Operational Technology, or OT, including SCADA (supervisory control and data acquisition) and ICS (industrial control systems), is a system of hardware and software designed to monitor and/or control the physical devices, processes, and events used in the production and operations segments of businesses and organizations, including critical infrastructure (CI). OT networks play a critical role in things like production, manufacturing, defense and emergency, food and agriculture, and financial systems. These systems are traditionally kept separate from IT networks, and are often owned, managed, and operated by a different team.

 

OT devices and networks can be deployed anywhere – inside a manufacturing floor, distributed across a chemical processing plant, or out in the arctic monitoring oil and gas pipelines. These OT systems often perform simple yet essential tasks, such as monitoring a valve and shutting it off when a certain value is triggered. As a result, they can perform their tasks with little change for years. Which also means they sometimes run on aging operating systems and obsolete hardware using home grown applications. Since the goal for an OT system is to run exactly as designed, even patches are only applied if they do not hinder the process of the OT system.

 

But because these OT architectures run on a separate and isolated infrastructure, until recently they have been traditionally isolated from the Internet. One of the reasons for this is because these systems are often tasked with monitoring and managing the highly sensitive processes associated with critical infrastructure. The other is that these systems can be notoriously delicate. Something as benign as an active system scan can cause these devices to fail. And any failure or compromise can have serious if not catastrophic results.

 

However, new requirements, such as connected power grids, active inventory control, smart environmental control systems, just in time manufacturing, and interactive systems tied to Big Data have begun to change all of that.

 

In addition, companies are looking for productivity improvements and cost savings by implementing such changes as optimizing plant operations, deploying a more flexible operating environment, or establishing a more proactive inventory control system that requires real time online data.  As a result, many of today’s OT systems are transited or tunneled over corporate networks, leverage common internet protocols, run on general-purpose hardware and mainstream operating systems, and are increasingly connected via wireless technologies.

 

These critical infrastructure systems are also increasingly targeted by cybercriminals, with a reported 51% of critical infrastructure enterprises reporting an OT/SCADA/ICS security breach within the past 12 months.

 

As a result, Presidential Policy Directive 21 has established a national policy on critical infrastructure security and resilience for the following sixteen sectors:

 

Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, the Defense Industrial Base, Emergency Services, Energy, Financial Services, Food and Agriculture, Government Facilities, Healthcare and Public Health, Information Technology, Transportation Systems, Water and Wastewater Systems, and Nuclear Reactors, Materials, and Waste.

 

Targeting and taking out a critical infrastructure system has huge appeal for many cybercriminals, especially cyberterrorists or criminal organizations. Motivations include holding systems hostage for a ransom, stock price manipulation (short sell, attack, and reap a “clean” profit), denial of asset or production for strategic or tactical reasons, political awareness or impact, or corporate malfeasance (illegal competitive action).

 

Unfortunately, not only are many of these now-connected systems quite vulnerable to compromise, unlike IT networks, a failure in one of these sectors also has the possibility of causing a catastrophic event affecting both human life and property. The consequences of a successful attack can lead to the disruption, and even destruction of physical assets and essential services like water, electricity, and fuel.

 

As the utility, oil and gas, transportation, and manufacturing sectors increasingly adopt connected control systems and Industrial IoT devices, the CI attack surface is rapidly growing. The connected nature of these devices and systems poses serious challenges as they begin to utilize traditionally IT owned network infrastructure, wireless access points, and mobile networks. At the same time, the specialized nature of OT infrastructure technologies means that most IT security and threat intelligence solutions don’t have visibility into, let alone the ability defend against attacks on critical infrastructures.

 

While securing OT systems requires an integrated approach similar to IT, its objectives are inverted, with availability being the primary requirement, followed by integrity and confidentiality. OT systems are necessarily focused on delivering a particular essential service, such as electricity or water, or maintaining safety systems at chemical plants or dams, and cannot afford to be disrupted even momentarily. Conversely, IT systems are primarily focused on the collection, correlation, and distribution of data, with a primary focus on protecting confidential or personally identifiable information or trade secrets.
Addressing the requirements of an OT network requires an integrated approach comprised of the following elements:

  • Segmentation and Encrypted Communications: Perimeter security alone is inadequate. Security needs to be driven deep into the OT infrastructure, segmenting systems and devices, actively monitoring east-west traffic, and isolating compromised devices. In addition, applications and data should be encrypted in order to prevent the injection of malware into that traffic.
  • Access Control: Access to OT devices needs to be strictly managed and monitored for devices, users, applications, and protocols.
  • Secure Wireless Access: Industrial IoT (IIoT) devices communicate using a wide variety of communications protocols. Securing Wi-Fi connections only solves part of the problem. There are now thousands of vendors building IoT devices using a wide variety of connectivity and communications technologies in addition to Wi-Fi, including Bluetooth, NFC, Zigbee, and RFID. And this doesn’t include IoT devices hardwired into the network behind the firewall. Security resources need to be committed to identifying, segmenting, and securing these connections.
  • Vulnerability and Patch Management: With availability as a primary concern for OT networks and devices, patch management has historically not only been overlooked, but actively avoided. Operators may specifically decide not to patch systems that are operational and cannot afford to be taken offline for an update. But as these devices are connected to the IT network and Internet, this approach can no longer remain the status quo. Cybercriminals target known vulnerabilities, so tracking devices and vulnerabilities and implementing an aggressive patch and replace program is essential. For systems that cannot tolerate any down time, it is critical to deploy redundant, active-active devices, alternate data routes, or strict segmentation and active signature and behavioral-based security to protect unpatchable devices.
  • Behavioral Analytics and tracking: Advanced threats require more than passive security systems, especially when protecting critical infrastructure. Fortunately, the behavior of most OT systems can be pretty easily defined, which means that unusual or aberrant behavior should be likewise relatively easy to detect and block with a UEBA (user and entity behavior analytics) system in place.
  • Ruggedized devices: Traditional OT devices are often required to operate in industrial environments, exposed to extremes in temperature, weather, vibration, and impact. As IT and IoT devices are introduced to this environment, it is critical that organizations select those devices that have been tested and rated to function in extreme settings. The same is true for the security technologies used to protect OT devices and networks.
  • Deep Packet Inspection: Malware is increasingly successful at hiding and obfuscating attacks inside applications and data. Given the sensitive nature of industrial control systems (ICS) and the potential for devastating results should they be compromised, it is essential that organizations implement a combination of signature- and protocol/behavioral-based inspection of traffic traveling to, from, and between OT systems to prevent the abuse of particular industrial protocols. Such an approach is also better suited to the OT environments as it can provide protection critical protections without requiring frequent updates.

 

The transition to hyperconnected networks, such as smart cities and connected utility services, is driving the convergence of IT, OT, and IoT networks. To successfully defend these integrated networks, organizations need an architecture that scales across the entire infrastructure to provide unified visibility and control, distributed segmentation, and integrated protection. Protecting and defending today’s critical infrastructures requires a single, unified approach that integrates security solutions into an interactive Security Fabric capable of adapting to and spanning distributed IT environments, while simultaneously providing the advanced capabilities needed to defend their critical OT infrastructure.


RECOMMENDED ARTICLE FOR TECHWORLD


 
IPC Earns Salesforce Gold Consulting Partner Status
Techworld Date Posted: 14 August 2019 10:18 AM | 300 Views
IPC Earns Salesforce Gold Consulting Partner Status. See More
 
IPC Earns Salesforce Gold Consulting Partner Status
Techworld Date Posted: 10:18 AM | 300 Views
IPC Earns Salesforce Gold Consulting Partner StatusSee More

 
Businesses Most at Risk from New Breed of Ransomware
Techworld Date Posted: 20 September 2017 9:35 AM | 597 Views
While ransomware has long been one of the main cyber threats to businesses, the past number of months have seen organizations more exposed than ever.Symantec's latest research paper on ransomwarehas found that businesses were.... See More
 
Businesses Most at Risk from New Breed of Ransomware
Techworld Date Posted: 9:35 AM | 597 Views
While ransomware has long been one of the main cyber threats to businesses, the past number of months have seen organizations more exposed than ever.Symantec's latest research paper on ransomwarehas found that businesses were...See More

 
Synology® Announces DiskStation DS1618+
Techworld Date Posted: 21 May 2018 4:45 PM | 183 Views
Synology® Inc. today launched DiskStation DS1618+, a 6-bay NAS featuring the Intel Atom® C3538. For tech enthusiasts and small to medium sized businesses, DS1618+ is the perfect all-in-one solution for file serving, application hosting,.... See More
 
Synology® Announces DiskStation DS1618+
Techworld Date Posted: 4:45 PM | 183 Views
Synology® Inc. today launched DiskStation DS1618+, a 6-bay NAS featuring the Intel Atom® C3538. For tech enthusiasts and small to medium sized businesses, DS1618+ is the perfect all-in-one solution for file serving, application hosting,...See More

 
Intensified Financial Hunting by Lazarus Group Marked by Fake Supply Chain Attacks, MacOS Malware
Techworld Date Posted: 28 September 2018 4:04 PM | 582 Views
Kaspersky Lab reveals today that heightened cyberheist activity by the notorious Lazarus group will give rise to more fake supply chain attacks to deliver ever stealthier infections. The cybergang has also been discovered to.... See More
 
Intensified Financial Hunting by Lazarus Group Marked by Fake Supply Chain Attacks, MacOS Malware
Techworld Date Posted: 4:04 PM | 582 Views
Kaspersky Lab reveals today that heightened cyberheist activity by the notorious Lazarus group will give rise to more fake supply chain attacks to deliver ever stealthier infections. The cybergang has also been discovered to...See More

 
Botnet Activity in H1 2018: Multifunctional Bots Becoming More Widespread
Techworld Date Posted: 3 September 2018 5:14 PM | 190 Views
Kaspersky Lab researchers have published a report on botnet activity in the first half of 2018, analyzing more than 150 malware families and their modifications circulating through 600,000 botnets around the world. . See More
 
Botnet Activity in H1 2018: Multifunctional Bots Becoming More Widespread
Techworld Date Posted: 5:14 PM | 190 Views
Kaspersky Lab researchers have published a report on botnet activity in the first half of 2018, analyzing more than 150 malware families and their modifications circulating through 600,000 botnets around the world. See More

PCBG Contributing Writer
Machine Learning AI vs Employee Vigilance
Techworld • By: PCBG Contributing Writer | Date Posted: 1 August 2017 9:43 AM | 257 Views
Here we are again. Man versus machine. On one corner, we have the machine capable of reading huge amounts of data in so little time, and on the other, an employee who knows nothing.... See More
PCBG Contributing Writer
Machine Learning AI vs Employee Vigilance
Techworld • By: PCBG Contributing Writer | Date Posted: 9:43 AM | 257 Views
Here we are again. Man versus machine. On one corner, we have the machine capable of reading huge amounts of data in so little time, and on the other, an employee who knows nothing...See More

 
Be Original, Buy Original
Techworld Date Posted: 12 July 2018 2:04 PM | 498 Views
In line with efforts to bring Nokia fans only the best mobile experience, HMD Global, the home of Nokia phones, warns consumers about counterfeit Nokia phones being sold in physical stores and online shops.. See More
 
Be Original, Buy Original
Techworld Date Posted: 2:04 PM | 498 Views
In line with efforts to bring Nokia fans only the best mobile experience, HMD Global, the home of Nokia phones, warns consumers about counterfeit Nokia phones being sold in physical stores and online shops.See More

 
An Ex with Benefits: A Third of Employees Still Have Access to Files from Former Workplace
Techworld Date Posted: 4 June 2019 2:31 PM | 230 Views
An Ex with Benefits: A Third of Employees Still Have Access to Files from Former Workplace. See More
 
An Ex with Benefits: A Third of Employees Still Have Access to Files from Former Workplace
Techworld Date Posted: 2:31 PM | 230 Views
An Ex with Benefits: A Third of Employees Still Have Access to Files from Former WorkplaceSee More

 
Lenovo Opens First Legion Gaming Store in PH
Techworld Date Posted: 1 March 2019 4:30 PM | 431 Views
Global innovation leader and number one PC developer Lenovo inaugurated its first ‘Legion Concept Store’ in the Philippines as part of its efforts to bring game-changing devices closer to Filipino gamers in the company’s.... See More
 
Lenovo Opens First Legion Gaming Store in PH
Techworld Date Posted: 4:30 PM | 431 Views
Global innovation leader and number one PC developer Lenovo inaugurated its first ‘Legion Concept Store’ in the Philippines as part of its efforts to bring game-changing devices closer to Filipino gamers in the company’s...See More

 
D-Link’s Enhanced Wi-Fi Gigabit Routers, Security Cameras Deliver Improved Connectivity, Security
Techworld Date Posted: 20 March 2018 5:05 PM | 882 Views
Manila, Philippines – D-Link, one of the world’s biggest suppliers of home networking products, matches the growing demand for high-speed connectivity and improved home security with enhanced Wi-Fi gigabit routers and security cameras.. See More
 
D-Link’s Enhanced Wi-Fi Gigabit Routers, Security Cameras Deliver Improved Connectivity, Security
Techworld Date Posted: 5:05 PM | 882 Views
Manila, Philippines – D-Link, one of the world’s biggest suppliers of home networking products, matches the growing demand for high-speed connectivity and improved home security with enhanced Wi-Fi gigabit routers and security cameras.See More


Power by

Download Free AZ | Free Wordpress Themes