Guest blog by Matthew Mackay, Security Practice Lead at Logiq. Written for and first published on techUK.
Over the last decade, we have witnessed the convergence of Information Technology (IT) and Operational Technology (OT), a shift often linked to Industry 4.0 or the Fourth Industrial Revolution. This integration offers significant benefits, such as enhanced connectivity between systems, but also introduces new risks that must be managed effectively. As IT and OT become more interconnected, cybersecurity practitioners must move beyond the traditional Confidentiality, Integrity, and Availability (CIA) framework to address the broader security challenges that this convergence introduces.
Historically, cybersecurity has focused on protecting IT systems by safeguarding sensitive data (Confidentiality), ensuring data accuracy (Integrity), and maintaining system availability (Availability). While the CIA triad remains fundamental, it provides a limited perspective when applied to the converging world of IT and OT. By focusing solely on information-centric risks, we may overlook broader strategic risks that impact the organisation’s mission and operational safety. To properly understand and manage risks in this new landscape, we need to evolve our approach to include both IT and OT contexts whilst maintaining alignment with the organisation objectives.
A holistic approach to cybersecurity is now essential. IT and OT networks are complex, and their integration demands that we consider security from a broader perspective. Beyond just protecting information, we must recognise that a breach in one domain can have direct consequences on the other. For example, OT systems, which control physical processes in industries like energy, manufacturing, and transportation, prioritise safety and operational continuity. Cyberattacks on these systems could lead to physical damage or even jeopardise human safety, demonstrating the need for cybersecurity to extend beyond the information-centric CIA triad.
Expanding beyond the traditional framework, cybersecurity professionals must incorporate concepts such as Authentication and Non-Repudiation. Authentication ensures that system access is limited to verified users, reducing the risk of unauthorised access, while Non-Repudiation ensures accountability by confirming that actions taken within a system can be attributed to specific individuals. These considerations help address the evolving nature of threats in today’s interconnected environments.
Figure 1 – Expanding beyond the CIA Triad
As IT and OT systems merge, a more socio-technical approach to security is required. Cybersecurity must encompass not just the technical aspects of systems but also the people and processes that interact with them. This means adopting strategies that view cybersecurity and cyber resilience through multiple lenses, understanding how technology, human behaviour, and organisational processes contribute to overall security.
Figure 2 – Sociotechnical Nature of Cybersecurity
Furthermore, as these integrated systems evolve, the risk landscape rapidly changes. Cybersecurity strategies must reflect this by considering Safety alongside traditional cybersecurity objectives. By broadening the scope of security to encompass safety and resilience, we can protect not only data but also the physical processes that underpin critical infrastructure. A strategic, holistic approach taking into account both the convergence of IT and OT systems and their socio-technical nature ensures a fuller understanding of the risks and allows organisations to implement comprehensive solutions that protect both digital and physical assets.
In conclusion, the convergence of IT and OT calls for a cybersecurity approach that goes beyond the traditional CIA triad. By incorporating broader concepts such as Authentication, Non-Repudiation, and Safety, and by recognising the socio-technical nature of security, organisations can better manage evolving risks. This integrated perspective ensures the protection of data, the resilience of critical infrastructure, and the alignment of cybersecurity efforts with both operational and strategic objectives.
More about techUK: https://www.techuk.org/
Follow techUK: https://www.linkedin.com/company/techuk/
About Logiq:
Logiq is a NCSC-assured cyber security consultancy and secure managed services provider focused on safeguarding critical organisational data. Our clients are amongst the most demanding in the world and have some of the most stringent and complex security needs. We help to design and develop innovative solutions that enable them to focus on delivering their business securely.
