Usage of Cybersecurity Standards in Operational Technology Systems
摘要
The escalating frequency of cyber attacks against industrial installations over the past decade underscores the growing imperative to fortify cybersecurity in organizations. The advent of Industry 4.0 has interconnected factories with the external world, intensifying cybersecurity risks. While international standards are advocated as a source of knowledge to enhance cybersecurity efforts, scant information exists regarding their applicability and usage in Industry 4.0. Diverse cybersecurity standards are available, either specialized for Information Technology (IT) or Operational Technology (OT) or formulated as universal umbrella standards to guide organizations’ efforts. In this paper, two data sources are deployed - a Semi-Systematic Literature Review (SSLR) and interviews- to unveil the extent of utilization of cybersecurity standards for OT systems in the Industry and to identify potential barriers to cybersecurity standard usage. The results indicate a low applicability of cybersecurity standards within OT systems. Additionally, the size and lack of practical guidelines in OT cybersecurity standards act as entry barriers, especially for Small and Medium Enterprises (SMEs) with limited resources. The interviews reveal that the organizations mitigate the identified barriers by creating bespoke internal OT standards appropriate for the organization’s size and goals.