Manufacturing OT security stalls on split IT/OT accountability, funding and production priorities, executives say
A feature interviewing industrial cybersecurity executives argues that manufacturing security programs stall less because of weak policy than because accountability, budget and responsibility sit in different places across IT and OT. The article cites the SANS 2025 ICS/OT budget survey: 37% of organizations share ICS/OT budget control between IT and OT, 31% have IT controlling it and 26% have OT controlling it. Only 27% of budget decisions are led by CISOs or CSOs, and only 9% of organizations allocate more than 75% of their security budget to ICS/OT. Fortinet's 2026 survey found 23% of OT professionals see only half of their OT environment. Interviewees from Sun Square, NexGenomics, Infrashield and RunSafe Security gave anecdotal examples of governance gaps: an unmanaged Windows XP host on the network, a firewall configured with any-to-any allow rules, and unscreened USB media. They also described uneven security across acquired plants. This is commentary and survey data, not a specific incident.
Detalhes técnicos
- Unmanaged legacy systems (a Windows XP machine with 2004-era update data) stayed connected because neither IT nor OT claimed ownership. Such a host could offer a path to other systems within its network reach.
- A firewall was deployed with any-to-any allow rules because accountability for configuration and acceptance was unclear.
- Reported site-level gaps include poorly controlled supplier access, incomplete segmentation, unsupported systems without compensating controls, inconsistent remote access, limited control-system visibility, untested recovery plans and unscreened portable media.
- Security tooling funded at headquarters often does not cover plant-floor OT. Acquired facilities may never be fully integrated into the corporate security model.
- RunSafe's Saunders argues that OT systems 10-15 years old or more are highly exposed because they are hard to patch. He says the industry should eliminate vulnerability classes, such as memory-safety flaws, through secure-by-design and "secure by demand" practices rather than rely on patching.
Remediação
- Assign joint IT/OT ownership with clear authority, deadlines and escalation. Secomea research cited in the article found lower incident rates where IT and OT jointly own remote access.
- Use central governance with local execution: minimum requirements and risk-acceptance authority set centrally, with plants adapting to operational constraints.
- Frame OT risk as business consequence (safety, environmental, process, production) and fund work on the site's operational timeline.
- Agree decision rules before a crisis, use compensating controls during deferral with an accountable owner and review date, and give security a seat in plant design decisions.
- Make verification of control effectiveness independent of the team that implements remediation.
Linha do tempo
-
Manufacturing OT security stalls on split IT/OT accountability, funding and production priorities, executives say
ler a análise desta fonte ocultar
A feature interviewing industrial cybersecurity executives argues that manufacturing security programs stall less because of weak policy than because accountability, budget and responsibility sit in different places across IT and OT. The article cites the SANS 2025 ICS/OT budget survey: 37% of organizations share ICS/OT budget control between IT and OT, 31% have IT controlling it and 26% have OT controlling it. Only 27% of budget decisions are led by CISOs or CSOs, and only 9% of organizations allocate more than 75% of their security budget to ICS/OT. Fortinet's 2026 survey found 23% of OT professionals see only half of their OT environment. Interviewees from Sun Square, NexGenomics, Infrashield and RunSafe Security gave anecdotal examples of governance gaps: an unmanaged Windows XP host on the network, a firewall configured with any-to-any allow rules, and unscreened USB media. They also described uneven security across acquired plants. This is commentary and survey data, not a specific incident.
Technical Details
- Unmanaged legacy systems (a Windows XP machine with 2004-era update data) stayed connected because neither IT nor OT claimed ownership. Such a host could offer a path to other systems within its network reach.
- A firewall was deployed with any-to-any allow rules because accountability for configuration and acceptance was unclear.
- Reported site-level gaps include poorly controlled supplier access, incomplete segmentation, unsupported systems without compensating controls, inconsistent remote access, limited control-system visibility, untested recovery plans and unscreened portable media.
- Security tooling funded at headquarters often does not cover plant-floor OT. Acquired facilities may never be fully integrated into the corporate security model.
- RunSafe's Saunders argues that OT systems 10-15 years old or more are highly exposed because they are hard to patch. He says the industry should eliminate vulnerability classes, such as memory-safety flaws, through secure-by-design and "secure by demand" practices rather than rely on patching.
Remediation
- Assign joint IT/OT ownership with clear authority, deadlines and escalation. Secomea research cited in the article found lower incident rates where IT and OT jointly own remote access.
- Use central governance with local execution: minimum requirements and risk-acceptance authority set centrally, with plants adapting to operational constraints.
- Frame OT risk as business consequence (safety, environmental, process, production) and fund work on the site's operational timeline.
- Agree decision rules before a crisis, use compensating controls during deferral with an accountable owner and review date, and give security a seat in plant design decisions.
- Make verification of control effectiveness independent of the team that implements remediation.