Exploring the Security Culture of Operational Technology (OT) Organisations...
summary
Thirty-three interviews across 25 UK OT organisations identify three concrete barriers to security culture: unclear governance and split IT/OT responsibilities, insufficient OT cybersecurity expertise, and poor cross‑function communication. External consultants and security vendors repeatedly implement specific controls, draft policies, advise on roles, run training, and mediate IT–OT disputes, sometimes resolving budget and reporting clashes but not always embedding lasting change. The paper reports examples where consultancy accelerated fixes yet left organisations dependent on external knowledge, and concludes with actionable recommendations to transfer skills and clarify governance.
AI-written summary · about
chapters (7)
- 0:00OT security research intro
- 1:10Digitalization and security risks
- 2:33Security culture barriers
- 3:38Governance challenges in OT
- 5:25Lack of OT cybersecurity expertise
- 7:11External consultants' role
- 8:37Conclusion and future research
related talks
47mField Guide to Building an Operational Technology Cybersecurity Capability
05mIndustry Responses to the European Directive on Security of Network and Information
50mHarmonizing IT and OT Security in the Era of Convergence
53mCXO Panel: OT & IoT Risk Management Strategy For CISOs
31mICS Security: Why People and Culture Matter Most
11mKeynote
29mRed Team Operations in OT: A Peek Behind the Curtains of Hacking Industrial Systems
48mYou Too Can Secure OT