Episode 36: How MSPs deliver OT and IoT security without specialists

Christina

Okay, let's unpack this. When we talk about cybersecurity, most organizations focus uh very intently on their IT systems.

Adam

Right, their laptops, their cloud storage, their email servers, the usual suspects.

Christina

Exactly. And they feel relatively secure about that digital perimeter. But what if the systems that control the physical world around us?

Adam

You mean the systems regulating the air we breathe, the water we drink, or even who gets into the building?

Christina

What if those were just completely unmonitored?

Adam

And what's so fascinating here is that we have spent, what, two decades building these huge walls around our data? But the systems that control physical operations, what we call operational technology or OT, they've just sort of quietly merged onto the same networks.

Christina

And the bad guys have noticed.

Adam

Oh, they've definitely noticed. Cybercriminals, state actors, everyone. We're talking about some distinct threats. Attacks on these OT environments have surged by over 2,000% in just the last few years.

Christina

2,000%.

Adam

It's an unbelievable rise in risk, and it's directed squarely at our physical infrastructure.

Christina

That number alone should be terrifying because it suggests a huge opportunity that threat actors are aggressively exploiting. So what's our mission today?

Adam

I think we need to explain exactly what OT is, first of all.

Christina

And then why are common IT security solutions just fundamentally fail when they're faced with these fragile systems?

Adam

Exactly. And finally, what specialized, non-disruptive approach is necessary to secure the connected infrastructure that controls our hospitals, our data centers, and our smart office buildings?

Christina

We are diving into that vast, unmonitored environment that we're calling the 70% blind spot.

Adam

Precisely. We really need to help you understand the systems that control physical processes. Systems that were, frankly, never designed to be connected to the Internet.

Christina

Let alone designed with any modern cybersecurity in mind.

Adam

At all.

Christina

So let's start right there with that definition for anyone new to this. When we say OT operational technology, what specific hardware and processes are we covering? Give us the landscape.

Adam

Okay. So when we talk OT, we are specifically looking at the connected systems that are responsible for controlling the physical world.

Christina

So not just data, but things.

Adam

Exactly. Think industrial controls, but also building controls. This includes building management systems or BMS.

Christina

Which would handle things like HVAC, lighting.

Adam

HVAC controllers, lighting, elevator operations, all of that. It also covers industrial control systems, scatter networks, and even something as basic as your electronic access control platforms.

Christina

So these are the systems that are literally modulating temperature, ensuring proper air exchange in critical spaces, and managing who gets in and out.

Adam

Yes, exactly.

Christina

And the reason this has become the new frontier for cyber risk is that convergence you mentioned, it's no longer a hypothetical risk, is it? This is today's reality.

Adam

It is. Historically, IT and OT lived in completely separate silos. IT managed the data and OT managed, you know, the plant floor or the mechanical room.

Christina

They were often on different networks, sometimes totally air gapped.

Adam

Right. But efficiency demanded connection. And now the same standard corporate network that carries your email or your business applications.

Christina

It's now connected to the HVAC controllers, the elevator systems, the security cameras.

Adam

And that single connection, it acts as a cyber bridge.

Christina

The moment that bridge is built, the attack surface just expands exponentially. It means a phishing email can ultimately lead to shutting down a facility's climate control.

Adam

Which brings up a fascinating point from the sources about service providers.

Christina

Right. Managed service providers or MSPs.

Adam

Yes. They are, it seems, uniquely positioned to address this staggering gap.

Christina

How so? What makes them the right player here?

Adam

Well, it really comes down to trust and proximity. MSPs already have these established relationships with building owners and crucially with facility managers.

Christina

And the facility managers are the ones who worry about the operational continuity. They know what happens when the HVAC goes down.

Adam

Precisely. They understand the financial consequences are immediate. MSPs are already there, contracted for physical maintenance or IT services. They're trusted to work with these sensitive systems.

Christina

So they bridge that traditional gap between IT risk management and operational needs.

Adam

They do. And that's a powerful competitive advantage. Because the mainstream IT security vendors.

Christina

The big names.

Adam

The giants, yeah. They sell traditional endpoint and firewall solutions. They are focused exclusively on data and standard computers. They just don't have the specialized tools or the relationships to even enter that facility management conversation.

Christina

That makes sense. It leaves a massive underprotected market opportunity. We're talking about solutions that require specialized knowledge of these industrial protocols.

Adam

And tools that MSPs are best positioned to deliver, especially since they can offer that protection without disruption that facility owners absolutely demand.

Christina

That sets the stage perfectly for the core problem here, the OT security gap. Why can't we just run our standard endpoint security software on these building controllers?

Adam

Because the failure is fundamental. It comes down to architectural limitations. Traditional IT security tools rely on an agent, a piece of software you have to install.

Christina

And that agent needs a modern operating system: Windows, Mac, Linux, and enough processing power and memory to run.

Adam

Exactly. But now try to apply that standard to a piece of operational hardware.

Christina

It's often physically impossible.

Adam

Completely. Devices like programmable logic controllers, PLCs, or those BMS controllers regulating a hospital's airflow. They lack the resources. They have minimal memory, archaic operating systems, if they even have one at all.

Christina

They were designed for one single simple task.

Adam

And that task was not running security software.

Christina

So that's the agent problem. But even if you could somehow trick a device into running an agent, the risk of active scanning or updates is, well, it sounds catastrophic.

Adam

This is where we shift from a security problem to an immediate liability. We have documented incidents where routine vulnerability scans.

Christina

Just probing the network to find open ports.

Adam

Just probing. And it caused massive operational outages. Think about a security check accidentally initiating a full HVAC shutdown across an entire hospital complex because the scan overloaded a fragile controller.

Christina

That hospital story shifts security from being just an IT problem to a real patient safety issue.

Adam

It does.

Christina

A software update restart that's invisible on your laptop could literally shut down the environmental controls in an operating room. That level of risk is unacceptable.

Adam

It is. The absolute cardinal rule of OT security has to be protection without disruption.

Christina

And that leads directly to the visibility problem, right? Because traditional security monitoring assumes it can query devices, get logs back.

Adam

Right. Receive telemetry. But because that isn't true for the majority of OT, they can't see them.

Christina

So organizations have this false sense of security. Their IT infrastructure is monitored perfectly.

Adam

But that massive 70% of operational systems, the ones regulating critical physical functions, remain completely invisible to their security operations center.

Christina

Okay, that makes perfect sense. So if we accept that IT tools are out, where exactly are these hidden systems we need to worry about? Help us understand this vast operational attack surface.

Adam

It's far more extensive than most people realize. When you walk into a commercial building, the biggest component is the building management system. And this isn't just a handful of thermostats.

Christina

No, the system is controlling everything.

Adam

Everything. Regulating temperature, managing airflow exchange, which is critical for hygiene and air quality controlling lighting, coordinating elevators, tracking energy usage. A single large commercial building can easily have hundreds of these dedicated controllers.

Christina

And then you have the really heavy-duty industrial side, industrial control systems and SCADA networks.

Adam

Correct. This is what powers our utilities in manufacturing. We're talking PLCs, which run automated sequence-based tasks, human-machine interfaces, or HMIs.

Christina

The touch screens operators use?

Adam

Exactly. The terminals operators use to view and manipulate the system. And remote terminal units, RTUs, used for monitoring infrastructure across wide geographic areas like a pipeline or a water treatment facility.

Christina

And the complexity just gets worse when you look at specialized environments like a hospital.

Adam

Oh, hospitals are a whole other layer of complexity. Beyond standard building systems, they have specialized OT that impacts patient outcomes directly. Networked medical devices, specialized HVAC systems for maintaining precise conditions and operating rooms, pharmaceutical storage monitoring, automated medication discursors, all connected to the network.

Christina

The scale is just staggering. You said a medium-sized office could have 200 to 500 of these devices.

Adam

And a hospital campus could have tens of thousands.

Christina

And here's the crucial vulnerability: these systems communicate using industrial protocols that were engineered in an era where air gaps were standard. They were never designed for the internet.

Adam

Never. We're talking about protocols like Bay A Net for building automation, Modbus TCP/IP for industrial sensors, and OPC UA for manufacturing. Right. When these were created decades ago, security meant a lock on the door.

Christina

Right. Physical access.

Adam

They fundamentally lack the basic security features we expect today, like built-in encryption or robust authentication. They just assume trust within the local network. They are wide open.

Christina

So given that fundamental lack of security, what are the actual dangers? How are criminals and nation states exploiting this convergence today?

Adam

Ransomware has completely matured and shifted its focus. Attackers aren't just encrypting files on a server anymore.

Christina

No, they're going after the physical world.

Adam

They're specifically targeting BMS and industrial controls because they know that encrypting the system that controls the manufacturing line or the temperature in the server room results in immediate, non-negotiable operational downtime.

Christina

And that forces organizations to pay and pay quickly just to get back online.

Adam

Exactly.

Christina

We've got some pretty striking real-world anecdotes that illustrate this jump from data theft to physical disruption.

Adam

Yeah, think about the 2023 ransomware attacks that encrypted access control systems in hotels.

Christina

Locking guests out of their rooms.

Adam

Locking them out, disabling keycards. The payment wasn't about data recovery, it was about immediately restoring customer service and room access.

Christina

Or the casinos where attackers disabled both the slot machines and the building systems at the same time to exert maximum pressure.

Adam

And we've also seen manufacturing facilities experience complete multi-day production shutdowns when the controllers managing their assembly lines were encrypted. The entire workflow just stopped.

Christina

That is massive leverage. But it's not just criminals looking for a quick payout. We have to consider the long game too.

Adam

Absolutely. Nation-state actors target critical infrastructure energy grids, water treatment, transportation systems. They aren't looking for an immediate disruption.

Christina

They're pre-positioning.

Adam

They are pre-positioning capabilities. They compromise the OT networks, they install back doors, and they just sit there. Sometimes for years. So they can be activated as a kinetic attack during a geopolitical conflict. They are essentially mapping and taking control of the country's nervous system.

Christina

And the consequences beyond data loss are what truly define the severity of an OT attack.

Adam

We're talking about real-world harm, impacts on patient care disabling the environmental controls in an operating room.

Christina

Physical damage to incredibly expensive industrial equipment.

Adam

And critically, the potential for widespread public health threats if water or sewage treatment systems are compromised. And maybe the most damning part.

Christina

What's that?

Adam

Most of these compromises don't involve complex zero-day exploits. They involve simple things like default credentials and systems that were accidentally exposed directly to the Internet.

Christina

So if we come back to that cardinal rule, protection without disruption, and we accept that active scanning and installing agents are impossible, what is the specialized solution? How do we gain visibility without crashing the facility?

Adam

The solution hinges entirely on passive network monitoring. Since we cannot risk sending any traffic to these fragile OT devices, we must only observe their communication.

Christina

Okay, unpack mechanics of that for us. If you can't talk to the device, how do you even know what it is?

Adam

It's like listening in on a conversation without joining it. You use network taps or spam ports to capture a copy of the traffic flowing between the OT devices. It's totally non-intrusive.

Christina

So you're analyzing the protocols, the BACnet, the Mod Bus, without ever sending a single packet back to the device itself.

Adam

Exactly. This is the only way to build a comprehensive asset inventory, which is the critical first step without risking operational availability. It's how you finally shine a light on that previously dark, unmonitored environment.

Christina

And since that operational traffic looks nothing like IT traffic, generic tools must just fail here.

Adam

They fail completely. A generic IT monitoring tool is trained to recognize HTTP DNS email. It will ignore or misinterpret this specialized industrial traffic.

Christina

So you need tools that have industrial protocol parsers built in. They need to understand the nuances of BACnet and Modbus.

Adam

They need to know what a normal command looks like for an air handling unit versus a suspicious command.

Christina

And this is where the detection gets really fascinating because these OT systems often lack the logging capabilities we rely on in IT. So if they can't log suspicious activity, how do you find the threats?

Adam

You have to rely entirely on behavioral analytics. Since we can't query logs, we establish a precise baseline for normal communication patterns.

Christina

So you figure out exactly which devices talk to each other using what protocols and how often.

Adam

Precisely. For example, a PLC controller should only talk to its HMI and maybe a central server using only Modbus at a specific rate.

Christina

And anything outside that established predictable pattern gets immediately flagged.

Adam

Exactly. Any anomaly. A building controller suddenly trying to communicate with a server in Russia, or an HVAC system attempting to upload 500 megabytes of data.

Christina

Or a device just changing its approved protocol.

Adam

All of it. It gets flagged as reconnaissance, lateral movement, or operational interference. And this allows detection without requiring any active component on the vulnerable system itself.

Christina

The technical imperative is crystal clear. But let's pivot to the business drivers. Beyond the obvious operational risk, it seems like compliance and financial pressures are really forcing organizations to address this.

Adam

Absolutely. Global regulations are making this mandatory. The primary international standard here is IEC 62443. It was originally for industrial control systems, but regulators and insurers are now applying it to commercial building automation.

Christina

And to comply, you need that network segmentation and that asset inventory we just talked about.

Adam

You do. And then you have major legislation like the EU's NIS2 Directive. This significantly expands cybersecurity requirements for critical infrastructure, creating real urgency for companies operating in Europe.

Christina

And it comes with teeth.

Adam

It does. NIS2 creates mandatory risk management and strict incident reporting, we're talking 24 to 72 hours, with substantial financial penalties and crucially, board-level accountability for security failures. This mandates action.

Christina

And then there's the money side of things, cyber insurance.

Adam

Exactly. Cyber insurance carriers are now requiring concrete evidence of specific OT security controls just to maintain insurability.

Christina

Or to avoid massive exclusions in their policies.

Adam

Right. They want proof of asset inventory for operational systems, network segmentation, and passive monitoring. OT security isn't optional anymore. It's a requirement for mitigating enterprise-level financial risk.

Christina

This has been an incredibly insightful deep dive into a huge and often overlooked sector of cybersecurity, so to summarize, IT and OT convergence is complete.

Adam

It's here. And it's creating immense non-negotiable risk across our physical infrastructure.

Christina

And our traditional IT solutions fail fundamentally because they rely on agents and active scanning that can crash these fragile operational systems.

Adam

And because of that, 70% of the attack surface, the physical controllers for your HVAC, your access control, your manufacturing lines remains invisible if you're only monitoring your IT endpoints.

Christina

So the only viable solution is protection without disruption, achieved through non-intrusive passive network monitoring and specialized protocol aware detection.

Adam

Right.

Christina

And when you discuss this with executives or facility managers, the messaging needs to be accessible. It has to focus on operational continuity.

Adam

Yes. Use simple, memorable concepts. I like reminding them that buildings do not run antivirus. Focus on securing the processes, not just the data.

Christina

That's the key takeaway. Nearly every organization with a physical facility operates OT systems, whether they realize it or not.

Adam

And that initial security assessment almost always reveals far more unmanaged OT assets than clients ever expected.

Christina

So, what does this all mean for you listening? We'd encourage you to look around your own environment. Consider the unmanaged critical devices in your organization that are connected to the network but just ignored by your current security stack.

Adam

Which essential physical systems, the HVAC, the elevators, the access control systems in your building, are currently unmonitored and relying on industrial protocols that were never ever designed to handle today's sophisticated internet threats?

Christina

That is the real blind spot, and it is actively being targeted right now.