Protect operational technology systems from cyber risks

It was the revolution in operational technology (OT) that changed the world before the rise of IT. What we call “operational technology” is the hardware and software that regulates and runs the mechanical parts of businesses. Water, manufacturing, power, and distribution networks all rely heavily on OT systems to function well. To run, automate, and control industrial machinery, all of these systems are necessary. As internet penetration increases in the manufacturing sector, OT systems face the same disruptive dangers as other internet-connected equipment, including cybercrime, botnet assaults, and ransomware.

Traditionally, organisations have kept their information technology (IT) and operational technology (OT) systems completely separate, and they haven’t put much emphasis on protecting their industrial control systems (ICS). Moreover, most investments in SCADA, PLC, and industrial robotics were undertaken with a time horizon of many decades. Companies have been hesitant to update their OT systems due to the fact that their proven reliability over many years has made the possibility of security flaws or breaches seem less urgent.

Large, previously unconnected systems have become so because of the current digitalization push caused by the pandemic and the desire of businesses to maintain resilient supply chains. To make matters worse, many OT systems have never received the fundamental security care of frequent patching, regular vulnerability upgrades, and periodic backups.

The Distinctive Features of IT and OT

Historically, the two types of networks—IT and OT—have been handled and monitored independently. Both IT and OT employ the same technologies but in different contexts. Unlike IT tools, OT tools are made to facilitate communication between mechanical systems. The primary goal of utilising these resources is to guarantee the high availability of devices and the proper functioning of industrial control systems. They are more susceptible to dangers that might compromise their high availability by using outdated software. Traditionally, operational technology (OT) systems were isolated from information technology networks by being housed in their own dedicated data centres. But, with the advent of the Industrial Internet of Things (IIoT), systems may be managed and monitored remotely, making full use of existing network infrastructure and computer programmes.

The ability to work remotely reduces overhead and boosts productivity for businesses. Yet, this indicates that air holes are being quickly closed. As a result, OT is now more approachable and vulnerable to cyberattacks.

Why is it important to protect operational technology?

Because OT systems were traditionally not connected to the internet, physical facility protection was the extent of OT security. The usual and very visible deterrents against incursions were strong perimeter gates and human-based entry restrictions, such as security guards. The precautions taken to safeguard the technology were clearly visible.

To what end do OT networks pose a threat?

Even if having an Internet connection makes things simpler to use, this transition has left the system vulnerable in ways that can’t be prevented by even the most well-armed guard. Even worse, as the Stuxnet attack demonstrated, an assault on the physical systems might lead to the destruction of these priceless assets. Can there be no downtime associated with securing industrial networks?

The majority of these systems are running out-of-date software that is no longer receiving security updates (71%), have weak passwords (64%), and lack up-to-date antivirus software (66%), according to the 2020 Global IoT/ICS Risk Report. The following issues arise from this situation:

Direct Internet Connections

Most businesses today have what are called “direct internet connections,” which are wired directly to the internet backbone. It is well known that all an attacker needs is access to a single internet-connected device to compromise a whole OT network.

Operators have been exploiting weak passwords to get easy access to networks. Because of this, gaining unauthorised operator access via brute-force discovery of credentials is simple for attackers to do.

Exposed Unnecessarily: At least one poorly designed wireless access point is in range of several laptops and other devices in many fields. Auditing access point setups can uncover any misconfigurations, which can then be corrected to stop malware assaults.

Outdated OS: An OS that is no longer receiving security upgrades leaves the machine wide open to cyber threats. To prevent compromise, it is necessary to take stock of all devices and update them to the most recent patches and manufacturer standards.

Obstacles to Identifying OT Threats

There have been several releases of OT threat detection software and hardware in recent years. Nevertheless, detecting OT threats has a few obstacles:

1. The Security Operations Centre (SOC) lacks the necessary expertise in operations and manufacturing cybersecurity.
2. As time goes on, threats evolve, and adversaries improve their methods.
3. There is no one device or sensor that can reveal all potential dangers.
4. Many tools are unable to automatically trigger a shutdown event until a genuine breakdown has occurred, as this would violate the sensitivity required in an industrial control system context.
5. Coverage by endpoint tools is limited by legacy hardware and vendor constraints.

How can businesses ensure the safety of their OT infrastructure?

The organisational security management of operational technology is a top priority. Organisations may build a smarter security operations centre utilising the MITRE ATT&CK framework to protect their OT networks from any cyber threat. Organisations can better safeguard themselves with the knowledge presented in MITRE ATT&CK.

Some vital procedures that might quickly improve the security of your OT environment are as follows:

1. Consolidated logging and secure access are two problems that many businesses struggle with. Different users require varying levels of access, so businesses must provide them with their own unique pathways in. Multi-factor authentication is necessary for safe user access. With centralised logging, you can ensure safe access management. To better manage and analyse all logs, find security holes, and fine-tune defences, centralised logging is essential.
2. Asset Management: OT systems are the brains of every industry, and it is the responsibility of any company to keep them safe. Lack of visibility is a problem for many OT systems. The true number of operational technology (OT) systems in use is often unknown. Every business needs a complete list of their OT systems as part of their asset management. They’ll have a better idea of what they’re defending and can prepare accordingly.
3. Companies must be aware of all software versions, updates, and compatibility with the OT systems in the environment in order to conduct a thorough software vulnerability analysis. Spotting potential weak spots with a vulnerability scan is also crucial.
4. Management of patching: Patching is a crucial aspect of responsible hardware and software maintenance. It is important for businesses to be aware of the patching needs of the assets they own. Given the complexity of OT patching, careful management is required. As a result, it’s possible that automated OT patching isn’t always the ideal option. But it doesn’t mean you shouldn’t have a comprehensive patching strategy in place.
5. The separation of networks into distinct categories is known as network segmentation. The goal is to create functional subnetworks inside massive networks. To isolate a middle ground, segmentation might be useful. An assault on the development network, for instance, would have no effect on the sales network. To link several systems, businesses should choose a tried-and-true method, such as the Purdue Model, rather than starting from scratch.
6. Data backups are the best approach to getting your data back after a disaster. Businesses need to back up their data often. There are a variety of backup strategies available, as well as industry standards for keeping copies safe.

Conclusion

Managing IT security may be challenging for businesses since assets are often hidden from view. The good news is that there are measures that can be taken to mitigate the most serious threats. With the right information and meticulous preparation and execution, a security programme may be highly successful. Enterprises may begin to counter the rising threats to OT systems by investing in technologies that can give crucial insight and cooperating with Cybersecurity Solution and Service Providers who provide suitable, industry-specific solutions and a trained talent pool.

At 10xDS, we partner with you to provide a comprehensive suite of cybersecurity and IT risk assurance services to detect, prevent, and proactively respond to security threats, helping you to rapidly adapt to changes, mitigate risk, and minimise the impact. Talk to our cybersecurity experts to know more!

1. The Purdue model is a framework for ensuring the safety of Industrial Control Systems (ICSs); specifically, it addresses the need to divide up the physical processes, sensors, supervisory controls, operations, and logistics into their own separate compartments. Despite the popularity of edge computing and direct cloud connections, the idea of ICS network segmentation to safeguard operational technology (OT) against malware and other assaults has not faded.