Cybersecurity’s Advancing, but Understand Basics

“Generally speaking, it depends on how you define the basics, but if you take a top 20 list of OT cybersecurity controls all based on the NIST security framework and the ISA/IEC 62443 standard that addresses things like USB protections and malware and network protection, and network segmentation, I think you’re going to get 80 percent plus protection,” Cusimano added. “It would really have to be a very well-crafted, very sophisticated attack that would be able to bypass all of those basic layers of defense.”

Understanding the basics often falls into the category of a complicated rat’s nest of comprehending where to start and what is most important area for protection.

OT Security Programs

“We’re seeing more and more companies stand up real OT cybersecurity programs and put people in roles that are responsible for that, named individuals, both at the corporate level and at the site level,” Cusimano said. “The biggest challenge that they have, usually, is they have so many assets. We do a lot in the midstream in oil and gas sectors, and it just can be overwhelming for them to just get handle on what they have, get inventories, get drawings updated, because it’s really hard to protect this stuff if you don’t have it identified. Sure, ICS detection products will do a pretty good job of identifying assets on a network, but it’s a bit of a matter of how you deploy it.

“If you don’t put sensors in the right place, you’re not going to see devices. If there’s devices on unmanaged networks, you’re not going to see those. You can only get so much coverage, I guess, is what I’m trying to say with the automated tools. Particularly, and depending on how you deploy it, we see a lot of companies, because it’s expensive to put sensors everywhere, they’ll usually just put the sensors on, say, the main switch in a facility, and they’ll see high level of north-south traffic coming through the firewall, but they won’t see the east-west traffic because they didn’t deploy sensors,” he said.

In reality, east-west traffic is just as important as north-south.

“Ideally, you’re going to look at traffic going to every control device, but it is costly to do that,” Cusimano said. “Then somebody has to actually look at it.”

People Vital to Process

Through analysis of what the technology brings in and because of work of experienced integrators, it is possible to feel confident in understanding what the user has on its systems.

“We gather lots of different types of data,” Cusimano said. “We don’t guarantee 100 percent, but we do collect a lot of different types of data. Packet capture from the network, switch configs, PC configs, things like that. We correlate all of that. Plus, we typically walk down the facility, so we visually inspect. Again, not 100 percent, but we try to. We are pretty confident in the data we do have. Then we typically produce drawings because even if the client has drawings, they’re not generally up to date.”

The holy grail when it comes to basic cybersecurity is segmentation, which can be grueling, but worth the effort.“Segmentation can be pretty complicated to do it correctly because it can sometimes require that you re-IP devices; give devices a new IP address. We’re working with one client that’s going through that. They made a pretty big acquisition, and all of the OT networks were flat – one IP address range. Their company has standards for how they should segment. So, they’re having to go, facility by facility, and re-IP devices as well. To do that, you have to basically shut down the system. So, it’s not trivial. One of the most common incomplete basics is network segmentation because it’s one of the hardest. It just takes time and resources, and it generally requires going to the field. You can’t do it remotely.”

Cyber PHA

That is also where a Cyber PHA – one of the Cusimano’s hallmarks – comes in. A cybersecurity process hazard analysis, borrowed from the safety world, breaks down for the user where and what their greatest risks are.

“The process, the methodology is pretty consistent, has been for a number of years now. It really tells (the user) once we properly partition the system into zones and conduits, and then we go through and it shows them what are the greatest risks. Where they need to put their resources.

“If they did a cyber PHA up front, it could help figure out, okay, we have 50, 100 facilities around the world, which ones are the most critical to our operations that if there was a cyber incident would cause serious harm to the company? You would look at financial or health and safety or supply chain issues, things like that, and then focus on those instead of just trying to do all controls across all facilities worldwide without any risk-based decision making. Then we can get the list down to 10 we have to do right away. The next 20 facilities we could do the next two or three years. Then there are a few others that are really just some R&D facilities and things like that, but they are not very consequential to the daily business.

Flexibility

“Then even within the facilities, you could also break it down because typically, if it’s manufacturing, there’s going to be different product lines. And so you might be able say these lines or these units are the most critical, so let’s make sure those end up protected. My point is the cyber PHA gives you a lot more flexibility in terms of saying, ‘what’s most critical? Let’s put our resources there. Let’s knock those out.’ It doesn’t mean you never get to the other stuff, but certainly takes care of the basics at the key facilities.”

Part of the basics relies on an equal balance of people, process and technology, but with all the complex, sophisticated and brilliant technology introduced to the market, sometimes people and process end up forgotten. The reality is, though, they are becoming more important than ever.

“There’s no shortage of technology; there’s plenty of technology out there,” Cusimano said. “If I was to say if there is anything that might be out of balance is there is not enough people properly trained and have processes to follow to best apply and manage all that technology. It’s a whole lot easier to buy technology than it is to properly deploy it and train people on it and manage it.

Can’t Buy Basics

“That’s the same reason I see why a lot of these basics foundational cyber controls haven’t been taken care of because the things like monitoring and detection. You can buy that. And that’s where a lot of CISOs went when they first got responsibility for OT,” he said. “They wanted visibility, which makes sense because they realized they had no visibility into their OT network. So, the first thing they wanted to buy and deploy was some OT ICS detection tool, so they could at least get a basic inventory and get a handle on what they had.

“The downside was they spent a lot of money there. And that’s monitoring and detection, which is only one out of those top 20 items,” Cusimano said. So many other basics don’t get taken care of because the spending went toward the technology.”

Looking at purchasing technology, at least from an outside perspective, means everything should end up solved. The issue ends up being people have to use it and they have to understand it and they have to know when to use it. That’s where people and process come in.

“That’s where I think we tend to be behind,” Cusimano said. “Just optimizing the technology we already have. I think that’s important instead of just going out and buying more and more technology. A lot of times we see clients will have two or three different tools and technologies that overlap, but they’re just not really taking proper advantage of what they have.

That all means understanding the basics to cybersecurity.

Top 20 list of OT Cybersecurity policies and practices:

1. Access Control
2. Asset Management
3. Training & Screening
4. Backup & Recovery
5. Data Security
6. Endpoint Protection
7. Incident Response
8. Change Management
9. Malware Prevention
10. Network Segmentation
11. Patch Management
12. Physical Security
13. Removeable Media
14. Risk Management
15. Secure Remote Access
16. Security Monitoring
17. System Hardening
18. Supply Chain management
19. Vulnerability Management
20. Wireless Communications