Ornua

I’m Adnan Ahmed, CISO at Ornua. Ornua is a global food manufacturing company, headquartered in Dublin.

Food and beverage production environments increasingly depend on connected operational technology. What makes securing IT/OT converged environments in food manufacturing different compared to securing traditional enterprise IT?

In the food manufacturing sector, the main reason behind OT and IT environments being different is because their priorities are different. 

For example, in the IT environment priorities align to the CIA triad: confidentiality, integrity, and availability. Whereas in the OT environment, availability is very important, then safety, then integrity, and confidentiality comes last. 

The environments are also designed and developed in a different way. For example, in the OT environment, the devices that we have last for 20 to 50 years. This is very common practice, especially in the food sector where the profit margin is very small, so companies tend to stay with those devices. 

Recently, we are seeing the proliferation of different technologies, for example, with smart factories. The difficulty for CISOs with smart factories is that the business and operations would like to do more automation, integration with the ERP systems, IoT using cloud access connectivity. We’re also talking about AI use case proliferation in the factories. These objectives bring challenges, and those challenges need to be addressed with regard to the new way of working. These are just some examples of how the traditional environment is different from the OT environment. 

We are trying to bring the same IT aspect into the OT environment. When we bring all those things, we need to make sure we need to have the same level of security available. That’s difficult because the environment is different, the demands are different, regulatory compliance requirements are different.

The answer to all of these is to make sure that the devices are protected using Zero Trust network architecture. Before you trust anything, you need to make sure you need to validate every individual employee. 

You need to make sure you have Zero Trust in place in your environment, but also make sure that the devices the that you are not going to patch have mitigating controls. There is a series of events that you have to do to make sure the environment is protected.

For a global company like Ornua, with employees, partners, and third parties needing access to sensitive environments, how do you balance secure connectivity with usability and business continuity?

This is a really important question for CISOs. We produce Kerrygold butter, so we need to make sure that there’s high availability and security when producing it. Health and safety are also key concerns. 

From CISO perspective, we need to make sure that when the external OEM vendors try to access those devices, that access is controlled and protected through Zero Trust network architecture. 

The most important thing is to make sure that whoever is connecting to your environment feels comfortable gaining access to whichever solution they are using, and making sure to give them just-in-time access. For instance, if they need access for a couple of hours, make sure to give access only during that particular timeframe. 

The same principle applies to your internal IT staff as well. The Zero Trust principle shouldn’t be only for external people. Trust everyone, but verify. If you use that principle, make sure that even the internal employees and external contractors are both using that principle to gain access to the environment. In my opinion, that is very important.

At the same time, you need to make sure that the productivity of the production plant is not impacted. So make sure it’s still highly available, it is secure, health and safety issues are not compromised, and also your environment is patched whenever it is feasible or possible to do that patching.

For a global manufacturer like Ornua operating across multiple regions, how do regulatory and compliance requirements influence cybersecurity architecture decisions, especially around access controls, MFA, auditability, and privileged sessions?

Regulatory compliance actually helps CISOs make sure that they’re aligning all their strategies to a specific framework. The OT industry is not as mature as the IT industry in the food and manufacturing sector. For instance, in IT they may try to gain an ISO certification or follow a NIST framework. In OT, mostly companies, including Ornua, try to comply with IEC 62443, but that whole framework is not as mature when compared to ISO or a NIST framework.

Once you start aligning all the principles of security under one framework, it makes your life easier. You should adhere to always-verify principles with MFA, assume breach principles, and principles of minimum access. 

There are also new regulations coming. In the EU, there is a network information security directive called NIS2 being implemented. A number of countries within the EU already have transposed NIS2 into their local laws. This has already been done, for instance in Germany, where we have a big footprint. In Ireland and Spain, where we have large footprints as well, we are still waiting for the local governments to transpose it into law.

NIS2 is also re-emphasizing the basic principles like MFA. MFA is required for OT equipment. In OT environments the devices are, by default, quite old, and sometimes MFA is not possible. If you can’t do MFA, make sure you have mitigating controls. 

Zero Trust principles still apply, MFA requirements still apply. Make sure the basic security hygiene, the backups of the environment, and environment connectivity is controlled. 

Network segmentation is critical in OT environments. Organizations cannot afford to operate flat networks that allow attackers who compromise IT systems to move freely into OT. Strong segmentation makes it significantly harder for adversaries to reach critical operational assets and disrupt production.

Most breaches, especially in the manufacturing and food sectors, start from IT, not from OT environment. So if you protect your IT environment, make sure you have microsegmentation and physical segmentation to make it as difficult as possible for the hackers to try to gain access from the IT into the OT environment. 

These are some examples of how the regulations’ principles can help you. So from CISO community perspective, we actually love those regulations because they make our life easier. You’re aligning your strategy against specific principles that are already available. So IEC 62443 and NIS2 are not two different things. They are talking about the same thing, but you are trying to align to principles that you can then follow.