Key Takeaways
- Cybersecurity in industrial settings must protect people, equipment, and the environment—not just data.
- Real‑world harm can arise when a cyber incident disables safety alarms or alters process controllers.
- Geographically dispersed assets (remote irrigation, offshore sites, rooftop equipment) expand the attack surface and dissolve the traditional network perimeter.
- A pervasive, dangerous assumption is that anything on the internal network is trusted; legacy OT hardware often lacks authentication, encryption, and patchability.
- Embedding cyber teams early in project design and treating security as a co‑designer enables both speed and resilience.
- Extending an existing safety‑first culture to a safety‑and‑security‑first mindset helps engage mission‑driven staff who may not naturally think like attackers.
- Zero‑trust principles, asset inventory, network segmentation, and secure remote access are essential controls for mitigating OT risk.
Intersection of Cybersecurity, Safety, and Environmental Impact
In operational environments where digital systems control physical processes—such as water distribution, manufacturing lines, or chemical production—a cyber incident is not confined to data loss; it can directly threaten human safety, damage equipment, and cause environmental harm. Cybersecurity protects the confidentiality, integrity, and availability of systems and data; safety shields people from injury; and environmental protection prevents spills, contamination, emissions, and waste. Because OT systems often drive physical actuators, an attacker who disables a safety alarm or manipulates a controller setting can trigger real‑world consequences that traditional IT incidents rarely produce. At Orbia, cybersecurity teams sit alongside health‑and‑safety, engineering, operations, and sustainability groups, ensuring that security considerations are woven into process design, control implementation, and operational resilience initiatives such as OT cyber‑incident tabletop exercises.
Physical Dispersion and the Evolving Threat Model
Orbia’s footprint includes more than 100 production sites across 50 countries, with assets ranging from drip‑irrigation fields and fiber‑conduit plants to offshore facilities. This geographic dispersion means the traditional “perimeter” concept—once a single fence line around a centralized plant—no longer applies. The COVID‑19 pandemic further blurred boundaries, as a significant portion of the workforce now operates outside the corporate LAN, relying on remote access, cloud services, and personal devices. Consequently, endpoint protection, identity management, and cloud security have become critical focus areas to detect and respond to threats regardless of location. Securing a distributed infrastructure requires controls that follow the asset, not just the network segment it resides on.
The Trust‑by‑Default Assumption in Legacy OT Hardware
When walking into any Orbia environment—whether a PLC on an extrusion line, a smart controller for precision‑agriculture products, or a distributed control system in a chemical plant—the most worrisome security assumption baked into the hardware is that “if it’s on our network, it’s trusted.” These systems were engineered for uptime, long service life, and process efficiency, not for resisting adversaries. Authentication, encryption, and modern detection‑and‑response capabilities were often absent from the original design. As a result, legacy technology that cannot be patched or does not meet contemporary security standards remains a daily reality. To counteract this implicit trust, Orbia prioritizes accurate asset inventory, IT/OT network segmentation, zero‑trust architectures, and secure remote‑access solutions—not as optional enhancements but as essential imperatives.
Instilling Security Instincts in a Mission‑Driven Workforce
Many employees join Orbia because of its sustainability mission, bringing a passion for fighting climate change rather than a natural inclination to think like attackers. However, safety and health are already core cultural values; every employee mobilizes around protecting people and the environment each day. Leveraging this existing safety‑first mindset, Orbia extends it to a safety‑and‑security‑first perspective, recognizing that the instinct to safeguard people and the planet is the same instinct needed to defend data and networks. A pivotal moment came when the leadership team participated in the first cyber crisis simulation, which demonstrated how a security breach could rapidly escalate into a safety or environmental incident. That exercise shifted cybersecurity from an IT‑only concern to a business, safety, and sustainability priority, fostering mature cyber awareness across the organization.
Balancing Speed of Expansion with Strong Cybersecurity
Pressure to rapidly deploy sustainable solutions—driven by climate goals and infrastructure demands—often tempts organizations to sacrifice security for speed. Orbia rejects this trade‑off by embedding secure‑by‑design principles into every new digital initiative, whether related to smart manufacturing, sustainability programs, commercial excellence, R&D, or customer service. Cybersecurity teams engage during the design phase, conducting risk assessments, validating controls, and helping select scalable architectures before contracts are signed or systems go into production. By positioning cyber as a co‑designer rather than a gate‑keeper, the business gains confidence to move faster, knowing that resilience and speed reinforce each other. This proactive partnership reduces costly retrofits and ensures that innovation proceeds securely.
Practical Controls for a Distributed OT Landscape
Given the realities of legacy OT, geographic spread, and evolving work patterns, Orbia has hardened its defenses through a set of foundational controls. Comprehensive asset inventory provides visibility into every PLC, RTU, and smart controller across the network. Strict IT/OT network segmentation limits lateral movement, ensuring that a compromise in one zone does not automatically grant access to critical processes. Zero‑trust principles enforce continuous verification of identity and device health, regardless of location. Secure remote‑access solutions—combining multi‑factor authentication, encrypted tunnels, and session monitoring—enable safe connectivity for field technicians and off‑site staff. Finally, regular OT‑focused tabletop exercises and red‑team/blue‑team drills keep response capabilities sharp and reinforce the security‑safety culture throughout the organization.
Conclusion: Security as an Enabler of Sustainable Progress
Miranda Ritchie’s insights illustrate that protecting industrial control systems is inseparable from safeguarding people, equipment, and the environment. By recognizing the real‑world stakes of OT cyber incidents, addressing the challenges of dispersed assets, dismantling the dangerous “trusted by network” mindset, leveraging an existing safety culture, and integrating security early in project lifecycles, Orbia demonstrates that speed and security can coexist. The result is a resilient operational foundation that supports the company’s sustainability ambitions while keeping its people, assets, and planet safe.