Industrial Control System Security Is Overlooked

Industrial, manufacturing, and other organizations are in business to manufacture and/or distribute products. These organizations cannot manufacture and/or distribute products without the control systems performing reliably, safely, efficiently, and resiliently. Organizations have been making and distributing products before the advent of IP networks and can continue, though in a less efficient manner, without the IP networks. 

This was demonstrated by Ukraine when the Russians cyber attacked the electric grids in December 2015 and 2016 and the Ukrainians were able to operate the grid without their IP networks. On the other hand, control system cyber security is necessary to ensure the connected control system networks and devices can perform their functions securely so as to support safety and reliability.

Too often, the IT mentality is to focus on data security rather than what is important when control systems are involved, i.e.. safety, reliability and integrity. Real issues occur within cyber security policy-making organizations where operations and engineering support (collectively OT) is not an equal member to the CISO when the focus is Operations, its equipment, and business objectives.  

There is a popular belief that control system cyber security is an issue because of IT/OT convergence. Convergence is an issue, but it is not the fundamental issue for cyber securing control systems.

A greater problem surrounds the place of field devices in the control system architecture. Control systems are composed of field devices with their lower-level networks under the purview of engineering. Internet Protocols (generally Ethernet) and Human-Machine Interfaces (HMI’s) are under the purview of network engineers. All of these engineers collectively are part of OT.

Cyber security technology, training, and forensics exists at the Ethernet layer and OT network specialists consider cyber security part of their job. The same cannot be said at the device and facility equipment level as cyber security technology, training, and forensics currently do not exist at this level and many engineers do not recognize that cyber security is part of their job 

Yet it is lack of the cyber security organizations addressing the Level 0,1 devices that is one of the significant reasons for the broken (or never established) culture gap between IT and OT, e.g.., operations and engineering.

With respect to process sensor cyber security, a respected colleague stated: “I have spent years talking to brick walls and brick heads about the lack of security in field devices. Their response is typically that they are air gapped and that everything is safe and secure. Irrational fantasy at best. I am not alone in this quest, but I am definitely in a minority.” 

Level 0,1 Issues

Process sensors are ubiquitous. A large process facility may have 10-30,000 process sensors, a large ship may have 50-100,000 process sensors, and a large utility-scale solar facility can have millions of process sensors. Level 0,1 devices often are the least understood part of control system cyber security (and are therefore generally ignored), yet they can have some of the most significant impacts.

Process sensor issues have been directly involved in many of the more than 1,300 actual control system cyber incidents to date that have killed people and caused more than $80B in direct damage. Russia, China, and Iran are aware of the cyber security gaps in these devices and in some cases are currently exploiting the lack of sensor authentication.

Process sensors are assumed to be secure, authenticated, and correct. Those assumptions at the very least depart from the IT principle of “zero trust”. Process sensor data are the input to process control, safety systems, OT networks, predictive maintenance programs, historians, etc. Compromising process sensors (or not recognizing sensor deviations) can circumvent cyber security mitigation as well as engineering safeguard protections. However, there is minimal cyber security in the process sensor ecosystem. Worse, there are built-in vulnerabilities that cannot be bypassed. 

Level 0,1 devices are often at the root of the technical and organizational issues as these devices are directly used in safety, control, maintenance, and operations, often with different requirements, different users, and different organizational cultures.

The organizational problem at Level 0,1 is very complex. Furthermore, the organizational problem is different on the user side and vendor side. They manage different problem spaces and have different goals and strategies. I will address the complex organizational issues in a separate blog.

Level 0,1 Standards Gaps

The available standards mostly reflect the divisions in user organizations. For instance, cybersecurity standards (e.g., ISA99) exclude safety while safety standards (e.g., ISA84) do not address the unique issues of cybersecurity (defers to ISA99). Additionally, many device safety manuals don’t mention cyber security and conversely many cyber security manuals don’t mention safety. The ISASecure certification program Component Security Assurance (CSA) focuses on the cyber security of software applications, embedded devices, host devices, and network devices.

To date, there have been no process sensors certified to ISASecure because of the kind of technical gaps listed next:-

Recently, the ISA84.09 working group (the process safety/cyber security group specifically organized to address safety-security as part of an integrated safety lifecycle) performed a thorough review with participation from several industry experts. The review was made of a generic state-of-the-art digital safety (wired) pressure transmitter for conformance to the ISA 62443-4-2 standard, Technical Security Requirements for IACS Components. Pressure transmitters were selected as they are used in basic process control and process safety applications. It is expected that other transmitter types such as differential pressure, temperature, level, flow, as well as other process transmitters will have similar cyber security issues. Many of the review conclusions are also applicable to wireless and analog sensors though they were not explicitly addressed in this assessment as the focus was wired pressure transmitters in safety applications.

There is a prevailing thought that analog sensors cannot be hacked because they are only accessible from close proximity to the sensors. That is not true and has been demonstrated by various security researchers including from Russia using a project called Corsair and demonstrated in the 2016 time frame. There were other similar demonstrations including one from Dr. Juan Lopez, then at the US Air Force Institute of Technology. These existing wired and wireless digital and analog pressure transmitters with their cyber security limitations are expected to continue to be produced and used for at least the next 10-15 years so “Rip and Replace” is not an option.  

The intent of the ISA 84.09 effort was to determine the relative conformance and applicability of the ISA 62443-4-2 Component Specification’s individual security requirements to the legacy (what is being built today as well those already installed in the field) digital safety pressure transmitter ecosystem including the transmitters, host computers, field calibrators, and local sensor networks so as to determine what, if any, compensating measures might be necessary.

The results were that most of the requirements in ISA 62443-4-2, including the fundamental requirements could not be met with some requirements not being applicable to wired-safety transmitters. 

It should be noted that a number of the requirements could be met by the host computers such as secure boot. Selected example cyber security deficiencies in the transmitters include: 

  • Lack of device cyber forensics (no ability to determine what has been changed and by whom).
  • Lack of cyber logging (no ability for long term storage of information as data is overwritten).
  • No capability of implementing AntiVirus.
  • Lack of patching capabilities.
  • Use of insecure communication protocols such as FTP, Modbus, Bluetooth, etc.

This means that compensating controls are necessary and that alternate standards/recommendations are needed to address the legacy devices that will be in use for the next 10-15 years or longer. There are compensating controls that can be developed to meet some, but possibly not all, of the pressure transmitter cyber security deficiencies and this effort is ongoing within the ISA84.09 committee. This work includes continuation of this use case that is part of a broader case study to illustrate practical activities within the overall integrated safety/security lifecycle.

As work continues, it is hoped that some discussions with various manufacturers will help to improve the initial transmitter study, as well as to begin formalizing potential compensating countermeasures. Additional off-shoots expected from this exercise are better guidance for security manuals and their relationship to safety.

Summary

Level 0,1 devices have no cyber security, authentication, or cyber logging. Yet process sensor issues have been directly involved in many of the more than 1,300 actual control system cyber incidents to date that have killed people and caused more than $80B in direct damage.

Russia, China, and Iran are aware of the cyber security gaps in these devices and in some cases are currently exploiting the lack of sensor authentication.

The ISA84.09 review of the ISA 62443-4-2 Component Cyber Security Specification identified that most of the cyber security requirements currently could not be met for a wired safety pressure transmitter. It is hoped that the Level 0,1 devices will be addressed with compensating controls where technology does not exist as they will be in use for the next 10-15 years or longer.

It is also hoped that addressing the artificial divisions in future standards work will result in more secure Level 0,1 device ecosystems. However, until the engineers believe that cyber security of their equipment and networks are important to them and the IT/OT network organizations believe that Level 0,1 devices and the process are important to them, control systems will not be able to be secured to all of our peril.

About The Author:  Joe Weiss is an international authority on cybersecurity, control systems and system security. He is Managing Partner at Applied Control Solutions.                                                

Image: Unsplash

You Might Also Read:

The SolarWinds Hack Can Directly Affect Industrial Control Systems:

 

 

 

« Cybersecurity Mergers And Acquisitions Q1 2021
How Do The Facebook & LinkedIn Data Leaks Impact Their Users? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Rambus Security Division

Rambus Security Division

Rambus Security Division solutions span areas including tamper resistance, content protection, network security, mobile payment, smart ticketing, and trusted provisioning services.

Masergy Communications

Masergy Communications

Masergy delivers hybrid networking, managed security and cloud communication solutions to enterprises around the globe.

Jiransoft

Jiransoft

Jiransoft, a security software company, provides endpoint data protection and personal information protection to business users.

Xcina Consulting (XCL)

Xcina Consulting (XCL)

Xcina Consulting provides high quality business and technology risk assurance and advisory services.

Consortium for Information & Software Quality (CISQ)

Consortium for Information & Software Quality (CISQ)

The mission of CISQ is to develop international standards for software quality and to promote the development and sustainment of secure, reliable, and trustworthy software.

ReconaSense

ReconaSense

ReconaSense helps protect people, assets, buildings and cities with its next-gen access control and converged physical security intelligence platform.

Netlawgic Legal Services

Netlawgic Legal Services

Netlawgic is exclusively focused on delivering cyber law solutions to the industry. We provide our clients with specialized attention and problem solving in all aspects of cyber law.

Dutch Innovation Park

Dutch Innovation Park

Dutch Innovation Park in Zoetermeer is a breeding ground for applied IT solutions in the field of cyber security, e-health, smart mobility and big data.

Adzuna

Adzuna

Adzuna is a search engine for job ads used by over 10 million visitors per month that aims to list every job everywhere, including thousands of vacancies in Cybersecurity.

24By7Security

24By7Security

24By7Security are Cybersecurity & Compliance Specialists with extensive hands on experience helping businesses build a defensive IT Infrastructure against all cyber security threats.

Selectron Systems

Selectron Systems

Selectron offers system solutions for automation in rail vehicles and support in dealing with your railway cyber security challenges.

Data Privacy Office (DPO)

Data Privacy Office (DPO)

Data Privacy Office is a company that specializes in privacy and personal data protection, following the highest standards in its sector.

ClearVector

ClearVector

ClearVector is a leading provider of realtime, identity-driven security for the cloud.

META-Cyber

META-Cyber

META-cyber was founded by engineers with experience in process and control-protection to provide cyber security for industrial infrastructure.

HiddenLayer

HiddenLayer

HiddenLayer is a provider of security solutions for machine learning algorithms, models and the data that power them.

SignalFire

SignalFire

SignalFire invest across both enterprise and consumer sectors at the seed and early growth stages.