Which encryption approach is recommended for OT environments to balance security with performance?

Which encryption approach is recommended for OT environments to balance security with performance?

• A. Encrypt only data at rest; ignore in-transit data
• B. Disable encryption to maximize performance
• C. Encrypt data in transit using TLS/DTLS and at rest where feasible, while maintaining low-latency configurations
• D. Use proprietary encryption with no standard

Answer: (C)

In OT environments, you want to protect both the data moving across networks and the data stored on devices, but you also must keep latency and real-time responsiveness in check. Encrypting data in transit with TLS or DTLS helps prevent eavesdropping, tampering, and impersonation of control commands and sensor data as it flows over the network. Encrypting data at rest where feasible protects stored configuration, logs, and archival data without necessarily adding heavy runtime overhead. At the same time, you aim for low-latency configurations by selecting efficient cipher suites, enabling hardware acceleration where available, and tuning session parameters to minimize overhead. This approach is superior because it provides security for both in-transit and at-rest data, while still meeting the performance requirements of OT systems. In contrast, encrypting only data at rest leaves networks vulnerable; disabling encryption removes essential protections for transit data; and relying on proprietary encryption with no standard introduces interoperability and security risks due to lack of peer review and updates.

In OT environments, you want to protect both the data moving across networks and the data stored on devices, but you also must keep latency and real-time responsiveness in check. Encrypting data in transit with TLS or DTLS helps prevent eavesdropping, tampering, and impersonation of control commands and sensor data as it flows over the network. Encrypting data at rest where feasible protects stored configuration, logs, and archival data without necessarily adding heavy runtime overhead. At the same time, you aim for low-latency configurations by selecting efficient cipher suites, enabling hardware acceleration where available, and tuning session parameters to minimize overhead.

This approach is superior because it provides security for both in-transit and at-rest data, while still meeting the performance requirements of OT systems. In contrast, encrypting only data at rest leaves networks vulnerable; disabling encryption removes essential protections for transit data; and relying on proprietary encryption with no standard introduces interoperability and security risks due to lack of peer review and updates.