 10

Business Trends
If organizations fail to define clear objectives
for IT/OT convergence, they may
also fail to implement the right processes
and tools for their specific environment,
or they may end up with diffuse goals that
cannot be accomplished. Both outcomes
diminish the effectiveness of convergence
and will reduce long-term morale and
buying around convergence.
However, in defining a convergence
strategy and deliverables, organizations
should allow for flexibility. Especially
within the cybersecurity realm, threats
and protections are rapidly evolving-
this should be addressed by infusing flexibility
into your strategy. While it is easier
said than done, finding a middle ground
allows for adaptation when inevitable difficulties
are encountered while also maintaining
clear project goals and timelines.
Process and workflow convergence.
Process and workflow convergence are
integral to a broader IT/OT convergence
plan. Introducing new technology
to a converged system without adapting
processes and workflows to the new system
will not deliver the desired business
benefit. Therefore, before organizations
can begin converging processes, it is important
to recognize the reasons why IT
and OT processes are different. Once the
" why " is identified, an organization can
look at how processes can be converged
without compromising the effectiveness
or safety of an individual IT or OT
process. IT and OT processes and workflows
have always been different-for
good reason.
Underlying nearly every OT process is
safety. Consistency is safety's best friend,
and as such, OT systems favor legacy systems
and processes-change is rare in
applications and infrastructure and there
must be a good reason to do so. IT processes
are quite the opposite. To achieve
greater process efficiency or to adapt to
evolving risks, IT processes encourage
updates and adaptation.
Both philosophies support cybersecurity
in their own way. IT processes can
be secure because they are constantly upgraded
to address vulnerabilities as they
emerge from the wild and use new cyber
defenses. OT processes can be secure due
to their strict adherence to procedures
and regimented control of change.
Before entering a converged environment,
both IT and OT cybersecurity pro10
AUGUST 2022 | HydrocarbonProcessing.com
cesses and workflows must be adapted. A
great deal can be learned from one another.
Stricter attitudes towards processes
and a culture of safety-hallmarks of the
OT environment-should be adopted
within IT. Now that their work is more
directly integrated with manufacturing
or production systems and the personnel
physically operating them, IT administrators
must recognize the elevated
stakes associated with cybersecurity.
The resulting cultural change within IT
should better prepare IT processes and
workflows for convergence.
Conversely, OT processes and workflows
should be adapted to fit a more regular
schedule of updates. This approach
is necessary to support cybersecurity in
a converged environment that contains
more connected devices and potential
vulnerabilities. IT administrators are acquainted
with this approach and their expertise
should be utilized when designing
new OT processes, systems and capabilities
to support convergence.
OT processes and workflows can be
prepared for convergence-and
supported
during and after convergence-
by an OT security center for excellence.
A center for excellence is important for
training OT administrators and engineers
to protect critical infrastructure as new
vulnerabilities are introduced in IT/OT
convergence. Administrators can learn
through hands-on cybersecurity exercises
that replicate real-world risks. In turn,
these engineers can tailor their workflows
around a new understanding of cybersecurity
in a converged environment.
Management- and board-level
thinking. People-rather than systems
or technologies-may be the most important
factor for IT/OT convergence
success. However, while much attention is
paid to the actual practitioners of IT and
OT systems (i.e., those with their hands
on the physical levers), often lost in the
conversation are the people at the top of
an organization: those at the management
and board level.
In addition to determining an organization's
budget or goals, the management
team and board determine culture. Two
key aspects to a culture that supports IT/
OT convergence are understanding and
open-mindedness. Though these may
sound better suited for marriage counseling
than for an industrial operation, they
are practical for both.
Increased understanding of each other's
systems and processes is critical for
preparing IT and OT teams for convergence.
Such understanding will improve
both the efficiency and safety of newly
converged processes like data transfer
and system monitoring.
Open-mindedness-to one's IT or
OT counterparts-will ease the acceptance
of new shared protocols or processes
resulting from IT/OT convergence.
If administrators are aware of the
unique needs of an IT or OT system, they
are more likely to buy in to the plan and
accept compromises to how they think
the operation should be run. There are
additional practical steps organizations
can make to their management team and
board to support IT/OT convergence.
The CIO does not sit on the board for
many industrial organizations. This fact
is a relic of an old way of thinking-that
operations trump all, especially IT. This
broadly needs to change, but particularly
for organizations preparing for IT/OT
convergence. IT must have a seat on the
board so that their needs and insights are
addressed for convergence plans.
This approach can be applied more
broadly to management with a leveling of
opinions and responsibilities. The COO's
opinion at an industrial organization
should not necessarily be more important
than that of the CIO. Chief Financial Officers
(CFOs) should fully understand the
risks and benefits of IT/OT convergence
so that their decision-making supports the
effort. Full management buy-in is only possible
when everyone's opinion is valued.
Distributing responsibilities between
IT and OT. Somewhat counterintuitively,
a key for IT/OT convergence
success is knowing which processes to
keep separate. Within this, distributing
cybersecurity responsibilities between IT
and OT teams is critical to ensuring convergence
does not make an organization
more vulnerable than before.
CISOs have become increasingly important
for industrial companies. However,
within large, diverse organizations,
CISOs' differing responsibilities for different
divisions can become burdensome
and even dangerous if their holistic remit
prevents the separation of cybersecurity
responsibilities. A way to avoid unnecessary
vulnerabilities resulting from an overstretched
CISO is to have two CISO-like
roles-one each for IT and OT-in addi
http://www.HydrocarbonProcessing.com
Hydrocarbon Processing - August 2022

Table of Contents for the Digital Edition of Hydrocarbon Processing - August 2022
