“As utilities embrace the Internet of Things, and they converge IT and OT platforms, they are not just connecting devices; they are connecting safety, resilience, and insight across every layer of critical infrastructure. And they are introducing new cyber risks that must be addressed. – MJ Martin
Maintaining a clear separation between Information Technology (IT) and Operational Technology (OT) environments is critical for Canadian utilities to safeguard their infrastructure from cybersecurity threats, including ransomware attacks.
IT systems, which manage business operations such as billing and customer service, differ fundamentally from OT systems, which control physical processes like water distribution, electricity distribution, or gas flow.
The National Institute of Standards and Technology (NIST), in its Special Publication 800-82, emphasizes the heightened vulnerability of OT systems due to their real-time requirements and legacy components not originally designed for cyber resilience. A failure to properly segment IT and OT networks can allow attackers to pivot from compromised corporate systems into operational networks, threatening service continuity and public safety.
For Canadian utilities designated as part of the nation’s critical infrastructure, the consequences of such breaches can be profound, impacting not only reliability but also national security. As ransomware campaigns increasingly target essential services, robust network segmentation and disciplined access control between IT and OT domains are essential pillars of a resilient cybersecurity posture.
Trends Towards Convergence Create Risks
The convergence of Information Technology (IT) and Operational Technology (OT) in utility environments; accelerated by the proliferation of Internet of Things (IoT) devices and internet-connected infrastructure; has introduced both operational opportunities and significant cybersecurity risks. According to the U.S. National Institute of Standards and Technology (NIST), OT systems, which include industrial control systems (ICS), building automation, and physical monitoring networks, are increasingly integrated with IT components to enable functions such as remote diagnostics and continuous data analysis. While this integration enhances efficiency and visibility, it also exposes traditionally isolated OT systems to cyber threats originating in the IT domain. Many OT devices, originally never intended for internet connectivity, now face vulnerabilities due to legacy firmware, long life cycles, and limited patching capabilities.
For Canadian utilities, whose operations are designated as critical infrastructure, the failure to maintain clear segmentation between IT and OT networks could allow cyber attackers to move laterally from enterprise systems into operational controls, potentially disrupting essential services.
Ransomware attacks, which are now very common in Canada, are now directly targeting OT systems. These OT system attacks are no longer theoretical but represent a growing threat landscape that demands strict network isolation, role-based access, and adherence to best practices outlined in NIST SP 800-82. A disciplined separation between IT and OT is not just a cybersecurity measure; it is a public safety imperative.
IoT Devices Pose An Added Risk
Canadian utility facilities are increasingly integrating IoT-enabled security and monitoring systems to enhance safety, operational resilience, and environmental stewardship. AI-powered surveillance cameras, smart sensor networks, and automated alert mechanisms are now common across energy, water, and gas sectors, enabling real-time detection of physical threats, equipment failures, or environmental anomalies.
In parallel, IoT technologies are transforming data centre operations by enabling continuous monitoring of power stability, humidity, and flooding risks; critical factors for maintaining service continuity.
Beyond infrastructure, various utilities are deploying environmental IoT sensors to monitor air and water quality, producing high-resolution datasets that inform the daily operations of the utility, as well as for scientific research, conservation strategies, and future regulatory frameworks.
Meanwhile, in some parts of Canada, real-time telemetry systems are being used to develop earthquake early warning platforms capable of detecting seismic activity, issuing alerts, and disseminating public safety notifications within seconds. These solutions are common in Canada’s nuclear sector and with dozens of Small Modular Reactors expected to come online over the next decade, more of these types of sensors are anticipated to be deployed. As these technologies continue to evolve, their integration into utility and public infrastructure highlights the growing role of IoT in advancing safety, preparedness, and sustainability across Canada’s critical utility systems.
But, many of these IoT solutions are not as technologically evolved from a cybersecurity perspective, so they pose a potential risk point for cyber attacks. Cameras have been used by attackers as a favourite entry point into OT systems. So, while these IoT systems are important, they need to be fortified to prevent undesired intrusions.
Conclusions
The convergence of IoT, IT, and OT systems within utility environments presents both transformative opportunities and profound cybersecurity challenges. While IoT integration enhances operational visibility, automation, and responsiveness across critical infrastructure, it also expands the attack surface by introducing connectivity into systems that were traditionally isolated and less exposed to cyber threats.
The blending of IT and OT increases complexity and demands a higher standard of cybersecurity governance, particularly as legacy OT systems may not be inherently secure or designed for networked environments.
As utilities in Canada and globally move toward smarter, more connected operations, maintaining robust segmentation, adopting cybersecurity frameworks like NIST SP 800-82, and investing in continuous monitoring and threat response capabilities are essential. Protecting these interconnected systems is not simply a technical requirement; it is a foundational component of public trust, safety, and national resilience.
About the Author:
Michael Martin is the Vice President of Technology with Metercor Inc., a Smart Meter, IoT, and Smart City systems integrator based in Canada. He has more than 40 years of experience in systems design for applications that use broadband networks, optical fibre, wireless, and digital communications technologies. He is a business and technology consultant. He was a senior executive consultant for 15 years with IBM, where he worked in the GBS Global Center of Competency for Energy and Utilities and the GTS Global Center of Excellence for Energy and Utilities. He is a founding partner and President of MICAN Communications and before that was President of Comlink Systems Limited and Ensat Broadcast Services, Inc., both divisions of Cygnal Technologies Corporation (CYN: TSX).
Martin served on the Board of Directors for TeraGo Inc (TGO: TSX) and on the Board of Directors for Avante Logixx Inc. (XX: TSX.V). He has served as a Member, SCC ISO-IEC JTC 1/SC-41 – Internet of Things and related technologies, ISO – International Organization for Standardization, and as a member of the NIST SP 500-325 Fog Computing Conceptual Model, National Institute of Standards and Technology. He served on the Board of Governors of the University of Ontario Institute of Technology (UOIT) [now Ontario Tech University] and on the Board of Advisers of five different Colleges in Ontario – Centennial College, Humber College, George Brown College, Durham College, Ryerson Polytechnic University [now Toronto Metropolitan University]. For 16 years he served on the Board of the Society of Motion Picture and Television Engineers (SMPTE), Toronto Section.
He holds three master’s degrees, in business (MBA), communication (MA), and education (MEd). As well, he has three undergraduate diplomas and seven certifications in business, computer programming, internetworking, project management, media, photography, and communication technology. He has completed over 50 next generation MOOC (Massive Open Online Courses) continuous education in a wide variety of topics, including: Economics, Python Programming, Internet of Things, Cloud, Artificial Intelligence and Cognitive systems, Blockchain, Agile, Big Data, Design Thinking, Security, Indigenous Canada awareness, and more.