Integrity as an overarching protection goal for all five categories. © ZVEI

Define protection goals
If you ask IT security experts about the most important protection objectives, you often hear "CIA" - confidentiality, integrity and availability. With OT, on the other hand, it is very often "AIC" - in that order. The focus is therefore more on availability, followed by integrity. Both sequences make sense on their own, especially in non-networked industrial environments. It becomes critical in the environment of networked production. The "patch at all costs" approach typical of IT does not really make sense in this context, nor does the "never patch in the name of availability" approach typical of OT. In many environments, on the other hand, there is a focus on integrity as the primary protection goal. After all, what use is encrypted data if it has been corrupted? Or what use is the availability of a cell if parts are processed incorrectly? Integrity thus crystallizes here as one of the primary protection goals of networked production.

In terms of trustworthiness, integrity is even the basis for subsequent protection goals. This naturally includes safety and security, but goes far beyond this with objectives such as privacy and resilience.

Meaningfulness of security

Most people instinctively understand why safety is necessary. After all, one's own health is a good whose value is generally highly valued. When it comes to security, the question of "why" is more complex. The idea of IT security as an end in itself is perhaps sensible and appropriate in the office IT environment. After all, the danger posed by inadequately secured systems is greater than the possible side effects of security mechanisms.

In the OT area, the question of the "why" of security is absolutely essential, as the impact may be considerably greater - and often not just financially. In the area of office IT, explanations often fall back on the simple double play of "threat" on the one hand and "solution" on the other. However, if - as in OT - a very specific risk due to faulty security comes into play, security experts must also accept the question of whether it makes sense. What's more, they must be able to demonstrate the benefits of introducing this security function.

IT and OT under one roof

Industry 4.0 can only work if OT and IT work together. Different terms or their definitions must not prevent cooperation. Fortunately, cooperation becomes easier with newer standards as a "translation aid". However, this also means questioning or expanding cherished truths. After all, the context in which they were created is also changing. In particular, it is the task of IT to see itself as a service provider and to speak the language of the customer - in this case the industry - and to understand these environments. This also includes questioning and possibly adapting one's own priorities. Just like the willingness to be able to explain and justify cherished truths or to adapt them to current circumstances if necessary.
Udo Schneider, Security Evangelist at Trend Micro / ag

[1] ZVEI: Whitepaper Integrity of data, systems and processes as a core element of digitalization. ZVEI Automation Association, Industry 4.0 management group, SG Security. November 2017.