Endpoint

7/17/2018
10:30 AM
Peter Newton
Peter Newton
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

SCADA/ICS Dangers & Cybersecurity Strategies

Nearly 60% of surveyed organizations using SCADA or ICS reported they experienced a breach in those systems in the last year. Here are four tips for making these systems safer.

A large number of government agencies and private organizations have SCADA (supervisory control and data acquisition) or industrial control systems (ICS). The benefits of these technologies come with significant security challenges. In a recent survey by Forrester commissioned by Fortinet, nearly six in 10 surveyed organizations using SCADA or ICS indicate that they experienced a breach in those systems in the past year.

Part of the challenge is that these systems are being used to manage not only their traditional OT (operational technology) infrastructures but also a host of new Industrial Internet of Things (IIoT) devices. What's more, many of those organizations are adding to their risk by providing new technologies and partners with a high level of access into their systems. In addition, most organizations now report developing connections between their traditional IT systems and their SCADA/ICS, introducing the potential for outside hackers to penetrate into these control systems.

Rapid Adoption, Access, and Security
Though SCADA/ICS systems were once primarily used by electric and water utilities, many organizations in recent years have begun using these technologies to automate data collection and related equipment. Transparency Market Research predicts the global ICS market alone will grow from $58 billion in 2014 to $81 billion in 2021. Industrial control systems, for example, have become widely used in manufacturing, at seaports, in water treatment plans, in oil pipelines, in energy companies, and in building environmental control systems. At the same time, SCADA systems, which serve as the graphical user interface into ICS, are growing at an annual growth rate of 6.6%.

Consequently, SCADA/ICS technologies and related IIoT devices have become high-value targets for hackers looking to disrupt business operations, collect ransom, or compromise a rival nation's critical infrastructure. Per the Forrester study, while a staggering 56% of organizations using SCADA/ICS reported a breach in the past year, even more astonishing is that only 11% indicate that they have never been breached.

Easy access to SCADA/ICS by third parties is a major part of the problem. Many organizations place a lot of trust in the security of their technology vendors and other outside organizations by giving them wide access to their internal systems. More than six in 10 organizations surveyed by Forrester give either complete or high-level access to partner or government organizations. Thus, SCADA/ICS operators face serious risks, many of their own design.

Threats and Breaches
The Forrester survey asked organizations operating SCADA/ICS about their most serious security threats. More than three-quarters of organizations acknowledge being very or extremely concerned about outside malware. Seven in 10 are very or extremely concerned about internal hackers, the leakage of sensitive data and external hackers.

Not only are SCADA/ICS breaches common, but they also have serious repercussions. Unlike traditional IT networks, OT networks often manage and control systems where a compromise can have potentially devastating consequences. A compromised IoT device that monitors inventory represents a very different threat than an IIoT device monitoring or managing a temperature control system on a 50,000-gallon boiler at a chemical plant.

As a result, 63% of organizations say the safety of their employees was highly or critically affected by a SCADA/ICS security breach. Another 58% report major impacts to their organization's financial stability, and 63% note a serious drag on their ability to operate at a sufficient level.

Addressing Security and Compliance
There are a variety of responses to these security issues. Nearly half of surveyed organizations see a full business or operational risk assessment as the top way to improve their risk posture as OT and IT systems converge. Other common approaches for mitigating risk include implementing common standards, increasing the centralization of device management, and consulting government bodies such as the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Compliance with industry and security standards is another top concern.

Steps Toward Greater Security
SCADA/ICS operators can take several steps to protect their assets, even as they consider what security measures to spend their budget on. These include:

  • Securing the network infrastructure, including switches, routers, wireless networks, and IoT/IIoT devices, as well as appropriately hardening devices by turning off or disabling unused ports and/or features.
  • Segmenting networks by, where possible, separating connected wireless and IoT/IIoT technologies from the SCADA/ICS deployment.
  • Applying identity and access management policies to control and monitor outsiders who may need to access the network, to prevent employees from accessing parts of the network they don't need to access, and to control and manage IoT/IIoT devices being connected to the network.
  • Deploying endpoint protections to IoT and other devices to establish visibility into threats.

Security considerations for SCADA/ICS take on a higher priority than those for traditional IT systems due to the potential impact of an attack on the physical safety of employees, customers, or communities. Because the repercussions of a breach are so potentially serious, the need to remain in compliance is also high. Fortunately, organizations can significantly improve their security posture and thereby reduce their risks by taking a multilayered approach to SCADA/ICS security.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Peter Newton is the Senior Director of Product Marketing for Fortinet. He has more than 15 years of experience in high-tech product management and product marketing. Newton is the product marketing lead for Fortinet's Operational Technology (OT) solution, including ICS & SCADA. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.