IT vs OT Security: A Time to Consider a Change in CIA to Include Resilience

There has long been debate over the differences between IT and OT networks, especially concerning security. Examining the business drivers behind OT and how security is typically measured provides insight into the cause of the mismatch. Adding a new measure, resilience, into the traditional CIA mix provides better security and business objective alignment in OT systems. This paper postulates a new method for the measurement of security in OT systems, specifically the addition of resilience as a driving factor. Using resilience as a framing method before attempting to employ security controls in an OT system will result in better alignment of security control outcomes with respect to system control objectives.