What is IT/OT convergence? Everything you need to know

What is OT?

OT focuses on the management and control of physical devices that exist and operate in the physical world. The control of real-world devices is as old as industry and manufacturing itself. Over time, electronics and digital technologies also found widespread use in operational control systems, such as computerized numerical control (CNC) machining systems.

Where IT focused on data and communication, OT focused on behaviors and outcomes. Most control systems employed across industrial and manufacturing installations weren't networked, resulting in silos of specialized devices -- each electronic at some level, but not readily able to communicate or share information. This means human operators were tasked with programming, maintaining and managing the physical operations of each piece of equipment. Even equipment that provided centralized control used closed or proprietary protocols.

Consider a traditional (non-autonomous) automobile. Although a modern vehicle contains a wide array of electronic devices, it remains a single, unintegrated system. The vehicle might record data, but doesn't share data and doesn't enable any overarching management or control. It functions under all real-world conditions but relies solely on the capabilities and experience of a human operator to operate successfully.

What's the difference between IT and OT?

IT includes any use of computers, storage, networking devices and other physical devices, infrastructure and processes to create, process, store, secure and exchange all forms of electronic data.

OT, traditionally associated with manufacturing and industrial environments, includes industrial control systems such as material articulation and manipulation, supervisory control and data acquisition. A common example is a robotic device that might grab a material or part, apply other materials or parts to it and then send the completed assembly on to another machine.

The problem is that IT and OT were never integrated. For example, a CNC machining station on a factory floor might be fully digitized. It might have proprietary connectivity to other similar machines or common factory floor control systems. Still, it would never connect to the enterprise LAN where other business data, such as spreadsheets and PDFs, was exchanged. Thus, the status, behaviors and outputs of that isolated machine in the OT world were never really available to the broader enterprise for analysis and control. Today's technologies are finally enabling such integrations.

One technology that fostered the integration between IT and OT was the development and deployment of IoT devices. IoT devices include a wide assortment of sensors for gathering real-world conditions, such as temperature, pressure, dimensional measurements, chemical compositions and countless other physical parameters. IoT devices also include an array of actuators, such as motors and solenoids, that translate digital commands and instructions into physical actions, such as controlling valves and moving mechanisms. Each IoT device is designed to communicate over standard networks, enabling them to exchange OT data with IT resources -- servers and storage -- sometimes over considerable distances.

Consider a wind turbine. By itself, a wind turbine would be classified as OT industrial equipment, including all the equipment and electronics necessary to generate power and connect it to the grid. But that's all. By including IoT devices to drive IT/OT convergence, the wind turbine could use sensors to detect wind direction and intensity while communicating its output and status to a centralized control location. The central facility would analyze the data, issue commands to autonomously configure the wind turbine for optimal performance under current weather conditions and create maintenance work orders based on operating time and condition-sensor data, such as vibration or wear.

While IT inherently covers communications as a part of its information scope, OT hasn't traditionally been networked technology -- meaning connected to a larger network such as a LAN or the internet. Many devices for monitoring or adjustment weren't computerized. Those OT systems with compute resources generally used closed proprietary protocols and programmable logic controllers rather than technologies that afford full computer control. The systems involved often relied on air gapping -- the deliberate choice to forego network connections -- for security.

As IT integrates with more OT systems, air gaps can't provide adequate security for network communication and OT data. Organizations driving IT/OT convergence must educate and train staff to understand and implement adequate security. This often involves a mix of cross-hiring, cross-training and close observance of regulations, such as the GDPR and CCPA, across both IT and OT regarding data security, privacy and protection.

IT/OT convergence project success and overall security can benefit from a range of initiatives involving project teams, including the following:

• Having an IoT sponsor.
• Keeping OT and IT in the same loop.
• Understanding how to design IoT.
• Understanding how to integrate IoT.
• Training staff and developing expertise.
• Planning for scale.

What is IT/OT convergence?

The idea of technological convergence isn't new. By enabling different technologies to integrate and interoperate efficiently as a single cohesive system, businesses can improve efficiency, reduce errors, cut costs, enhance workflows and gain measurable competitive advantages.

Enterprise IT has long been a focus of convergence efforts, bringing often disparate data center technologies together and enabling seamless interoperation. One example of convergence is the appearance of converged IT infrastructure -- later evolving into hyperconverged infrastructure. These developments merge traditionally separate servers, storage, networking and management tools into a single, cohesive, centrally managed product or platform.

The idea of IT/OT convergence seeks to bring physical -- OT -- equipment and devices into the digital -- IT -- realm. This is possible due to advances such as machine-to-machine communication and the introduction of sophisticated IoT sensors and actuators that can be integrated into physical equipment. These devices can employ wireless communication over standardized networking protocols, such as TCP/IP, to communicate the relevant data from each physical system back to a central server for monitoring and analysis. The results of that analysis can then be fed back into the physical system to enable more autonomous operation, enhance accuracy, correct recurring errors or drift, support maintenance and improve uptime.

Consider how this affects everyday technologies, such as vehicles. The addition of sensors, actuators and standardized communication enables a vehicle to pass real-time position, movement and condition data back to a collection point for analysis. At the same time, instructions and real-time data, such as traffic and weather, can be passed to the vehicle. This can help a human driver make better driving decisions, such as finding alternate routes or servicing the vehicle before breakdowns occur. But this kind of IT/OT convergence is also the underpinning of autonomous vehicles, also known as self-driving vehicles. 

Types of IT/OT convergence

Convergence isn't a single initiative or effort. Convergence initiatives can take a variety of directions depending on the needs and goals of the particular organization. There are three main categories of IT/OT convergence:

• Process convergence covers the convergence of workflows. IT and OT departments must reform their processes to accommodate each other and make sure important projects are communicated. This is an organizational convergence that deals with the structure of the internal business. For example, a business might follow specific processes for storing and protecting IT data, but these processes might be adapted or extended to converge OT systems. Another example is applying data security and retention policies to data collected from manufacturing machines across a factory floor.
• Software and data convergence deals with getting the software and data in the front office to work to address OT needs. This is a technical convergence affecting the organization's network architecture. For example, IT might need to implement new tools to collect OT data and integrate it with IT data for analysis. For example, future business analytics and decision-making might include data collected and processed from OT and IT systems. One example might be the introduction of new AI tools capable of performing analytics for predictive maintenance of manufacturing systems, based on collected and stored data.
• Physical convergence includes physical devices being converged or retrofitted with newer hardware to accommodate the addition of IT to traditional OT. This is an operational convergence in which the hardware itself is updated and maintained over time. This might include purchasing new OT systems -- replacing aging machines with newer, convergence-ready systems -- or adding aftermarket devices to enable expanded data communication and control.

IT/OT convergence industry examples and use cases

Increasingly, organizations are integrating sensors and connected systems, such as wireless sensors and actuator networks, into the management of industrial environments, including water treatment facilities, electric power systems and factories. The integration of automation, communications and networking in industrial environments is an integral part of IoT and is often referred to as Industry 4.0. Today, some technology leaders envision an impending convergence of human intelligence and AI that might signify a fifth industrial revolution -- sometimes called the cognitive age -- though that point of inflection has not yet fully materialized.

Here are some practical examples from industries that benefit from the convergence of OT and IT:

• Manufacturing. IT/OT convergence enables organizations to be more cost- and resource-efficient by using sales and inventory data to drive manufacturing operations -- optimizing equipment and power use while minimizing maintenance and unsold inventory. For example, IT/OT convergence might integrate an organization's manufacturing execution systems and the programmable logic controllers of each manufacturing system with a back-end ERP platform to coordinate production with demand and supply chain behaviors.
• Utility and energy companies. Modern IT enables OT teams to access operational data remotely, helping industries such as oil, gas and electricity to optimize industrial equipment inspections, make damage assessments and handle inventory monitoring and distribution. As an example, smart meters and IoT sensors can provide the data needed to monitor, control and optimize real-time energy distribution while monitoring and managing device health across the energy grid.
• Healthcare. The integration of IT and OT enables traditionally independent devices -- such as patient monitoring systems -- to collect and exchange patient data for centralized monitoring and analytical diagnostics. One example is remote cardiac monitoring devices, which can track a patient's cardiac performance in real time and automatically trigger clinical intervention -- even rescue -- if cardiac issues arise.
• Transportation. Asset management is a priority in transportation. Integrating IT and OT can help rail, bus, delivery and other transportation organizations gain better visibility into the coordination, condition and usage of assets to guide short-term repairs, route optimization and long-term planning for asset replacement and safety. For example, convergence initiatives can connect vehicles and infrastructure to tracking systems to optimize routes based on weather and traffic conditions, enhance fleet maintenance to reduce vehicle downtime, and track detailed inventory in real time.
• Military and law enforcement. IT/OT convergence can aid in the coordination and rapid deployment of resources while providing more insight into the condition and maintenance of critical equipment. For example, convergence can monitor the real-time position and operations of law enforcement units in the field, suggesting the fastest and most effective response for new calls for service based on the nature, location and severity of the call.
• Communications and media companies. Regional and global communication providers can employ IT/OT convergence to oversee the performance and operation of equipment and quality of service, leading to faster troubleshooting and better user satisfaction. For example, devices can monitor the availability and health of cell towers and other telecom equipment, directing failover and rapid remediation in the wake of device failures.
• Retail. The use of IoT devices, such as smart product tags, along with other OT devices, such as cameras and point-of-sale terminals, can deliver more data to IT for analysis, leading to inventory and sales-floor optimizations for cost savings, as well as better revenue generation and a better shopper experience.
• Medical and pharmaceutical. IT/OT integration enables more medical devices to exchange and share patient information for real-time visibility, leading to better patient analysis and outcomes; meanwhile, convergence can monitor drug manufacturing systems and detect issues such as purity or contamination, improving medicine production and enhancing product quality.

IoT and IT/OT convergence

IoT, especially when paired with edge computing, enables the IT portion of IT/OT convergence. As mentioned, OT devices aren't traditionally networked technology. IoT devices, by definition, are networked computing devices capable of collecting, transferring and analyzing data. Traditional OT devices -- sensors, for example -- can collect data but can't transmit it over a large network or perform in-depth analysis.

Newer smart sensors can collect data from the source, such as a factory floor, and transmit it to an IoT hub or edge gateway, which then forwards it to an analytics application or an ERP platform, where it is integrated into an organization's unified system of business operations. When connected to a network, an OT device functions as an IoT device. In the factory floor example, a sensor can collect operational data on materials or machines in the factory and send it over a wireless network to the back-end system application to be interpreted and trigger an action -- maintenance on factory equipment, for example.

The addition of edge computing capabilities to industrial IoT (IIoT) devices enables real-time data processing closer to the source. Instead of sending data over a network to a centralized location for processing, IoT devices can analyze time-sensitive manufacturing data on-site and return insights quickly, enabling direct monitoring of industrial conditions before the data becomes obsolete. This is important because IoT and OT devices are often part of a distributed network architecture, making transmission to a central processing location difficult or impossible -- IoT is an important technology behind distributed or edge computing. These devices are also often responsible for critical industrial systems that, if shut down or interrupted, would incur severe consequences.

The addition of IT technology to OT enables organizations to make better use of data that OT generates through IoT devices and edge computing.

IT/OT convergence security challenges

IT/OT convergence can pose challenges in IT security. Convergence isn't just a blending of technologies, but also teams and processes. The addition of OT brings new stakeholders into the security environment. IT security teams and processes must incorporate the diverse real-time demands of industrial environments. Convergence must accommodate significantly more data that can be sensitive and proprietary to the business -- this must be stored, secured and managed as with existing IT systems. As another example, it's just not possible to shut down a smart grid for a few hours to apply patches or change configurations. In other cases, OT systems might be in place for decades longer than IT systems and have few or no security provisions governing how their controls and data are accessed, presenting additional security risks to consider and mitigate. But OT systems weren't built for internet connectivity and must be retrofitted with IoT devices and proper security controls.

There are six principal security threats to IT/OT convergence:

• Lack of collaboration. IT and OT teams have rarely worked together, which can lead to security oversights that increase complexity, duplicate efforts, raise operating costs and expose security flaws that attackers can exploit. To ensure security, disparate teams must prioritize, collaborate and communicate in ways that might not have been necessary or even possible in years past.
• Lack of uniform security strategy. If a system can produce data and be controlled, it can potentially be attacked. This can include data theft or more direct acts of sabotage -- such as misaligning machines or shutting down a production line. Just imagine what might happen if an attacker could access and turn off a patient's life-support device. As more real-world devices integrate with IT environments, it's critical to align IT and OT systems with consistent security practices such as strong access control, zero trust, data encryption and other current security technologies.
• Legacy OT systems. Although IT systems rarely last more than five years, OT systems, such as manufacturing machines, can have lifecycles that measure into decades. Such legacy systems typically incorporated few, if any, security features and can't be upgraded because of proprietary designs or protocols. Every converged system must be evaluated for security, and systems that can't meet security requirements might require new or updated OT equipment. If an older OT system or device can't communicate, identify itself on the network or ensure adequate security, it creates a serious blind spot in IT/OT management.
• Insufficient insight. IT routinely relies on asset discovery and remote configuration to provide a clear and complete picture of the managed environment. OT systems must be able to share this environment, offer discoverability, and support remote configuration and management. If an administrator can't see an OT device, they can't secure or manage it. Such gaps can lead to security vulnerabilities.
• Mission-critical demands. OT production systems are often called upon to function 24/7, year-round and can't be paused or turned off for upgrades or updates without a significant loss of revenue or physical risk. Imagine turning off medical life support equipment for software updates. Organizations might ignore potential security vulnerabilities simply because they can't afford the downtime required to remediate them. This is a kind of "technical debt" that can expose serious security vulnerabilities for the converged business.
• The effects of disruption or malicious attack. Although integration is seen as a positive, the effects of disruption can be devastating. Consider what happens when a factory floor full of active machinery suddenly can't communicate due to a network disruption, such as a network gear failure or an external DoS attack. IT/OT convergence demands a careful assessment of resilience and fail-safe factors.

Benefits of IT/OT convergence

IT/OT convergence enables more direct control and more complete monitoring, with easier analysis of data from these complex systems, from anywhere in the world. This enables workers to do their jobs more efficiently and improves decision-making, as organizations, leaders and employees have access to real-time insights that converged data provides. Businesses, including manufacturing, transportation, mining and other industrial organizations, are embracing IT/OT convergence.

The following are some of the benefits of IT/OT convergence over separate IT and OT:

• Less siloed IT and OT departments, as the departments must share their respective areas of expertise to manage converged technology.
• Improved cybersecurity where IT and OT systems are blended and protected as a single unified environment, rather than two disparate systems.
• Reduced development, operational and support costs, as well as less unplanned downtime due to predictive maintenance enabled by IoT devices and data-driven analytics.
• Faster time to market for converged technology.
• Improved compliance with regulatory standards, as the addition of IT to OT enables better visibility, management and auditing across digital and physical environments.
• Improved automation and visibility into distributed OT because OT gains the ability to transmit real-time maintenance data.
• More efficient energy and resource usage, as organizations can align OT systems more closely with actual product needs.
• More efficient asset management because all IT and OT systems are seen and managed through a common methodology.

Challenges of IT/OT convergence

Digital transformation requires organizations to reform most or all areas to succeed. OT's modernization through IT integration is no different.

• Security. Many operational technology systems were never designed for standardized communication or remote accessibility, and as a result, the risks of connectivity weren't considered. Such systems might not be regularly updated. Additionally, OT systems are often distributed in nature and relied upon to support critical infrastructure. Their distributed nature makes for a larger attack surface. The vulnerabilities of OT systems can leave organizations and critical infrastructure at risk of industrial espionage and sabotage. Converged security can be enhanced with smart filtering and zero-trust authentication.
• Human error. But security concerns are not just technical. People play a vital role in IT/OT security. The parallel, and sometimes conflicting, roles and priorities of IT and OT teams create ample opportunities for security oversights and vulnerabilities -- which can complicate effective governance. It's up to people to change the corporate culture to support IT/OT convergence, establish the communication and collaboration needed to approach convergence, and adjust the business policies and workflows that establish necessary security configurations and guidelines. A clear review of organizational roles and responsibilities can establish the organizational structure needed to implement convergence. IT/OT cross-training can help disparate teams enhance collaboration and address differing goals.

Other challenges of IT/OT convergence include the following:

• Process convergence. Organizations might struggle with reorganizing previously siloed IT and OT departments to manage and operate newly converged technology.
• Communication and interoperability. Older OT devices might not be discoverable or communicate adequately with the IT infrastructure. A thorough review of OT systems and their capabilities can reveal instances where new systems or adaptations (workarounds) might be required to achieve suitable convergence.
• Advanced IT. Adding devices and systems to the IT environment can sometimes overwhelm the network with significantly greater data volumes. Adding OT systems might require advanced technologies, including high-speed networks, additional computing power and specialized systems such as edge computing deployments to collect and process data closer to the OT sources.
• Secure IoT implementation. Oftentimes, IoT initiatives aren't owned by any one department, and communication of a new project might not reach all departments -- especially in a more siloed organization. Typically, OT departments have limited knowledge of security, and IT has limited knowledge of the projects currently underway. This can create a dangerous security gap with IoT deployments.
• Training and skills. Only recently have certifications, such as Cisco IoT Essentials for System Engineers, been offered to help OT workers understand how the technology they are accustomed to intersects with networked technology. Before that, there were few standardized courses for manufacturing process control. This means that older systems and staff may have adhered to standards that vary from one organization to another, leading to compatibility and security issues.
• Integration with existing systems. The business side of an organization might be tempted to replace technologies instead of modernizing existing OT with IT technology. This undermines one of the benefits of convergence: cost efficiency. The point of convergence is to do more with what is available.

IT/OT convergence strategies and best practices

So, what's the right way to approach an IT/OT convergence initiative? Given the wide array of OT systems and industries that might pursue convergence, few clear paths guarantee a successful strategy. However, some general guidelines can help an organization maximize its chances of success:

• Communicate goals. Develop a clear picture of the overall objectives and ensure that both IT and OT groups understand the convergence goals involved.
• Show the overlap. Illustrate how IT and OT will overlap for each team, especially in terms of systems management and security.
• Define the roles and responsibilities. Outline the duties, goals, roles and responsibilities for IT and OT teams and focus on opportunities to collaborate.
• Provide training. Cross-training can help IT and OT groups develop a better sense of each other and understand each other's needs. In addition, a growing number of IT/OT convergence certifications are appearing to help organizations manage convergence projects more effectively.
• Use the right tools. Teams can work together to identify and deploy tools that can provide the appropriate amount of visibility and control over IT/OT assets. Tools should cover discovery, configuration, analytics, reporting, alerting, management and security.
• Measure and adjust. Goals should include clear technical metrics and business KPIs that can be measured to gauge the actual outcomes of IT/OT convergence. Take the time to implement those metrics or KPIs and measure them with tools. Review metrics regularly and make constructive adjustments to the plan that can overcome any difficulties and refresh goals along the way.

The path toward any IT/OT strategy typically involves three distinct phases: organizational, technical and operational.

The organizational phase is intended to facilitate collaboration and communication by bringing IT and OT teams together to share information and align efforts, often under the guidance of a senior manager or convergence evangelist. The technical phase is where the actual convergence architecture -- including IoT and other parts of the infrastructure -- is designed and developed. This usually includes management and security issues and involves some amount of proof-of-principle validation. The operational phase involves deploying and operating the converged environment, including regular reporting and infrastructure refreshes and updates as technologies evolve.

With overarching guidelines in place, a business can focus on the more practical aspects of IT/OT integration. There are generally three accepted approaches:

• Creating a separate network for IT and OT.
• Partitioning IT and OT networks.
• Fully integrating OT traffic in the IT environment.

Each approach has its challenges and tradeoffs, but IT and OT systems have different requirements that must be addressed. They aren't the same and often can't be treated interchangeably, especially where legacy OT systems are involved. For example, consider the presence of mission-critical OT systems, such as critical safety systems in an industrial process. It might be better to create and maintain a separate network for IT and OT systems than to share a network that could be subject to heavy traffic loads and disruptions. In effect, use the approach that's most appropriate for the business and its regulatory or governance requirements.

Stephen J. Bigelow, senior technology editor at TechTarget, has more than 20 years of technical writing experience in the PC and technology industry.

Ben Lutkevich is a site editor for Informa TechTarget. Previously, he wrote definitions and features for WhatIs.

Ryann Burnett also contributed to this article.