Yet better cybersecurity does not necessarily mean organisations understand every part of their operational environment.<\/p>\n
Only 14% of respondents to Fortinet\u2019s 2026 State of Operational Technology and Cybersecurity Report said they had full visibility of their operational technology (OT) environments. Almost a quarter could see only about half of their systems.<\/p>\n
That does not necessarily mean organisations are unaware of the equipment they operate. They may know they have particular pumps, control systems, substations or other critical assets and understand their role in delivering a service.<\/p>\n
The greater challenge is knowing what is happening across the operational network. Organisations need to understand how devices communicate, where operational systems connect with corporate IT networks and which systems depend on one another.<\/p>\n
Many components in operational environments are pre-digital. They were designed to work in isolation and were never built with modern cyber threats in mind.<\/p>\n
Over time, they have been connected to business networks, cloud services, remote monitoring systems and third-party suppliers. Retrofitting protection can be difficult and expensive, especially when essential services cannot simply be shut down while systems are upgraded.<\/p>\n
Those connections are important. They can improve efficiency and make infrastructure easier to manage. They can also create new pathways for disruption.<\/p>\n
Alcock says organisations can have a good understanding of their major assets while still lacking visibility into activity within the operational environment. \u201cIf you connect the traditionally isolated operational technology environment, which once had an air gap, you often don\u2019t know what\u2019s happening within these environments. A motivated threat actor can get inside and remain unnoticed for a considerable amount of time\u201d.<\/p>\n
That\u2019s concerning, but operational technology security and resilience problems are not limited to deliberate cyber-attacks.<\/p>\n
Indeed, keeping attackers out is only part of the challenge. As infrastructure becomes more connected, failures, technical errors and unexpected interactions can also spread beyond the systems where they begin. An organisation may have strong security controls but still struggle to respond if it does not understand how its operational systems fit together.<\/p>\n
That is one of the key differences between conventional IT security and operational technology security.<\/p>\n
Alcock says: \u201cIn IT, it\u2019s about securing the data and securing the environment. That\u2019s just stuff that supports the business.\u201d<\/p>\n
If those systems fail, the consequences can be serious. An organisation may still be able to function without email or other business applications for a period.<\/p>\n
\u201cWith operational technology, the operational technology side of things is the business,\u201d he explains. \u201cIf that goes down and you can\u2019t make the widget or treat the water, then everything kind of goes haywire.\u201d<\/p>\n
For organisations operating critical infrastructure, that means the goal is not just about keeping attackers out. They also need to detect problems early, limit the damage and maintain essential services when an incident occurs.<\/p>\n
Alcock describes this as a shift from designing purely for prevention to designing for resilience.<\/p>\n
\u201cIt\u2019s a question of how do we detect threats early, contain the damage fast and then recover without hopefully anyone noticing,\u201d he says. \u201cIt\u2019s about taking a hit and continuing to run, as opposed to take a hit and fall over.\u201d<\/p>\n
Alcock says New Zealand\u2019s overall preparedness is mixed: \u201cI think it\u2019s a double-edged sword.\u201d<\/p>\n
Because New Zealand is small, critical infrastructure operators may not have the resources available to larger organisations overseas. At the same time, being small means the country can also be more agile, with a close-knit industry able to share information and respond quickly to new risks.<\/p>\n
\u201cThere is a really good community when it comes to this sort of thing. They share a lot\u201d.<\/p>\n
Informal collaboration is one of New Zealand\u2019s strengths. The country\u2019s small cybersecurity sector means many specialists know one another and can share experience across industries.<\/p>\n
Alcock helps bring those people together through Fortinet\u2019s OT Security Exchange Forum, where operators and security specialists discuss emerging risks and lessons from other sectors.<\/p>\n
Yet New Zealand\u2019s size can also create vulnerabilities.<\/p>\n
Some regional infrastructure operators have limited funding and only a small number of people with specialist knowledge. In some cases, critical operational knowledge may rest with one experienced employee.<\/p>\n
Alcock says water infrastructure and systems operated by regional councils are particular concerns, not because organisations are ignoring the risks, but because they may have fewer resources available to address them.<\/p>\n
\u201cThe biggest gap that I see right now is just the fact that we don\u2019t have any actual requirement to do any of this stuff.\u201d<\/p>\n
Australia has introduced strong cybersecurity obligations for critical infrastructure operators. Alcock says Australia\u2019s regulations have helped drive greater maturity because organisations must meet defined requirements rather than relying solely on voluntary action.<\/p>\n
New Zealand does not have the same level of cyber regulation for critical infrastructure. That means organisations are left to improve their defences because they recognise the operational and business risks, rather than because they face a legal requirement.<\/p>\n
Alcock says many are already adopting recognised practices and looking to Australian requirements for guidance. The challenge will be to develop an approach suited to New Zealand\u2019s smaller scale, rather than simply copying overseas rules.<\/p>\n
He says regulation could provide clearer direction and help ensure cybersecurity is treated more consistently across the sector. But it would need to recognise the different resources and capabilities of large national operators and smaller regional organisations.<\/p>\n
\u201cWhether or not we can scale it down properly to our sort of environment is another thing,\u201d he says.<\/p>\n
For Alcock, the most difficult risks are often the ones organisations have not yet identified.<\/p>\n
\u201cWhat we do know, we can identify as a risk and we can mitigate it. But it\u2019s the stuff that we don\u2019t know yet.\u201d<\/p>\n
New Zealand\u2019s critical infrastructure sector is becoming more aware of cyber risk and better prepared to respond. But resilience depends on understanding not only the systems operators know about, but also the connections, dependencies and vulnerabilities that remain hidden.<\/p>\n
Fortinet is a sponsor of the Herald\u2019s Infrastructure report.<\/p>\n","protected":false},"excerpt":{"rendered":"Yet better cybersecurity does not necessarily mean organisations understand every part of their operational environment. Only 14% of…\n","protected":false},"author":2,"featured_media":574600,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[283175,5660,9442,3381,11728,4373,1510,10806,71,8455,6871,305,1702,38862,12892,5829,5971,117,111,43,139,7805,69,72024,1319,70416,6122,312,6100,17178,8229,80],"class_list":["post-574599","post","type-post","status-publish","format-standard","has-post-thumbnail","category-new-zealand","tag-alcock","tag-attacks","tag-better","tag-complete","tag-critical","tag-cyber","tag-cybersecurity","tag-defend","tag-from","tag-getting","tag-has","tag-have","tag-infrastructure","tag-joshua","tag-mandatory","tag-many","tag-need","tag-new","tag-new-zealand","tag-news","tag-newzealand","tag-no","tag-nz","tag-organisations","tag-picture","tag-protecting","tag-rules","tag-says","tag-still","tag-systems","tag-they","tag-zealand"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/574599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=574599"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/574599\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/574600"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=574599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=574599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=574599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}