Abstract
Breached cybersecurity may impact personnel safety on industrial sites, cause major
accidents and affect societal safety at large. The combined cybersecurity of information
technology (IT) and operational technology (OT) (aka industrial control systems) is
crucial. The Norwegian oil and gas industry is a nexus where the boundaries between
safety and security concerns, IT and OT practices are indefinite. While risk-informed
building of robustness and rebound capabilities is the salient approach, the overall
challenges call for a diverse resilience approach, including adaptive capacities to deal
with complexity and surprise.
IT and OT are communities of practice conveying techno-cultural priorities and
preferences beyond the organizational culture they are situated in, and their
combination accommodate tensions. The purpose of this research is to enhance the
understanding of the cultural positions from which the inhabitants of the IT/OT domains
act and navigate, and how these positions affect the possibility of joint cyber-resilient
performance.
The results show that by studying IT/OT self-descriptions, mutual expectations and
demarcations, we can identify blind spots, inert positions, but also occasions and
conditions for cultural exchanges and dynamics. This enhances the knowledge on how
joint IT/OT cyber-resilient performance can be understood and shaped in cultural
terms, combining safety and security concerns.
The findings imply new directions for management in the forming of a culture for cyber
resilience. Successful cyber resilience will require a focus on relations and
responsiveness building adaptive capacity in the periods between, rather than focusing
on traditional measures targeted at, cyber incidents and events