OT and IoT: the convergence that multiplies industrial risk

The digitalization of industrial plants has blurred the boundary between process control systems (OT) and connected devices (IoT). This convergence, which promises efficiency and real-time data, is dangerously expanding the attack surface of organizations. According to the State of Critical Infrastructure Cybersecurity report by Palo Alto Networks, 42% of organizations identify legacy OT assets that cannot be patched as their main cybersecurity risk, and 68% do not have complete real-time visibility of the assets connected to their OT networks.

The European Union Agency for Cybersecurity (ENISA) has also warned that digital dependencies and growing connectivity are expanding the attack surface and require new surveillance and protection measures. In a context where business continuity is at stake, understanding why these environments are vulnerable is the first step to protecting them.

Two worlds, one network

Carlos Aris Gómez, Cybersecurity Director at EPAM NEORIS Iberia, explains that OT systems control physical processes, so reliability and physical safety condition their management. In contrast, IoT encompasses devices designed for hyperconnectivity and ease of use, where security is often perceived as friction. This difference in philosophy is key: OT equipment often uses legacy operating systems conceived for isolated environments, with lifecycles of 20 to 30 years, compared to 3-5 years for IT technology. Many of these devices remain active today, although they were designed at a time when Internet connectivity was not considered a threat vector.

On the IoT side, the situation is no better. It is common to find default credentials that were never changed or outdated firmware, two of the most exploited attack vectors. Added to this are two important challenges: patching, especially difficult in systems that must operate 24/7, and shadow IoT, those connected devices that the organization does not manage or that do not meet its security requirements, including personal devices that employees connect to work (BYOD).

The visibility problem

Rocío Dantart, Director of Industrial IoT for EMEA at Cisco, adds that many organizations do not have a complete and updated inventory of their devices, vulnerabilities, or communications. Without that knowledge, it is difficult to identify exposures, detect insecure configurations, and establish adequate controls. Remote accesses implemented without oversight by security teams can also become entry points.

Protecting these environments requires understanding the industrial process. It is not enough to transfer IT security practices: availability, production continuity, and physical safety must be preserved. Therefore, close collaboration between IT and OT is essential, combining cybersecurity capabilities with knowledge of the assets and their operational impact.

What it means for an SME

For an SME with industrial processes, OT/IoT convergence is not a distant threat. Even if it does not manage critical infrastructure, any business with connected machinery, sensors, or control systems is susceptible. The lack of visibility and the presence of legacy devices are risks that can paralyze production or compromise sensitive data.

Furthermore, the growing interconnection with suppliers and customers expands the perimeter. An attack on a third party can become an entry point to one's own network. Security is no longer just an IT issue, but one of operational resilience.

Practical recommendations

From ForgeNEX we propose a series of measures adapted to the reality of SMEs:

• Complete and updated inventory of all OT and IoT assets, including firmware, versions, and known vulnerabilities.
• Network segmentation: isolate OT environments from corporate IT networks and the Internet, limiting traffic to the essential minimum.
• Multi-factor authentication (MFA) and the principle of least privilege for any remote access, both for employees and suppliers.
• Continuous monitoring of traffic and devices, with alerts for anomalous behavior.
• Patching policy adapted to production cycles, with planned maintenance windows.
• Training and awareness to avoid shadow IoT and insecure practices.

OT/IoT convergence is unstoppable, but it does not have to be an uncontrolled risk. With the right measures, SMEs can benefit from digitalization without jeopardizing their business continuity. At ForgeNEX we can help you assess your situation and design a security strategy adapted to your reality.

Source: Computerworld. Analysis and adaptation: ForgeNEX.