The NCSC says it has noticed a shift in attitudes towards using the cloud for industrial applications. Previously this has usually been dismissed due to the potential risks, but the Centre says that many OT organisations are now turning to cloud-based Scada systems.
The new guidance does not say whether the cloud is the right or wrong approach for OT organisations. Rather, the decision to migrate depends on each organisation’s risk profile and technical requirements. Although cloud-hosted Scada introduces “some unique risks”, making a cloud platform secure is problem that is shared with IT operations. The guidance is intended to be used in conjunction with the existing cloud security guidance.
The guidance identifies three critical areas that need to be assessed before deciding to migrate to the cloud:
• understanding business drivers and cloud opportunities;
• organisational readiness; and
• the suitability of technologies and cloud platforms.
Organisations also need to consider the impact of OT challenges such as a reliance on legacy equipment, the use of on-premises systems, and monolithic software packages.
