Hydrocarbon Processing - August 2022 - 9

T. DIEMONT and H. ALSHEDOKI,
KPMG, Saudi Arabia
Business Trends
IT/OT convergence: Efficiency and cybersecurity
in the energy and natural resources sector
Information technology (IT) and
Systems. OT systems are usually quite
operational technology (OT) environments
have traditionally assumed distinct
roles in industrial organizations.
Separated both in purpose and in practice,
IT and OT also differ in their culture
and their norms around security
and efficiency.
However, as new technologies are introduced
to the OT environment, it is
becoming necessary for the two environments
to be converged. Without convergence,
the new technologies and the data
gathered will be vastly underutilized,
making it difficult to justify the investments
needed to modernize OT environments.
Convergence requires organizations
to bridge the gaps between IT
and OT environments' people, processes
and systems and to build a smarter, more
secure network with high visibility to
monitor and control both environments.
This article considers the challenges
and opportunities and presents a path
toward better convergence of people,
systems and strategies between these two
functions of an organization in the energy
and natural resources sector.
Starting from behind. Transformational
change is not just about execution
or follow-up: it is also about preparation.
IT/OT convergence requires the right
preconditions-in both an organization's
environment and culture-to be successful
and lasting.
Though some of the world's most successful
industrial, and energy and natural
resources companies are well along the
path of IT/OT convergence, many of
their smaller or less ambitious peers are
not. Each in their own way, systems, people
and strategy are holding them back
from starting or are limiting their progress
with IT/OT convergence.
a bit older than IT systems due to their
capital intensive nature and safety protocols
that prefer consistency to change. By
design, newer OT environments are, for
the most part, already prepared for convergence.
These systems can support full
automation, and remote monitoring and
Internet of Things (IoT) devices can easily
be integrated.
Taken alone, system age is not necessarily
a hindrance to IT/OT convergence.
An OT environment can be upgraded to
support automation, monitoring and IoT
devices. However, OT systems that use
outdated equipment or are only patched
on a minimal level are not secure. Many
organizations do not secure these systems
because of a desire to separate them
from the internet and other networks.
Securing OT systems is a prerequisite to
IT/OT convergence.
Cybersecurity capabilities must be
implemented to evaluate existing systems
for threats and to continually monitor
them in the future.
Another system prerequisite for IT/
OT convergence is separation. This may
seem counterintuitive, but if an IT and
OT architecture are clearly separated
prior to convergence, their eventual integration
will be easier to accomplish. It
is critical this is done at the beginning of
the convergence project execution lifecycle
rather than midway through it.
People. Preparing an organization's
people and culture for IT/OT convergence
is critical for success. In fact, it is
often the first step. Building a strategy for
convergence should start at the top.
Unfortunately, simply bringing the idea
of IT/OT convergence to the board room
is a struggle for some companies. When
the long-term benefits of convergence are
not fully understood, it is difficult for its
proponents to articulate the need for convergence
to management or the board.
Poor understanding also results in inaccurate
evaluations of return on investment
(ROI). To remedy these difficulties,
it is important for organizations to
include both IT and OT administrators in
the evaluation of an IT/OT convergence
proposal. Too often at industrial companies,
IT administrators are left out of
these conversations.
In the same vein, Chief Operating Officer's
(COO's) opinions are often heard
before the Chief Information Officer's
(CIO's) opinions at industrial organizations.
However, both executives have important
contributions to make towards
the planning of an IT/OT convergence
strategy. Therefore, for organizations hoping
to explore IT/OT convergence, CIOs
should be empowered on management
teams and in board rooms and not seen as
a second fiddle to COOs.
Cybersecurity should be integral to
an IT/OT convergence project from its
inception. Responsibility for IT/OT
convergence cybersecurity will often
fall on a Chief Information Security Officer
(CISO). In many cases, CISOs are
brought into a convergence project in the
middle or even late stages, which can mean
systems and processes are not integrated
securely. When CISOs are included in the
planning stages, they can identify the areas
most vulnerable to threats and develop the
plans to secure them early on.
Strategy. A good practice for organizations
considering IT/OT convergence is
to clearly define what use cases they want
to solve by converging environments. Do
you want your systems to operate more efficiently,
deliver faster insight to leadership
on production data and analysis, or do you
want to improve maintenance and servicing
of equipment?
Hydrocarbon Processing | AUGUST 2022 9
Hydrocarbon Processing - August 2022

Table of Contents for the Digital Edition of Hydrocarbon Processing - August 2022
