The Future of OT Security, An Alternative Point Of View

### Overview In this presentation, a representative from the cybersecurity firm Sygnia explores the past 40 years of Operational Technology (OT) security and critiques the industry's longstanding reliance on the Purdue Model. The speaker argues that rigid adherence to legacy network segmentation has hampered digital transformation and modern supply-chain integration while failing to address contemporary threat realities. As an alternative path forward, the talk highlights emerging secure-by-design standards—specifically the Open Process Automation Forum (OPAF)—and discusses how architectures must evolve toward unified IT/OT visibility and hybrid detection.

### Key Topics - **History and Threat Landscape Evolution**: Over 40 years, OT threats transitioned through three phases: insider-dominated attacks with direct physical/local access (1982–2010), nation-state military-grade cyber weapons (kickstarted by Project Aurora and Stuxnet in 2010), and today's IT-to-OT cascading risks primarily driven by ransomware. - **The "Original Sin" of the Purdue Model**: The Purdue Model, originally created in the 1990s for a different purpose, was repurposed as OT's sole security architecture. Adding level 3.5 (IDMZ) and placing the Internet at level 5 created strict, dogmatic rules (e.g., forbidding direct L4-to-L3 communication, enforcing strictly on-premises operations, relying solely on passive IDS). These boundaries severely constrained bidirectional data flow required for digital transformation and modern demand-driven supply chains. - **Open Process Automation Forum (OPAF/OPAS)**: An initiative launched by ExxonMobil (now on version 2.1) supported by over 600 member organizations, introducing open, interoperable, secure-by-design architectures. Other aligned initiatives include NAMUR (integrating the NOA concept) and the U.S. Department of Energy's Cyber-Informed Engineering strategy. - **Architectural Shift & Hybrid SOC**: Moving toward distributed edge control devices while building a unified security operations center (SOC) that monitors both IT and OT estates.

### Technical Details - **Distributed Control Nodes (DCNs)**: Edge devices running control logic, control loops, configuration management, and embedded security layers (data collection and detection). DCNs are intended to eventually replace PLCs and DCSs. - **Distributed Control Framework (DCF)**: A transitional wrapper component enabling legacy control devices to interface with new architectures without introducing intolerable latency. - **Open Process Automation Standard (OPAS)**: Employs the OPA Communication Framework (OCF) using OPC UA as the standard communication bus across controllers, cloud, IoT, and advanced computing platforms. Audience discussion noted that OPAS incorporates ISA/IEC 62443 security standards. - **Sygnia's Implementation**: Sygnia joined OPAF and built an OPAS-based cyber-kinetic innovation center. They adapted their "Velocity" Extended Detection and Response (XDR) platform across levels 4, 3, and parts of 2, while using API integrations with industrial IDS for lower-level visibility as an intermediate step toward full IT/OT hybrid telemetry.

### Takeaways - Isolating OT from IT via air gaps or rigid Purdue boundaries is no longer viable in an era where ransomware cascades from IT into OT environments. - Process control security must shift from bolt-on network restrictions to open, secure-by-design frameworks like OPAS. - Security teams need to actively participate in pilots, testbeds, and standards convergence (OPAF, NAMUR NOA) to redefine detection, response, and data management across the entire digital enterprise.