Industrial Control System Security Is Overlooked

Industrial, manufacturing, and other organizations are in business to manufacture and/or distribute products. These organizations cannot manufacture and/or distribute products without the control systems performing reliably, safely, efficiently, and resiliently. Organizations have been making and distributing products before the advent of IP networks and can continue, though in a less efficient manner, without the IP networks. 

This was demonstrated by Ukraine when the Russians cyber attacked the electric grids in December 2015 and 2016 and the Ukrainians were able to operate the grid without their IP networks. On the other hand, control system cyber security is necessary to ensure the connected control system networks and devices can perform their functions securely so as to support safety and reliability.

Too often, the IT mentality is to focus on data security rather than what is important when control systems are involved, i.e.. safety, reliability and integrity. Real issues occur within cyber security policy-making organizations where operations and engineering support (collectively OT) is not an equal member to the CISO when the focus is Operations, its equipment, and business objectives.  

There is a popular belief that control system cyber security is an issue because of IT/OT convergence. Convergence is an issue, but it is not the fundamental issue for cyber securing control systems.

A greater problem surrounds the place of field devices in the control system architecture. Control systems are composed of field devices with their lower-level networks under the purview of engineering. Internet Protocols (generally Ethernet) and Human-Machine Interfaces (HMI’s) are under the purview of network engineers. All of these engineers collectively are part of OT.

Cyber security technology, training, and forensics exists at the Ethernet layer and OT network specialists consider cyber security part of their job. The same cannot be said at the device and facility equipment level as cyber security technology, training, and forensics currently do not exist at this level and many engineers do not recognize that cyber security is part of their job 

Yet it is lack of the cyber security organizations addressing the Level 0,1 devices that is one of the significant reasons for the broken (or never established) culture gap between IT and OT, e.g.., operations and engineering.

With respect to process sensor cyber security, a respected colleague stated: “I have spent years talking to brick walls and brick heads about the lack of security in field devices. Their response is typically that they are air gapped and that everything is safe and secure. Irrational fantasy at best. I am not alone in this quest, but I am definitely in a minority.” 

Level 0,1 Issues

Process sensors are ubiquitous. A large process facility may have 10-30,000 process sensors, a large ship may have 50-100,000 process sensors, and a large utility-scale solar facility can have millions of process sensors. Level 0,1 devices often are the least understood part of control system cyber security (and are therefore generally ignored), yet they can have some of the most significant impacts.

Process sensor issues have been directly involved in many of the more than 1,300 actual control system cyber incidents to date that have killed people and caused more than $80B in direct damage. Russia, China, and Iran are aware of the cyber security gaps in these devices and in some cases are currently exploiting the lack of sensor authentication.

Process sensors are assumed to be secure, authenticated, and correct. Those assumptions at the very least depart from the IT principle of “zero trust”. Process sensor data are the input to process control, safety systems, OT networks, predictive maintenance programs, historians, etc. Compromising process sensors (or not recognizing sensor deviations) can circumvent cyber security mitigation as well as engineering safeguard protections. However, there is minimal cyber security in the process sensor ecosystem. Worse, there are built-in vulnerabilities that cannot be bypassed. 

Level 0,1 devices are often at the root of the technical and organizational issues as these devices are directly used in safety, control, maintenance, and operations, often with different requirements, different users, and different organizational cultures.

The organizational problem at Level 0,1 is very complex. Furthermore, the organizational problem is different on the user side and vendor side. They manage different problem spaces and have different goals and strategies. I will address the complex organizational issues in a separate blog.

Level 0,1 Standards Gaps

The available standards mostly reflect the divisions in user organizations. For instance, cybersecurity standards (e.g., ISA99) exclude safety while safety standards (e.g., ISA84) do not address the unique issues of cybersecurity (defers to ISA99). Additionally, many device safety manuals don’t mention cyber security and conversely many cyber security manuals don’t mention safety. The ISASecure certification program Component Security Assurance (CSA) focuses on the cyber security of software applications, embedded devices, host devices, and network devices.

To date, there have been no process sensors certified to ISASecure because of the kind of technical gaps listed next:-

Recently, the ISA84.09 working group (the process safety/cyber security group specifically organized to address safety-security as part of an integrated safety lifecycle) performed a thorough review with participation from several industry experts. The review was made of a generic state-of-the-art digital safety (wired) pressure transmitter for conformance to the ISA 62443-4-2 standard, Technical Security Requirements for IACS Components. Pressure transmitters were selected as they are used in basic process control and process safety applications. It is expected that other transmitter types such as differential pressure, temperature, level, flow, as well as other process transmitters will have similar cyber security issues. Many of the review conclusions are also applicable to wireless and analog sensors though they were not explicitly addressed in this assessment as the focus was wired pressure transmitters in safety applications.

There is a prevailing thought that analog sensors cannot be hacked because they are only accessible from close proximity to the sensors. That is not true and has been demonstrated by various security researchers including from Russia using a project called Corsair and demonstrated in the 2016 time frame. There were other similar demonstrations including one from Dr. Juan Lopez, then at the US Air Force Institute of Technology. These existing wired and wireless digital and analog pressure transmitters with their cyber security limitations are expected to continue to be produced and used for at least the next 10-15 years so “Rip and Replace” is not an option.  

The intent of the ISA 84.09 effort was to determine the relative conformance and applicability of the ISA 62443-4-2 Component Specification’s individual security requirements to the legacy (what is being built today as well those already installed in the field) digital safety pressure transmitter ecosystem including the transmitters, host computers, field calibrators, and local sensor networks so as to determine what, if any, compensating measures might be necessary.

The results were that most of the requirements in ISA 62443-4-2, including the fundamental requirements could not be met with some requirements not being applicable to wired-safety transmitters. 

It should be noted that a number of the requirements could be met by the host computers such as secure boot. Selected example cyber security deficiencies in the transmitters include: 

  • Lack of device cyber forensics (no ability to determine what has been changed and by whom).
  • Lack of cyber logging (no ability for long term storage of information as data is overwritten).
  • No capability of implementing AntiVirus.
  • Lack of patching capabilities.
  • Use of insecure communication protocols such as FTP, Modbus, Bluetooth, etc.

This means that compensating controls are necessary and that alternate standards/recommendations are needed to address the legacy devices that will be in use for the next 10-15 years or longer. There are compensating controls that can be developed to meet some, but possibly not all, of the pressure transmitter cyber security deficiencies and this effort is ongoing within the ISA84.09 committee. This work includes continuation of this use case that is part of a broader case study to illustrate practical activities within the overall integrated safety/security lifecycle.

As work continues, it is hoped that some discussions with various manufacturers will help to improve the initial transmitter study, as well as to begin formalizing potential compensating countermeasures. Additional off-shoots expected from this exercise are better guidance for security manuals and their relationship to safety.

Summary

Level 0,1 devices have no cyber security, authentication, or cyber logging. Yet process sensor issues have been directly involved in many of the more than 1,300 actual control system cyber incidents to date that have killed people and caused more than $80B in direct damage.

Russia, China, and Iran are aware of the cyber security gaps in these devices and in some cases are currently exploiting the lack of sensor authentication.

The ISA84.09 review of the ISA 62443-4-2 Component Cyber Security Specification identified that most of the cyber security requirements currently could not be met for a wired safety pressure transmitter. It is hoped that the Level 0,1 devices will be addressed with compensating controls where technology does not exist as they will be in use for the next 10-15 years or longer.

It is also hoped that addressing the artificial divisions in future standards work will result in more secure Level 0,1 device ecosystems. However, until the engineers believe that cyber security of their equipment and networks are important to them and the IT/OT network organizations believe that Level 0,1 devices and the process are important to them, control systems will not be able to be secured to all of our peril.

About The Author:  Joe Weiss is an international authority on cybersecurity, control systems and system security. He is Managing Partner at Applied Control Solutions.                                                

Image: Unsplash

You Might Also Read:

The SolarWinds Hack Can Directly Affect Industrial Control Systems:

 

 

 

« Cybersecurity Mergers And Acquisitions Q1 2021
How Do The Facebook & LinkedIn Data Leaks Impact Their Users? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Free Access: Cyber Security Supplier Directory listing 5,000+ specialist service providers.

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

AWS Marketplace eBook: Optimizing your cloud deployments to accelerate cloud activities, reduce costs, and improve customer experience.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

APMG International (APM Group)

APMG International (APM Group)

APM Group is a global accreditation, certification and examination body specializing in certification schemes for individuals, organizations and software.

CIO

CIO

CIO provides technology and business leaders with insight and analysis on information technology trends

IP Performance

IP Performance

IP Performance Limited is a leading supplier of customised network infrastructure and security solutions.

Aptible

Aptible

Security Management and Compliance for Developers. Aptible helps teams pass information security audits and deploy audit-ready apps and databases.

Synelixis Solutions

Synelixis Solutions

Synelixis Solutions is a high-tech company founded to provide complete telecommunications, networking, security, control and automation solutions.

Advens

Advens

Advens is a company specializing in information security management. We provide Consultancy, Security Audits and Technology Solutions.

SBD Automotive

SBD Automotive

SBD Automotive are specialists in automotive technology providing independent research and consultancy to help create smarter, more secure, better connected, and increasingly autonomous cars.

FPT Software

FPT Software

As a leading technology service provider, FPT assists customers of all sizes and from any industries in implementing and adapting digital technologies including cybersecurity.