Operations and Control Networks (OCN) Model: A Systematic Approach to Operational and Information Technology Convergence

Ensuring the integrity of Ethernet-based networks is a challenging and constantly evolving domain. This problem is exacerbated for those operational technology (OT) networks supporting industrial control systems (ICS) since much of that equipment was originally designed to be on a network that was isolated and generally considered free of malefactors. Increasing pressure to bridge these systems with traditional information technology (IT) networks has introduced a bevy of new threats. In response, both academia and industry have responded with security solutions tailored to ICS environments. Deploying these protection systems often involves several configuration choices. While some of these choices are clear (e.g., block/enable protocol X) others are far more subjective (e.g. alert threshold == 3.43). Further complicating the situation, while often similar to IT networks, OT networks have unique challenges and characteristics that make the task of protecting them simultaneously more difficult and straight forward.Extant solutions for quantifying the relative security of intrusion detection systems fail to effectively support the operators of said systems with understanding the impact of various configuration changes. Further, they assume that the attacks are static and not subject to manipulation or alteration in the face of defenses. In this paper, we present a threat-based method for quantifying the relative impact of various security settings for intrusion detection systems (IDSs) within ICS environments. This method provides operational staff with a clear understanding of the relative impact of their settings and assumes that the attacks levied against them are dynamic. The model is described in detail, we apply the model to a synthetic data set, and discuss the inferences that can be made and what types of decisions they could be used to support.

The oil and gas industry, a vital lifeline fueling the global economy, find itself at a pivotal juncture where the convergence of operational technology (OT) and information technology (IT) has ushered in unprecedented opportunities and challenges. As digital transformation sweeps across this sector, the imperative to fortify cybersecurity defenses against ever-evolving threats has become paramount. Innovative and forward-looking oil and gas organizations across the globe are adopting the Cloud in many forms because of their digital transformation initiatives. Data lakes, edge technology, machine-to-machine communication, and machine learning (ML) algorithms have been enabling this industrial digital transformation. This transformation is also driving changes to the OT landscape, and as these environments continue to evolve, OT environments are leveraging well proven IT solution patterns to improve the productivity and efficiency of production operations. Industrial customers often start their digital transformation journey by sending OT data to the cloud for analysis and analytics without sending commands back to the industrial automation and control systems (ICAS). This process is often called "open loop" operations, since there is one-way communication from edge to cloud. Customers generally find this relatively easy to secure and manage. However, more often we are witnessing requirements to optimize operations by generating an automatic or operator-initiated response in the oil and gas production operation, rig management based on insights gained from cloud analytics. This process is often referred to as "closed loop" operations with two-way communication between edge and cloud. The security and compliance practices for closed loop operations are more rigorous because closed operations manipulate OT devices remotely. Developing these practices should be rooted in a cyber risk assessment to help businesses understand and prioritize security concerns. In this paper we propose how strengths of Cloud computing can become key enabler for oil and gas organizations in helping them enhance their overall security posture and manage risks within OT environments. We have deployed solution patterns described in this paper as the foundational pillar of several Oil and Gas organization's overall OT system architecture to unlock both "open loop" and "closed loop" operations in a secure, reliable and cost-effective manner. The specific scope items we will cover in this paper focus on a custom security uplift framework having four foundational components – 1) Cloud led architecture patterns to provide next generation network segmentation strategies in OT De-militarized Zone 2) OT asset inventory and vulnerability management 3) Centralized security monitoring and incident response with help of Artificial Intelligence and most recently providing Generative AI based virtual assistant to query security event data from OT systems. For organizations to plan their industrial digital transformation safely and securely, it is recommended that a multi-layered approach to secure the Industrial Control Systems (ICS)/OT and Cloud environments be implemented as captured in ten security golden rules in the following paper [1]. In addition to this, in the paper we propose a comprehensive architecture framework that aligns with established cybersecurity framework (CSF) such as NIST. The use case studies discussed in the paper will highlight how customer have been able to remediate critical security vulnerabilities within weeks post implementation by deploying a comprehensive asset inventory discovery and vulnerability assessment. This has help reduce mean time to identify and mitigate vulnerabilities from months to days with automated testing in pre-production environments, ensure quick detection and response towards security incidents with help of advanced security monitoring and incident response playbooks, covering 100% of the OT assets through this capability and leverage advanced data analytics, machine learning to perform log mining, data cleansing, data validation, log mining and analysis through natural language processing such as conversational AI assistants powered by large language model (LLM) in the Cloud.

Internet of Things (IoT) is transforming the industry by bridging the gap between Information Technology (IT) and Operational Technology (OT). Machines are being integrated with connected sensors and managed by intelligent analytics applications, accelerating digital transformation and business operations. Bringing Machine Learning (ML) to industrial devices is an advancement aiming to promote the convergence of IT and OT. However, developing an ML application in Industrial IoT (IIoT) presents various challenges, including hardware heterogeneity, non-standardized representations of ML models, device and ML model compatibility issues, and slow application development. Successful deployment in this area requires a deep understanding of hardware, algorithms, software tools, and applications. Therefore, this paper presents a framework called Semantic Low-Code Engineering for ML Applications (SeLoC-ML), built on a low-code platform to support the rapid development of ML applications in IIoT by leveraging Semantic Web technologies. SeLoC-ML enables non-experts to easily model, discover, reuse, and matchmake ML models and devices at scale. The project code can be automatically generated for deployment on hardware based on the matching results. Developers can benefit from semantic application templates, called recipes, to fast prototype end-user applications. The evaluations confirm an engineering effort reduction by a factor of at least three compared to traditional approaches on an industrial ML classification case study, showing the efficiency and usefulness of SeLoC-ML. We share the code and welcome any contributions (https://github.com/Haoyu-R/SeLoC-ML).KeywordsMachine learningNeural networkIndustrial internet of thingsSemantic webKnowledge graphLow-code engineering

Industrial control systems (ICS)- the backbone of any modern nation's critical infrastructure (CI) such as the water, energy, transportation and information and communication technology (ICT) sectors-have been subjected to considerable cyberattacks in recent times. This is exacerbated by the gradual convergence of the information technology (IT) and operational technology (OT) domains. This paper sought to establish the basic cyber hygiene practices to stop malicious cyber activities against connected OTs. Cyber hygiene practices refer to knowledge, attitudes and behaviours consistently put into practice to eliminate a few root causes responsible for many cyber incidents. A scoping technique was adopted to review ICS security studies conducted in the past ten years (2012-2022). The key findings indicate that many CI operators have poor password and access control policies for onsite and remote access to networks, do not perform system updates and patching as and when it is necessary to do so, do not actively restrict, segregate and/or separate access to ICS networks and devices, and do not conduct cybersecurity awareness training as frequently as they should. Lastly, due to legacy ICS networks, threat intelligence tools such as extended detection and response and similar others to monitor and detect, in real-time, anomalous behaviour on the networks are rarely utilised for cyber risk assessment on OT networks.

Recently, OT (operational technology) networks of industrial control systems have been combined with IT networks. Therefore, OT networks have inherited the vulnerabilities and attack paths existing in IT networks. Consequently, attacks on industrial control systems are increasing, and research on technologies combined with artificial intelligence for detecting attacks is active. Current research focuses on detecting attacks and improving the detection accuracy. Few studies exist on metrics that interpret anomaly detection results. Different analysis metrics are required depending on the characteristics of the industrial control system data used for anomaly detection and the type of attack they contain. We focused on the fact that industrial control system data are time series data. The accuracy and F1-score are used as metrics for interpreting anomaly detection results. However, these metrics are not suitable for evaluating anomaly detection in time series data. Because it is not possible to accurately determine the start and end of an attack, range-based performance metrics must be used. Therefore, in this study, when evaluating anomaly detection performed on time series data, we propose a range-based performance metric with an improved algorithm. The previously studied range-based performance metric time-series aware precision and recall (TaPR) evaluated all attacks equally. In this study, improved performance metrics were studied by deriving ambiguous instances according to the characteristics of each attack and redefining the algorithm of the TaPR metric. This study provides accurate assessments when performing anomaly detection on time series data and allows predictions to be evaluated based on the characteristics of the attack.

The accelerating convergence of Operational Technology (OT) and Information Technology (IT) has transformed modern enterprises, enabling unprecedented integration of industrial control systems, data-driven automation, and digital business intelligence.However, this convergence has also widened the cybersecurity exposure of organizations, as traditionally isolated OT environments once protected by physical segmentation and proprietary protocols are now increasingly connected to IT networks, cloud platforms, and remote access infrastructure.This shift has amplified vulnerabilities across critical sectors such as manufacturing, energy, logistics, and healthcare.At a broader level, the challenge stems from the fundamental differences between OT and IT: OT prioritizes safety, system availability, and real-time control, while IT emphasizes confidentiality, data integrity, and scalability.Cybersecurity must therefore serve as the unifying layer capable of harmonizing these divergent priorities.This article develops a comprehensive framework for bridging the OT-IT divide through cybersecurity integration.It begins by outlining the evolution of OT-IT convergence and the systemic risks associated with legacy industrial assets, protocol incompatibilities, and the rising frequency of sophisticated cyberattacks targeting industrial systems.The discussion then narrows to technical and governance strategies such as zero-trust architectures, network segmentation, identity and access management (IAM), secure-by-design engineering, and continuous monitoring supported by threat intelligence.Special attention is given to the role of AI-enabled detection, secure remote operations, and governance structures capable of aligning IT security teams with OT engineering teams.By synthesizing operational, strategic, and technological measures, the article demonstrates how cybersecurity can act not only as a protective function but as an enabling discipline for digital transformation, operational resilience, and enterprise-wide risk reduction.Ultimately, effective integration of OT and IT security creates a pathway for sustainable modernization across increasingly interconnected industrial ecosystems.

Security is an increased concern in smart manufacturing, however, is often met with concerns from operational technology (OT) operators. Performance is paramount in OT communication and, thus, a higher risk is currently deemed acceptable. However, the probability for cyber attacks is rising as recent, successful attacks on factory communication demonstrate. In this work, we present a performant security protocol extension for usage in OT networks. It enables message authentication and data integrity while keeping the protocol overhead within real-time constraints. The protocol extension protects against attacks targeting communication of cyber-physical systems in a smart manufacturing environment. The availability of OT operations facing these attack vectors is, thus, guaranteed.

Detecting malicious activities in Information Technology (IT) is a critical component of cybersecurity and is essential for identifying threats and attacks on systems, networks, and resources. However, security of industrial control systems, an area of increasing concern due to the convergence of IT with Operational Technology (OT), requires new approaches. This work proposes a novel containerized testbed architecture for industrial water systems, implemented using open-source technologies and structured according to the Purdue reference model, which is widely used in industrial control and automation systems. The architecture aims to provide a secure and efficient environment. The experiments demonstrate that the proposed architecture enables the simulation of computational devices behavior in water systems under different scenarios, allowing data to be collected for the detection of malicious activities, such as denial-of-service attacks and command injection. The results highlight the architecture's relevance to advancing research and development efforts aimed at enhancing the security of critical water infrastructure.

The convergence of Information Technology (IT) and Operational Technology (OT) leads to an increasing interdependence between the protection goals of security and safety. A cyber-attack targeting safety functions may in turn lead to hazards endangering people and the environment. Furthermore, misusing safety functions may impact availability by causing a machine or production line to stop working. This work analyzes how Austrian stakeholders of industrial automation enterprises address security and safety risks to mitigate undesired situations. The stakeholder analysis performed considers vendors of products or components, integrators, and asset owners of industrial systems. Secure infrastructures, system architectures, and risk management are subject areas of this analysis. The analysis was conducted in two phases. First, an online survey was created where the involved stakeholder offered their answer simultaneously. Considering the results of the survey, individual stakeholder workshops were carried out to obtain additional, more specific perceptions about the stakeholder’s OT system and components with respect to security and safety considerations. The obtained results provide insights into the current practices in the industry regarding safety and security.

With the increasing deployment of 5G private networks in smart manufacturing, transportation, and IoT environments, the high performance of these networks has also introduced new cybersecurity challenges. The convergence of Information Technology (IT), Operational Technology (OT), and Communication Technology (CT) significantly expands the attack surface and exposes systems to cross-domain threats such as rogue base station infiltration, distributed denial-of-service (DDoS) attacks, and lateral movement. These attacks threaten data integrity, service continuity, and user privacy. To address these issues, this study applies the MITRE FiGHT threat model to depict representative attack stages—including reconnaissance, intrusion, lateral propagation, and service disruption—and integrates CVSS 3.1 scoring with corresponding mitigation strategies. Based on these components, we construct an analytical workflow capable of quantifying risks, identifying governance deficiencies, and guiding targeted improvements. A prototype Cybersecurity Governance Maturity Model (CSGMM) tailored for 5G private networks is subsequently proposed. The proposed framework incorporates six governance domains—policy, asset management, risk defense, incident response, control practices, and supply chain management—and formalizes a three-tier structure covering strategic, tactical, and operational layers. It also defines twenty-five practice objectives aligned with international standards such as ISO/IEC 27002 and NIST CSF 2.0, improving both applicability and interoperability. Experimental validation was conducted using a Free5GC and UERANSIM testbed to simulate practical attack scenarios, including traffic-based DDoS and endpoint-level exploitation. The results show that the implementation of the governance framework, together with FiGHT-based mitigation strategies, leads to a measurable reduction in CVSS risk scores and attack success probability. These findings demonstrate that integrating governance mechanisms with technical defense measures enhances incident response, strengthens network resilience, and supports continuous security management throughout the lifecycle of 5G private network deployment. The proposed model provides a structured reference for both industry and government seeking to advance 5G cybersecurity strategies. It offers practical value for smart manufacturing and other mission-critical applications, supporting organizations in addressing increasingly complex cyber threats in the era of digital transformation.

The introduction of Industry 4.0 and IIoT has enabled the interconnection of information technology (IT) and operational technology (OT) and exposed industrial control systems to cyber threats. Industrial cybersecurity requires knowledge, skill, and collaboration between IT and OT. A comparison of graduate curricula of software engineering and systems engineering identifies competencies related to industrial control systems cybersecurity. Industry experts are interviewed to identify needs for cybersecurity skills and competencies. Results from the mapping are discussed in the context of software and systems engineering challenges in ICS cybersecurity and leveraged against industry experiences and needs expressed through interviews with three OT and IT industry professionals. The curricula mapping reveals variations in both how they are organised and expressed to the extent that subjective interpretation is required for evaluation and comparison. The interviews with the industry experts indicate a gap between graduate competence from the curricula and industry needs.

The transition towards decentralized energy systems, driven by the global shift to renewable energy sources, introduces new cybersecurity complexities that challenge traditional energy security paradigms. Distributed Renewable Energy (DRE) systems comprising solar photovoltaics, wind turbines, microgrids, and battery storage are inherently decentralized, networked, and reliant on advanced digital technologies for real-time monitoring, control, and optimization. While these systems offer resilience, flexibility, and sustainability, they also expand the attack surface for cyber threats due to their reliance on Internet of Things (IoT) devices, cloud computing, and bidirectional communication protocols. This paper critically examines the cybersecurity challenges associated with DRE infrastructure, including unauthorized access, data breaches, malware propagation, and system manipulation, all of which could lead to energy theft, grid instability, and large-scale outages. Emerging opportunities lie in developing adaptive cybersecurity frameworks tailored to the unique topology of decentralized energy networks. These include the integration of artificial intelligence for anomaly detection, blockchain technologies for secure data exchange and identity management, and zero-trust architectures to enforce stringent access control. Additionally, the convergence of operational technology (OT) and information technology (IT) within DRE environments demands cross-sectoral collaboration, robust regulatory frameworks, and enhanced stakeholder awareness to build cyber-resilient systems. The paper also highlights the necessity for proactive risk assessment, real-time threat intelligence sharing, and the establishment of decentralized security standards to harmonize practices across diverse stakeholders and jurisdictions. Case studies from recent cyber incidents in the energy sector provide empirical evidence of vulnerabilities and mitigation strategies. By exploring both the risks and solutions, the study underscores the dual imperative of securing DRE systems not only as critical infrastructure but also as pivotal enablers of the global clean energy transition. In conclusion, while decentralized energy systems present new cybersecurity challenges, they also create opportunities to reimagine and strengthen energy security in the digital age. Addressing these issues through innovation, regulation, and cooperation will be crucial for ensuring sustainable and secure energy futures.

Technology, organisation and people factors influence the success of technology integration. This paper explores recent research findings of integration of Operational Technology (OT) and Information Technology (IT) in organisations with a primary function of managing assets. The main differences between the two technologies are that one is attached to assets and governs real time asset control and performance data, the other has static information and is traditionally used to make decisions. Understanding the factors for integrating the technologies is important because if organisations can leverage understanding of the influencing people, process and technology factors on the phases of integration of OT and IT, organisations can improve asset performance and control and therefore influence the consumption, cost, maintenance and consistent, reliable, secure provision of critical services such as energy and water. Integration theory applicability may be extended to the asset management environment and provide practitioners with a holistic, end to end, integrated framework to guide the efficient integration of OT and IT. The paper explores the integration phases, influencing factors and challenges such as the role of information governance, security and reliability decision rights identified in survey and case study research with asset management practitioners. The research concludes by suggesting a validated holistic framework for integrating OT and IT in asset management oriented organisations.

Given the pervasiveness of technology in today’s schools, the proficiency of educators with information and communications technology (ICT) is critically important. This study aims to determine teachers’ competence in information and communications technology in technology operations, pedagogical skills, and professional competency. Data for this descriptive study was collected from 90 respondents using a 30-item self-made data-gathering instrument that has passed the rigorous validity and reliability test. The assembled information was dealt with using the mean and Mann-Whitney U-tests. Results revealed that teachers had a high level of competence in ICT in technology operations and pedagogical skills and a moderate level in the professional area. A difference was found in the teachers’ ICT competence in three areas when compared according to sex, and a difference was also found in the professional area when compared according to age. The result provides evidence that teachers are proficient in ICT; however, their ICT competence varies based on gender and age. This study calls for a continuous, high-quality training program in all regional secondary schools to maintain teachers’ ICT competence. Keywords: Information and Communications Technology, ICT Competence, Secondary School Teachers, Negros Oriental

Being prepared to use technology and knowing how that technology can support student learning have become integral skills in every teacher’s professional repertoire. This study aimed to assess the level of information and communications technology competencies of teachers in higher education, particularly in the technology operations and concepts skills. The study utilized the descriptive design which involved a questionnaire adopted from the National ICT Competency Standard for Teachers. Using the sample size estimation formula for a finite population, 104 teachers in a state university in the Philippines were considered respondents of the study. Responses from the questionnaires were directly encoded and analyzed using the Microsoft Excel application using descriptive statistics such as frequency counts, percentage, and mean. Based on the results, teachers reported a basic competency in understanding and the effective use of the internet and network applications and resources. Also, teachers show a basic competency level in demonstrating knowledge and skills in information and data management. Moreover, teachers reported being proficient in demonstrating knowledge and skills in basic computer operation and other information devices, including basic troubleshooting and maintenance and the use of office and teaching productivity tools. Training can be provided to teachers on technology operations and concepts to further advance their skills and competence which can be applied in their teaching and learning process.