Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

4/13/2017
02:00 PM
Jeff Lund
Jeff Lund
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Got an Industrial Network? Reduce your Risk of a Cyberattack with Defense in Depth

If an aggressive, all-out cyberdefense strategy isn't already on your operational technology plan for 2017, it's time to get busy.

Designing and building the kind of mission-critical cyber protection systems needed in today’s vulnerable industrial environments are, in many ways, similar to the ways castles were designed and built in medieval times.

Barriers to entry were placed from the perimeter all the way into the core of the castle to stop invaders and give those inside the castle walls time to protect what needed to be protected. Moats, drawbridges, and iron gates all presented obstacles to anyone trying to breach the walls and entry points with malicious intent.

The modern-day equivalent of a fortress is known as the “defense in depth” model. The model is based on multiple, overlapping layers of protection for critical infrastructure.

Defining policies and procedures based on an integrated view of physical, network, computer, and device security, defense in depth is the best way to manage both external and internal threats. The model draws on three concepts to ensure fast detection, isolation, and control, ultimately limiting the impact of an error or breach, regardless of where or how it happens:

1.  Multiple layers of defense: If one is bypassed, another layer is able to provide defense. 

2.  Differentiated layers of defense: If an attacker finds a way past the first layer, they can’t get past all the subsequent defenses, since each layer is slightly different than the one before it.

3.  Threat-specific layers of defense: Designed for specific risks and vulnerabilities, these solutions defend against a variety of security threats the control system is exposed to, such as computer malware, angry employees, denial-of-service (DoS) attacks, and information theft.

[Check out the two-day Dark Reading Cybersecurity Crash Course at Interop ITX, May 15 & 16, where Dark Reading editors and some of the industry's top cybersecurity experts will share the latest data security trends and best practices.]

In light of the escalating frequency of hacking events, it might seem necessary to lock everything down and throw away the keys. But business still has to be done. Before you begin investing in hardware, software, and training, look at your operations and identify the critical assets, vulnerabilities, and risks presented by a cyberattack. Understand how communication flows across the organization, both internally and externally. Identify the functions that are most critical to ensuring that business gets done, and what the tolerance in those areas is for downtime. Set priorities and then move on to executing your plan. And, lastly, understand how improving your cybersecurity posture can not only make it more secure but also make it more reliable and robust.

Firewalls & Defense in Depth
Implementing a defense in depth strategy requires a combination of tools and techniques that support the vision of a layered approach to protection. Five categories of security offer the comprehensive defense needed to significantly reduce the risk of a breach, as well as mitigate the impact of a breach should one occur. These include:

1.  Preventative security: Intended to prevent incidents from occurring and reduce the number and type of risks and vulnerabilities. Examples include strong password policies and disabling unused ports on switches to prevent access from unauthorized devices.

2.  Network design security: Minimizes vulnerabilities and isolates them so an attack doesn’t affect other parts of the network. A “zones and conduits” method can help limit the number of connections between network zones, lowering the risk of an attack spreading across the network.

3.  Active security: Active measures and devices block traffic or operations that aren’t allowed or expected on a network. Examples include encryption, protocol-specific deep packet inspection, Layer 3 firewalls, and antivirus use.

4.  Detective security: Identifies an incident in progress, or after it occurs, by evaluating activity registers and logs, including log file analysis and intrusion detection system monitoring.

5. Corrective security: Aims to limit the extent of any damage caused by an incident, such as configuration parameter backup policy, and firewall and antivirus updates.

Firewalls are an especially important and common tool for ensuring network security in an industrial environment, as they can play various roles in partitioning networks and protecting against outside threats and propagation of internal errors. Firewalls do this by permitting only certain types of communication between devices to protect against malicious attacks and device or operator errors. On a technical level, a firewall’s function is to filter packets. After inspecting each packet to determine whether it corresponds to an approved traffic pattern, firewalls filter or forward packets that match these rules.

Different kinds of firewalls offer different levels of packet filtering. Stateless firewalls determine the individual devices or applications with which they can communicate, while stateful firewalls monitor the communication process and use recorded information, such as the initiation or termination of the connection, as an additional decision metric for packet filtering. Deep packet inspection firewalls, an extension of stateful packet inspection, examine the full packet to find malformed industrial control system (ICS) messages, or highly specialized attack patterns hidden deep within the communication flow.

It’s also important to categorize and consider firewalls based on network location. Firewalls in a wide local area network (WLAN) restrict the forwarding of messages between WLAN clients at the WLAN access point to increase the overall security of the network. Those at the field level address threats that may lie within the network, and firewalls in a small cell or external site control the flow of network traffic going in and out of the external site’s local network. This creates a border between the company’s own network and an external network, such as the Internet.

Daily headlines remind us of the intensity of cyberattacks. Ignoring this business reality isn’t an option. For industrial operations, understanding the role firewalls play in a network security strategy and moving quickly to deploy the multi-layered approach afforded by defense in depth can mean the difference between investing millions to recover from the impact of breach on uptime, or the business continuity needed to serve customers and shareholders.

Editor’s Note: Tobias Heer and Oliver Kleineberg also contributed to this column. Tobias has been with Belden since 2012 and specializes in topics that revolve around security and wireless in industrial control systems. Oliver joined Belden in 2007, and is responsible for advance development within Belden’s Industrial IT platform.

Related Content:

 

Jeff Lund is a senior director of product line management in Belden's industrial IT group. He is responsible for Belden's vision and product initiatives related to the industrial Internet of Things, as well as for coordinating and driving cybersecurity and wireless product ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15943
PUBLISHED: 2019-09-19
vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a memset call.
CVE-2019-16413
PUBLISHED: 2019-09-19
An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems.
CVE-2019-3738
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVE-2019-3739
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVE-2019-3740
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.