Network Security for Operational Technology

Abstract

Many networked applications exist in commercial and industrial homes, from heating, ventilation, and elevators to door locks and industrial control systems. Unfortunately, these devices often lack built-in security features or are unpatched legacy systems. These systems and devices occasionally have Internet connectivity and thus attack surface increases of commercial and industrial homes. The author assumed that stakeholders are not entirely aware of the risk of their connected devices in the network, and challenges for securing an operational technology network are present. The thesis statement proposed business opportunities for providers of network security solutions to protect unpatched, legacy operational technologies and devices without embedded security used in commercial and industrial homes. The author defined related research questions and objectives to prove or refute the thesis statement. To validate the thesis statement, the author researched literature to get an overview of current sources relevant to this study's thesis. Based on the literature, the author created a cybersecurity framework for operational technologies to identify problem areas. These defined problem areas supported to structure of the qualitative interviews with seven experts in the field. The author gained insights about challenges using qualitative data coding from qualitative expert interviews. These insights helped to define use cases to identify business opportunities for network security provider solutions. Besides the identified business opportunities, the author could provide network security recommendations for commercial and industrial home stakeholders. After all, the author could validate the thesis statement based on the literature source and expert's insights.