theDocumentId => 1341231 Cars, Medicine, Electric Grids: Future Hackers Will ...

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
6/16/2021
03:00 PM
Greg Valentine
Greg Valentine
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Cars, Medicine, Electric Grids: Future Hackers Will Hit Much More Than Networks in an IT/OT Integrated World

Intelligent systems must include the right cybersecurity protections to prevent physical threats to operational technology.

For the first two decades of the Internet era, operational technology (OT) in places like factories and power plants remained mostly isolated from IT systems. While the fear of cyber intrusions grew among their counterparts in IT, workers in these physical settings were far more focused on safety precautions to protect people from the machines, products, and chemicals within those spaces.

Related Content:

The US Must Redefine Critical Infrastructure for the Digital Era

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: How Can I Test the Security of My Home-Office Employees' Routers?

But in the past decade, the business case for connecting computerized OT systems with the IT systems running the business has become so compelling that companies are rushing to create links between the two. Through these links, IT is now regularly connected to and communicating with the operational infrastructure. Leveraging technology in this way has led to full-scale digital transformation within the OT environment, improving efficiencies, automating processes, and extracting data insights. Cars today have enough software built into them that you almost forget about the steel. Pharmaceutical companies are now regularly using smart manufacturing, intelligent factories, and IIoT (Industrial Internet of Things) to create new drugs in record time. The electric grid is running with smart metering technology to identify warning signs of potential outages before the lights actually go out.

While increasing connectivity to OT systems can save an organization millions of dollars, the savings can pale in comparison to the cost of a cybersecurity breach — from brand reputation damage to the potential harm from a physical threat — as we recently saw with the US pipeline shutdown due to a ransomware attack. If such connectivity is not carefully managed, hackers who infiltrate the IT network may gain access into OT — at which point they can do everything from disrupting the operation of a specific tool or machine, to causing an explosion or poisoning a water supply. As we have seen in publicly reported cases, successful OT cyberattacks can shut businesses down for days or weeks, causing widespread impacts across an organization's ecosystem of suppliers and customers.

The more we digitally transform and interconnect systems, the more the cybersecurity of those digital systems becomes essential to reducing physical risk. Here are some techniques organizations can use to prevent, detect, and respond to OT cyberattacks.

Preventing Attacks Against OT Systems
In an ideal world, the best defense against a cyberattack on OT is to prevent the hack from happening in the first place. For an OT environment, preventative controls include leveraging identity and access management (IAM), practicing a zero-trust architecture, utilizing a vulnerability management solution, and properly segmenting the network. All can stop an attacker at the door.

  • IAM enables you to not only identify your OT users, devices and programs, but also to control their access within the network.

  • Vulnerability management identifies which aspects of your OT environment are insecure so that you can address those vulnerabilities through patching, isolation, monitoring, or other compensating controls. This can now be safely done in an OT site.

  • Network segmentation makes it more difficult for attackers to move laterally, giving you the opportunity to contain outbreaks and limit the amount of damage they cause. Proper network segmentation can reduce the impact of a breach such as a ransomware attack.

All these techniques fall under the overarching umbrella of zero trust, with a goal of placing obstacles and barriers along every step the attacker will have to take.

Detecting Early Warning Signs of OT Cyberattacks
While a good zero-trust architecture will slow them down, determined attackers will methodically work to defeat your cyber defenses. Detection is key to catching the early signs of a cyberattack before it causes significant impact, destruction, or data theft. To perform such detection within your OT environment, you will need the same type of monitoring that many organizations have established in their IT systems over the past decade. The monitoring should be continuous and designed to identify potentially suspicious or malicious activity. On the factory or plant floor, monitoring should detect malfunctions in production lines, equipment, or connected devices. It's important for organizations to teach IT and OT team members how to recognize warning signs of a potential breach, so an investigation can take place quickly to address the threat.

Responding to OT Network Breaches
When an attacker finds his or her way into your OT systems and devices, your organization must be prepared to respond swiftly and decisively. Your incident-response plan should be activated to locate the intruder, cut them off from doing further damage, and push them back out to wherever it was they came from. It also should swiftly remediate any damage caused by the attack, including resetting the configurations of affected equipment, reimaging affected computers, and recertifying the effectiveness of safety systems.

Within OT environments, incident response must focus on safety first, so that people and property are protected while the business works to resume normal operations as quickly as possible. For organizations delivering healthcare or public utility services, not only must the safety of the organization's personnel be considered but also the safety of the community and other people within the organization's areas of service.

Moving Toward a Culture of OT Cyber Safety
With the increasing connectivity among operations systems, OT networks, and IT environments, employees across all roles and departments have an increasing role to play in protecting those systems from invisible cyber threats. Whether this technology is in a car, an electrical grid, or behind a life-saving drug or vaccine, such connectivity is critical to the future of an organization's development, production, and performance.

Most operations organizations — whether in manufacturing, healthcare, utilities, or critical infrastructure — already have a culture of safety in place. By protecting OT environments from cyber threats, organizations can extend their cultures of safety to include cyber safety, as well.

A seasoned professional with 20+ years of experience, Greg serves as a Senior Cybersecurity Director in the NA Cyber Center Of Excellence, leading a team of SMEs and SAs that focus on various areas of cybersecurity like OT/IoT, Insider Risk, IAM, and Cybersecurity ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32794
PUBLISHED: 2021-07-26
ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` ASF API endpoint responsible for updating global ASF config incorrectly removed `IPCPassword` from the resulting config when the caller did no...
CVE-2021-36563
PUBLISHED: 2021-07-26
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts), the XSS pay...
CVE-2021-37392
PUBLISHED: 2021-07-26
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected use...
CVE-2021-37393
PUBLISHED: 2021-07-26
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user...
CVE-2021-37394
PUBLISHED: 2021-07-26
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.