Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

7/17/2018
10:30 AM
Peter Newton
Peter Newton
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

SCADA/ICS Dangers & Cybersecurity Strategies

Nearly 60% of surveyed organizations using SCADA or ICS reported they experienced a breach in those systems in the last year. Here are four tips for making these systems safer.

A large number of government agencies and private organizations have SCADA (supervisory control and data acquisition) or industrial control systems (ICS). The benefits of these technologies come with significant security challenges. In a recent survey by Forrester commissioned by Fortinet, nearly six in 10 surveyed organizations using SCADA or ICS indicate that they experienced a breach in those systems in the past year.

Part of the challenge is that these systems are being used to manage not only their traditional OT (operational technology) infrastructures but also a host of new Industrial Internet of Things (IIoT) devices. What's more, many of those organizations are adding to their risk by providing new technologies and partners with a high level of access into their systems. In addition, most organizations now report developing connections between their traditional IT systems and their SCADA/ICS, introducing the potential for outside hackers to penetrate into these control systems.

Rapid Adoption, Access, and Security
Though SCADA/ICS systems were once primarily used by electric and water utilities, many organizations in recent years have begun using these technologies to automate data collection and related equipment. Transparency Market Research predicts the global ICS market alone will grow from $58 billion in 2014 to $81 billion in 2021. Industrial control systems, for example, have become widely used in manufacturing, at seaports, in water treatment plans, in oil pipelines, in energy companies, and in building environmental control systems. At the same time, SCADA systems, which serve as the graphical user interface into ICS, are growing at an annual growth rate of 6.6%.

Consequently, SCADA/ICS technologies and related IIoT devices have become high-value targets for hackers looking to disrupt business operations, collect ransom, or compromise a rival nation's critical infrastructure. Per the Forrester study, while a staggering 56% of organizations using SCADA/ICS reported a breach in the past year, even more astonishing is that only 11% indicate that they have never been breached.

Easy access to SCADA/ICS by third parties is a major part of the problem. Many organizations place a lot of trust in the security of their technology vendors and other outside organizations by giving them wide access to their internal systems. More than six in 10 organizations surveyed by Forrester give either complete or high-level access to partner or government organizations. Thus, SCADA/ICS operators face serious risks, many of their own design.

Threats and Breaches
The Forrester survey asked organizations operating SCADA/ICS about their most serious security threats. More than three-quarters of organizations acknowledge being very or extremely concerned about outside malware. Seven in 10 are very or extremely concerned about internal hackers, the leakage of sensitive data and external hackers.

Not only are SCADA/ICS breaches common, but they also have serious repercussions. Unlike traditional IT networks, OT networks often manage and control systems where a compromise can have potentially devastating consequences. A compromised IoT device that monitors inventory represents a very different threat than an IIoT device monitoring or managing a temperature control system on a 50,000-gallon boiler at a chemical plant.

As a result, 63% of organizations say the safety of their employees was highly or critically affected by a SCADA/ICS security breach. Another 58% report major impacts to their organization's financial stability, and 63% note a serious drag on their ability to operate at a sufficient level.

Addressing Security and Compliance
There are a variety of responses to these security issues. Nearly half of surveyed organizations see a full business or operational risk assessment as the top way to improve their risk posture as OT and IT systems converge. Other common approaches for mitigating risk include implementing common standards, increasing the centralization of device management, and consulting government bodies such as the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Compliance with industry and security standards is another top concern.

Steps Toward Greater Security
SCADA/ICS operators can take several steps to protect their assets, even as they consider what security measures to spend their budget on. These include:

  • Securing the network infrastructure, including switches, routers, wireless networks, and IoT/IIoT devices, as well as appropriately hardening devices by turning off or disabling unused ports and/or features.
  • Segmenting networks by, where possible, separating connected wireless and IoT/IIoT technologies from the SCADA/ICS deployment.
  • Applying identity and access management policies to control and monitor outsiders who may need to access the network, to prevent employees from accessing parts of the network they don't need to access, and to control and manage IoT/IIoT devices being connected to the network.
  • Deploying endpoint protections to IoT and other devices to establish visibility into threats.

Security considerations for SCADA/ICS take on a higher priority than those for traditional IT systems due to the potential impact of an attack on the physical safety of employees, customers, or communities. Because the repercussions of a breach are so potentially serious, the need to remain in compliance is also high. Fortunately, organizations can significantly improve their security posture and thereby reduce their risks by taking a multilayered approach to SCADA/ICS security.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Peter Newton is the Senior Director of Product Marketing for Fortinet. He has more than 15 years of experience in high-tech product management and product marketing. Newton is the product marketing lead for Fortinet's Operational Technology (OT) solution, including ICS & SCADA. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The security team seem to be taking SiegeWare seriously" 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1114
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
CVE-2012-1115
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.
CVE-2012-1592
PUBLISHED: 2019-12-05
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
CVE-2019-16770
PUBLISHED: 2019-12-05
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
CVE-2019-19609
PUBLISHED: 2019-12-05
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.