We need to change our mindset around cybersecurity.
Manufacturers can’t just flip a switch and turn off its operations, especially when a process runs for years at a time. With that in mind, operators, engineers, and executives have to be able to adjust and work with what is happening out on the plant floor as a part of everyday life.
Add in a digital environment where connectivity abounds, the level of security resiliency needs to escalate to new levels on all fronts. The days of a hard shell exterior not allowing anyone in, has given way to understanding what your system is all about, and being able to see what is going on at all times.
“Cybersecurity should never be the goal, it’s basically the foundation to go through the digital transformation journey,” said Dee Kimata, Director of Cybersecurity Services at Schneider Electric. “We’re seeing more sorts of challenges like cost pressures, pressures to operate more efficiently, and create more output. And with the last year, the need to be able to manage operations remotely. None of those things could be possible without connecting devices. And if you connect devices, then you’re responsible to ensure that you have implemented cybersecurity controls.”
RELATED STORIES
- Best Practices to Reduce Cyber Risk, Improve Digital Resilience
- Podcast: Project Bids and Cybersecurity
- Protecting Non-Critical Infrastructure
- Podcast: Cybersecurity in Non-Critical Industries
- Cybersecurity in the New Normal
- Podcast: Security in the New Normal
- New Ways of Working: Adapting to Reality through Digital Resilience
- 3 Ways to Reduce Insider Cyberattacks on ICS
- IT vs. OT Cybersecurity: Why Process Industries Must Recognize the Important Differences
Enterprise Risk
That could mean thinking about cybersecurity risk in the terms of just enterprise risk in general, not creating individual silos focused on specific areas.
“When you think about that in the context of executive buy-in and board buy-in, your boards and your executive leaders are responsible for managing the risk of the company as a whole,” Kimata said. “They must address cybersecurity risk as they would financial risk or safety or whatever that risk bucket may be. And I think once that shift in mindset happens from the executive level, they understand in order to really benefit from this digital transformation or all of this money that I’m spending to connect devices, I need to take care of cybersecurity.”
“Cybersecurity should never be the goal, it’s basically the foundation to go through the digital transformation journey. We’re seeing more sorts of challenges like cost pressures, pressures to operate more efficiently, and create more output. And with the last year, the need to be able to manage operations remotely. None of those things could be possible without connecting devices. And if you connect devices, then you’re responsible to ensure that you have implemented cybersecurity controls.”
— Dee Kimata
For manufacturing organizations, IT and OT integration is becoming a reality. Nearly half (49 percent) of organizations said IT and OT infrastructure remain tightly integrated while another 45 percent claim there is some integration, according to a report by TrapX Security in partnership with the Enterprise Strategy Group (ESG). This integration will only increase as 77 percent of respondents expect further IT and OT infrastructure convergence in the future.
However, only 41 percent of organizations employ an IT security team with dedicated OT specialists, while 32 percent rely on their IT security team alone to protect OT assets, according to the report. 58 percent use network technology tactics like IP ranges, VLANs, or micro-segmentation to segment IT and OT network traffic. Almost one-quarter (24 percent) of organizations simply use one common network for IT and OT communications, reducing the visibility and response required for OT-focused attacks.
Designing in Cybersecurity
“You have assets on the manufacturing space that have lifecycles of 10, 15, 20, 30 years, so you’re doing some remediation work. But for new systems and new assets, there is the shift toward considering cybersecurity in the development process as opposed to an afterthought,” Kimata said. “And so, I think on a holistic basis, when we think about a project, or when we think about the digital transformation in general, it’s hard to now talk about digital without also thinking through cybersecurity. So, people understand that while incidents in the manufacturing space might not occur as frequently as they do in IT, when they do occur, the impact is much broader. I think that has encouraged companies, organizations, and individual people within the company to start thinking about cybersecurity in the day-to-day.”
With a more holistic approach to cybersecurity, it has to be understood there are different applications for various areas within the entire enterprise.
“At the enterprise level, an investment was made within cybersecurity much sooner or much earlier than in the process or building automation space. You’ll see in the enterprise space, there’s a willingness to spend and address cybersecurity because it’s been going on for longer,” Kimata said. “That being said, I think that with the creation of standards like IEC 62443, you’re seeing a more industrial focus on cybersecurity. With industries such as oil and gas, power generation, among others with distributed control systems as part of their overall environment, there’s the willingness to spend (to protect.) However, the business model for something like building automation systems is slightly different. The systems are less expensive. We need to be able to apply cybersecurity within the context of that business model. You’ll see that the application of security controls is a little bit different and really focuses on network segmentation, and maybe firewalls, instead of approaching cybersecurity, kind of as big, one-time projects that they implement at the beginning of an installation.”
While a united security front is the future for the manufacturing enterprise, targeted attacks are now hitting organizations with more frequency. Just in the last month alone, a brewer, a plastics engineering organization, a jet maker, a boat maker, and a dairy group ended up hit with cyberattacks.
Head on a Swivel
That means companies have to remain vigilant and understand what they have to do to have their feet planted firmly on the ground.
“Over the past 5 to 10 years, we’ve seen lots of standards come out, lots of incidents that are driving action and then numerous different companies that specialize in some element of cybersecurity capability from a software perspective,” Kimata said. “You can understand with all of those triggers, why it might be confusing to figure out where a good starting point is. But when I think about cybersecurity and when I think about the structure of the standards, it’s really critical to start with the foundational controls, which includes patch management, endpoint protection, backup and recovery, authentication and authorization, and then guidance around network segmentation and hardening.”
“In the context of cybersecurity, these capabilities may not seem as exciting, but the benefit and the reason I suggest starting with that, is it actually helps eliminate the majority of the risk and allows to build off of that, to implement solutions that are very popular, like anomaly detection or network monitoring, or these other solutions that have been popping up over the last two to three years.”
Understanding those capabilities and what to do and reaching security levels are all spelled out in industry standards, like IEC 62443.
Standards for Structure
“Standards provide structure for how cybersecurity should be implemented,” Kimata said. “And the beauty of the standards is it gives you kind of a step-by-step framework for implementing cybersecurity controls. When we think about IEC 62443, which is largely recognized as kind of the standard accepted cybersecurity standard globally, it does just that on behalf of any manufacturer. It says, ‘Hey, here’s your starting point’ to reach security assurance level one. And here’s where you can get to best in class security assurance level four.’”
The hardest part is starting and reaching the first plateau at security assurance level one, Kimata said.
“There’s 30 plus requirements, and this is when you’re thinking about security, building out your organization, making changes to your network. It’s those baseline controls like patch management, network segmentation, and hardening. I would recommend that most manufacturing organizations try to at least achieve security assurance level two, which starts to introduce concepts like monitoring, network performance monitoring, and anomaly detection.”
Tips to Remain Resilient
Attacks are going to happen; if that is understood it then becomes a matter of how resilient a company is to fight off an assault.
Dee Kimata, Director of Cybersecurity Services at Schneider Electric gave some tips on how to fight off attacks and remain resilient.
“I would say that the people piece is really important and then the response piece,” Kimata said. “I would say set up a process in which vulnerabilities or incidents or attacks can one, be detected, and then two, once they are detected, the roles and responsibilities for that remediation process are clearly defined so the remediation process or the triage process to determine whether an incident or risk might turn into something that’s exploited. Really make sure there is a team and structure around that. There’s also a technology piece. Event logs and solutions that help with monitoring are really critical. And then the people behind what happens once an alert is made, are also very, very critical.”
“Once the basics are implemented such as patch management, endpoint protection, backup and restore, hardening, network segmentation, all of those that I mentioned, try to automate those as much as possible. And I realize that depending on the manufacturer, full automation cannot happen, but making those control points routine help make the touch point or the time spent on them, it decreases that load.
“The other thing that I would recommend is leveraging shared services. Whether that may be co-locating a couple cybersecurity experts within an internal (security operations center) SOC organization that can manage security and kind of pull their minds together and keep an eye on the security posture in-house, or whether that includes managed services, I think that’s the other critical piece is that continuous monitoring and then having a resource available, should there be an anomaly, those are the two big pieces.
“The other piece that really needs to be understood is the cybersecurity posture for an organization should improve year over year,” Kimata said. “So set realistic goals as far as the cybersecurity control points to implement within a year, and then look to improve, operationalize, automate the controls year over year to build off of that foundation, that way it doesn’t seem overwhelming from a budgetary process or technology standpoint.”
— Gregory Hale
Two heavy attacks in recent times could have ended up avoided if companies stuck with the basics. SolarWinds and WannaCry were avoidable attacks if companies were able to implement patches on a timely basis.
“By doing basic things like patching and hardening and network segmentation, it takes away the bulk of that risk,” Kimata said.
Eliminating a majority of risk and understanding and then advancing from the basics are the beginning of the cybersecurity journey. Like a continuing process, security needs to keep flowing and, if done properly, will be the foundation for a secure digital enterprise.