OT and IT overlap: The real challenge

The phrase “operational technology (OT) and information technology (IT) environments are converging” may be outdated. The real challenge today is the overlap between OT and IT environments. Security teams strive to gain visibility and control over their networks, incorporating tools to cross their environments. While manageable with fewer devices, implementations become elusive and chaotic with larger numbers, leading to misconfigurations and governance issues.

It’s a familiar struggle in IT. Moving from one company to another, the same story unfolds with different details. As we try to secure our networks, applying the same security layering methods can be met with implementation issues, leading to exceptions, amendments and lowered security postures. Ultimately environments require the same outcome of protection of assets but require tuning for each environment and potentially further granularity in specific alterations. These changes are often seen as “temporary,” with hopes to address them later by gaining leadership agreement to shift the security posture correctly.

Let’s provide a clear example of an incident affecting your IT side, not the OT, from the threat actor (TA) access. The problem of the OT/IT overlap is revealed. Boom day occurs, and your incident response (IR) plan swiftly contains and addresses the incident. Invoking your IR plan typically involves many stakeholders, both technical and non-technical, to address the situation. A common action in these plans is dedicating teams to perform a root cause analysis (RCA). How did the TA manage to get malware on your endpoints, execute privilege escalation, lateral movement and remain persistent in your environment? Fast forward to a successful RCA, you discover the TA used pythonw.exe, a version of the Python interpreter for Windows that runs Python scripts.

Malware authors have been taking advantage of Windows embeddable package of python. From the 4. Using Python on Windows — Python 3.14.3 documentation:

“The embedded distribution is a ZIP file containing a minimal Python environment. It is intended for acting as part of another application, rather than being directly accessed by end-users.”

Malware authors are taking advantage of this by using the authentic, signed software python package, deploying to victims to unwittingly operate their malware tool kit in python. Effectively running all their malicious tools for privilege escalation, lateral movement, potentially the entire Command and Control (C2) framework, written in python without the need to have python installed on the endpoint. This technique TAs are using executes python on the victim’s endpoint, but does not always show script visibility to security controls like endpoint, detection and response (EDR) solutions. In most cases, the only observable event is the execution of pythonw.exe, which many analysts might falsely attribute to legitimate use.

If this software is not normally run in your environment, you can simply block it outright. A signature can be determined in the form of a tactic, technique and procedure (TTP) to look for future signs of infection using this same TTP. In environments with 1,000 endpoints, some developers or edge cases can be verified for their use case. Exceptions would be endpoint-specific or unique to the exemption, so the same attack technique would still be blocked from the known incident. However, if you scale up the number of endpoints, exceptions cannot be applied by verifying each case due to different implementations. This is precisely the problem when your OT and IT overlap.

Strengthening your environment with containment security controls is crucial in the incident response lifecycle. This process differs from containment during an incident, which may involve shutting down the network entirely to halt all North to South traffic. After determining the RCA, business operations must resume quickly to minimize downtime. Investigating every endpoint in environments with over 10,000 devices is often impractical and costly. Therefore, relying on security controls for visibility into events is essential to confirm consistent TTPs.

Blocking pythonw execution appears to be a viable solution to address the RCA. By eliminating the entry point and lateral movement capabilities, the issue can be contained. However, this approach presents a conflict at scale. Python is integral to many OT ecosystems, where pythonw.exe is utilized in GUI-based engineering tools, HMIs, background automation scripts, and vendor-provided utilities with embedded Python runtimes.

Proactivity is key in defending against the overlapping issues of IT and OT environments. Preventing one environment from impacting the other without fragmenting governance is a delicate balancing act. Specialists for each environment are crucial, providing operational context without hindering asset protection. Just as you likely wouldn’t hire a Windows system administrator for a Linux-dominated production environment, security controls should be supported by experienced vendors or analysts. Managing both IT and OT environments requires reflection in technology governance, including specific OT system administrators for help desks, application support and OS administration.

Ideally, separate domains for OT ensure compromised accounts in one area don’t grant access to the other. Segmenting environments to prevent attack spread demands persistence and focused organization to limit exposure. This ensures quick recovery and business continuity in the face of major breaches. Establishing your baseline during normal operations is the best proactive defense, as heightened sensitivity during or after a breach can cause major alarms from minor anomalies.

The worst time to start categorizing and establishing your “normal” is during or immediately after a breach. Even minor anomalies can cause major alarms due to heightened sensitivity. Establishing your baseline during normal operations is your best proactive defense.