# A Review of Industry 4.0 Manufacturing Process Security Risks
## 2 A Complete Paradigm Shift
### Convergence of IT and OT  
The introduction of low-cost devices that have Internet connectivity capability brought about a rapid evolution of a new type of low-cost technology that offers endless application possibilities while presenting the ability to be controlled over the Internet. This new movement of interconnecting devices over the Internet is known as the Internet of Things (IoT). Typical examples of such IoT devices are office printers and home appliances that have Wi-Fi capability, and smart watches that connect to the Internet to log data of people's daily movements and activities. As IoT technology became a well-established field, the scope of applications started expanding into the industrial sector. With an increasing number of industrial devices that started to use the IP for communication, these devices started to enter the IT network domain. This made it possible for OT equipment to be connected to an IT network router or switch and be controlled over the Internet. The new approach of connecting OT equipment to the Internet gave rise to an extension of the IoT called the Industrial Internet of Things (IIoT). In the previous section the three CIA pillars of information and data security have been introduced. Introducing OT equipment to the IT domain means extending these IT security aspects to the OT domain as well. However, it is immediately apparent that the platforms upon which these three security aspects have to be implemented are very different from one another. IT equipment is typically in the form of high performance computers and servers that have a huge amount of computing capability compared to more low-level OT embedded devices. Consequently, the security measures implemented on IT equipment are not easily transferable to OT equipment in general, if at all in some cases [8]. This results in OT systems that are connected to the Internet without proper security measures in place, leaving these systems open to hacking and being maliciously controlled. Several attempts have been made in the past to merge IT security measures with OT systems, but the results showed that this can often lead to an OT system malfunction, with devastating consequences. Such an example is the incident when the United States' National Aeronautics and Space Administration (NASA) explored the introduction of IT security measures to the OT systems in their critical and supporting infrastructure [10]. One of NASA's large-scale engineering temperature chambers, that uses an OT system to monitor and regulate the temperature inside the chamber malfunctioned when the computer connected to it required a reboot after a security patch was installed. After the computer rebooted, the temperature chamber's control system stopped working, causing the temperature to rise steadily until it caused a fire inside the chamber that completely destroyed spacecraft hardware that was undergoing tests. In addition to the control system malfunction, the alarm mechanism of the temperature chamber also malfunctioned, resulting in the fire only being detected hours later by one of the employees. The NASA example of what could happen when OT systems fail owing to incompatible IT security measures illustrates the devastating consequences this could have for any industry where such security measures are applied. This highlights what is arguably the greatest challenge that is presented by converging IT and OT--how to implement proper security measures that are 100% compatible with both IT and OT systems, without the disruption of any underlying processes. A deeper look into the nature of this challenge reveals that one of the underlying differences between IT and OT systems is the way in which the systems communicate with one another. IT devices generally act as either servers or clients, with a one-way control authority between servers and clients that makes use of protocols such as the hyper-text transport protocol (HTTP) [8; 9].