Week 19: What Systems On IT Does OT Rely On?

Operational Technology (OT) often depends on IT systems for critical functions. When IT systems fail—whether due to cyber incidents, ransomware, or other disruptions—OT operations can grind to a halt. This article explores the IT systems OT relies on, the impact of their failure, and how to build resilience.

You Should Know:

1. Critical IT Systems OT Depends On

Scheduling & Logistics Systems – Production schedules, shipping, and inventory management.
Recipe & Process Data – Manufacturing relies on IT-stored recipes and process parameters.
Billing & ERP Systems – Colonial Pipeline’s shutdown was triggered by billing system failure.
Active Directory & Authentication – Many OT systems depend on IT-managed credentials.
Network Services (DNS, NTP, DHCP) – OT devices often rely on IT infrastructure for basic networking.

2. How Long Can OT Operate Without IT?

Minutes to Hours – If real-time data sync fails (e.g., SCADA updates).
Days – If manual overrides exist but logistics break down (e.g., no shipping updates).
Indefinitely – Only if fully air-gapped (rare in modern environments).

3. Resilience Strategies

Segmented Networks – Ensure OT can operate if IT is compromised.
Manual Overrides – Maintain fallback procedures for critical processes.
Local Caching – Store essential data (recipes, schedules) on OT-side servers.
Independent Time Sync – Use local NTP servers to avoid IT dependency.

Key Linux & Windows Commands for Incident Response

Check network dependencies (Linux) 
netstat -tuln | grep "53|123"  DNS & NTP ports 
systemctl list-dependencies | grep -i "ntp|dns"

Verify AD authentication (Windows) 
nltest /dsgetdc:yourdomain 
gpresult /r  Check Group Policy dependencies

Isolate critical OT systems (Linux) 
iptables -A INPUT -s IT_SUBNET -j DROP

5. Real-World Example: Colonial Pipeline

IT Incident: Ransomware hit billing systems.
OT Impact: Operations halted due to inability to invoice customers.
Lesson: Test failover mechanisms for IT-dependent OT functions.

What Undercode Say

The blurred line between IT and OT is a major cyber risk. While OT is often seen as “isolated,” modern industrial systems rely on IT for core functions. Organizations must:
– Map IT-OT dependencies (nmap -sV OT_IP_RANGE).
– Test IT-disconnected scenarios (simulate DNS/NTP failure).
– Implement resilient architectures (local backups, manual workflows).

Expected Output:

A hardened OT environment that can sustain operations even if IT is down for 72+ hours. Use the following checklist:
– [ ] Audit IT-dependent OT systems.
– [ ] Deploy local failover servers.
– [ ] Train staff on manual operations.
– [ ] Conduct ransomware drills with IT offline.

Prediction

As IT-OT convergence grows, ransomware attacks will increasingly target IT to disrupt OT. Companies investing in segmentation and resilience will survive; those ignoring dependencies will face costly shutdowns.

(Reference: Ric Derbyshire’s OT Incident Taxonomy)