Industrial Control System Security Is Overlooked

Industrial, manufacturing, and other organizations are in business to manufacture and/or distribute products. These organizations cannot manufacture and/or distribute products without the control systems performing reliably, safely, efficiently, and resiliently. Organizations have been making and distributing products before the advent of IP networks and can continue, though in a less efficient manner, without the IP networks. 

This was demonstrated by Ukraine when the Russians cyber attacked the electric grids in December 2015 and 2016 and the Ukrainians were able to operate the grid without their IP networks. On the other hand, control system cyber security is necessary to ensure the connected control system networks and devices can perform their functions securely so as to support safety and reliability.

Too often, the IT mentality is to focus on data security rather than what is important when control systems are involved, i.e.. safety, reliability and integrity. Real issues occur within cyber security policy-making organizations where operations and engineering support (collectively OT) is not an equal member to the CISO when the focus is Operations, its equipment, and business objectives.  

There is a popular belief that control system cyber security is an issue because of IT/OT convergence. Convergence is an issue, but it is not the fundamental issue for cyber securing control systems.

A greater problem surrounds the place of field devices in the control system architecture. Control systems are composed of field devices with their lower-level networks under the purview of engineering. Internet Protocols (generally Ethernet) and Human-Machine Interfaces (HMI’s) are under the purview of network engineers. All of these engineers collectively are part of OT.

Cyber security technology, training, and forensics exists at the Ethernet layer and OT network specialists consider cyber security part of their job. The same cannot be said at the device and facility equipment level as cyber security technology, training, and forensics currently do not exist at this level and many engineers do not recognize that cyber security is part of their job 

Yet it is lack of the cyber security organizations addressing the Level 0,1 devices that is one of the significant reasons for the broken (or never established) culture gap between IT and OT, e.g.., operations and engineering.

With respect to process sensor cyber security, a respected colleague stated: “I have spent years talking to brick walls and brick heads about the lack of security in field devices. Their response is typically that they are air gapped and that everything is safe and secure. Irrational fantasy at best. I am not alone in this quest, but I am definitely in a minority.” 

Level 0,1 Issues

Process sensors are ubiquitous. A large process facility may have 10-30,000 process sensors, a large ship may have 50-100,000 process sensors, and a large utility-scale solar facility can have millions of process sensors. Level 0,1 devices often are the least understood part of control system cyber security (and are therefore generally ignored), yet they can have some of the most significant impacts.

Process sensor issues have been directly involved in many of the more than 1,300 actual control system cyber incidents to date that have killed people and caused more than $80B in direct damage. Russia, China, and Iran are aware of the cyber security gaps in these devices and in some cases are currently exploiting the lack of sensor authentication.

Process sensors are assumed to be secure, authenticated, and correct. Those assumptions at the very least depart from the IT principle of “zero trust”. Process sensor data are the input to process control, safety systems, OT networks, predictive maintenance programs, historians, etc. Compromising process sensors (or not recognizing sensor deviations) can circumvent cyber security mitigation as well as engineering safeguard protections. However, there is minimal cyber security in the process sensor ecosystem. Worse, there are built-in vulnerabilities that cannot be bypassed. 

Level 0,1 devices are often at the root of the technical and organizational issues as these devices are directly used in safety, control, maintenance, and operations, often with different requirements, different users, and different organizational cultures.

The organizational problem at Level 0,1 is very complex. Furthermore, the organizational problem is different on the user side and vendor side. They manage different problem spaces and have different goals and strategies. I will address the complex organizational issues in a separate blog.

Level 0,1 Standards Gaps

The available standards mostly reflect the divisions in user organizations. For instance, cybersecurity standards (e.g., ISA99) exclude safety while safety standards (e.g., ISA84) do not address the unique issues of cybersecurity (defers to ISA99). Additionally, many device safety manuals don’t mention cyber security and conversely many cyber security manuals don’t mention safety. The ISASecure certification program Component Security Assurance (CSA) focuses on the cyber security of software applications, embedded devices, host devices, and network devices.

To date, there have been no process sensors certified to ISASecure because of the kind of technical gaps listed next:-

Recently, the ISA84.09 working group (the process safety/cyber security group specifically organized to address safety-security as part of an integrated safety lifecycle) performed a thorough review with participation from several industry experts. The review was made of a generic state-of-the-art digital safety (wired) pressure transmitter for conformance to the ISA 62443-4-2 standard, Technical Security Requirements for IACS Components. Pressure transmitters were selected as they are used in basic process control and process safety applications. It is expected that other transmitter types such as differential pressure, temperature, level, flow, as well as other process transmitters will have similar cyber security issues. Many of the review conclusions are also applicable to wireless and analog sensors though they were not explicitly addressed in this assessment as the focus was wired pressure transmitters in safety applications.

There is a prevailing thought that analog sensors cannot be hacked because they are only accessible from close proximity to the sensors. That is not true and has been demonstrated by various security researchers including from Russia using a project called Corsair and demonstrated in the 2016 time frame. There were other similar demonstrations including one from Dr. Juan Lopez, then at the US Air Force Institute of Technology. These existing wired and wireless digital and analog pressure transmitters with their cyber security limitations are expected to continue to be produced and used for at least the next 10-15 years so “Rip and Replace” is not an option.  

The intent of the ISA 84.09 effort was to determine the relative conformance and applicability of the ISA 62443-4-2 Component Specification’s individual security requirements to the legacy (what is being built today as well those already installed in the field) digital safety pressure transmitter ecosystem including the transmitters, host computers, field calibrators, and local sensor networks so as to determine what, if any, compensating measures might be necessary.

The results were that most of the requirements in ISA 62443-4-2, including the fundamental requirements could not be met with some requirements not being applicable to wired-safety transmitters. 

It should be noted that a number of the requirements could be met by the host computers such as secure boot. Selected example cyber security deficiencies in the transmitters include: 

  • Lack of device cyber forensics (no ability to determine what has been changed and by whom).
  • Lack of cyber logging (no ability for long term storage of information as data is overwritten).
  • No capability of implementing AntiVirus.
  • Lack of patching capabilities.
  • Use of insecure communication protocols such as FTP, Modbus, Bluetooth, etc.

This means that compensating controls are necessary and that alternate standards/recommendations are needed to address the legacy devices that will be in use for the next 10-15 years or longer. There are compensating controls that can be developed to meet some, but possibly not all, of the pressure transmitter cyber security deficiencies and this effort is ongoing within the ISA84.09 committee. This work includes continuation of this use case that is part of a broader case study to illustrate practical activities within the overall integrated safety/security lifecycle.

As work continues, it is hoped that some discussions with various manufacturers will help to improve the initial transmitter study, as well as to begin formalizing potential compensating countermeasures. Additional off-shoots expected from this exercise are better guidance for security manuals and their relationship to safety.

Summary

Level 0,1 devices have no cyber security, authentication, or cyber logging. Yet process sensor issues have been directly involved in many of the more than 1,300 actual control system cyber incidents to date that have killed people and caused more than $80B in direct damage.

Russia, China, and Iran are aware of the cyber security gaps in these devices and in some cases are currently exploiting the lack of sensor authentication.

The ISA84.09 review of the ISA 62443-4-2 Component Cyber Security Specification identified that most of the cyber security requirements currently could not be met for a wired safety pressure transmitter. It is hoped that the Level 0,1 devices will be addressed with compensating controls where technology does not exist as they will be in use for the next 10-15 years or longer.

It is also hoped that addressing the artificial divisions in future standards work will result in more secure Level 0,1 device ecosystems. However, until the engineers believe that cyber security of their equipment and networks are important to them and the IT/OT network organizations believe that Level 0,1 devices and the process are important to them, control systems will not be able to be secured to all of our peril.

About The Author:  Joe Weiss is an international authority on cybersecurity, control systems and system security. He is Managing Partner at Applied Control Solutions.                                                

Image: Unsplash

You Might Also Read:

The SolarWinds Hack Can Directly Affect Industrial Control Systems:

 

 

 

« Cybersecurity Mergers And Acquisitions Q1 2021
How Do The Facebook & LinkedIn Data Leaks Impact Their Users? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ON-DEMAND WEBINAR: How to improve your security posture with a web application firewall (WAF)

ON-DEMAND WEBINAR: How to improve your security posture with a web application firewall (WAF)

Watch this webinar to discover how a WAF goes beyond a standard firewall and helps you meet security industry compliance.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Securi-Tay

Securi-Tay

Securi-Tay is an information Security conference held by the Ethical Hacking Society at Abertay University, Dundee.

Cobwebs Technologies

Cobwebs Technologies

Cobwebs Technologies provide web intelligence solutions for Law Enforcement (including cybercrime), Intelligence Agencies and Federal Agencies.

NESEC

NESEC

NESEC is a specialist in information security consulting services and solutions.

IT Association of Slovakia (ITAS)

IT Association of Slovakia (ITAS)

ITAS is a professional association of domestic and foreign companies operating in the field of information and communication technologies

Sungard Availability Services (Sungard AS)

Sungard Availability Services (Sungard AS)

Sungard AS partners with customers around the globe to understand their unique business needs and provide production and recovery services tailored to their requirements.

Cyberteq

Cyberteq

Cyberteq is an innovative Information and Communication Technology Consulting Company, enabling it’s customers to take full advantage of the latest technologies in a secure manner.

Protergo

Protergo

Protergo is the first integrated provider of cybersecurity solutions in Indonesia. We proactively protect our clients from cyber threats.

ColorTokens

ColorTokens

ColorTokens Xtended ZeroTrust Platform protects from the inside out with unified visibility, micro-segmentation, zero-trust network access, cloud workload and endpoint protection.

Nameshield Group

Nameshield Group

Nameshield is one of most experienced domain name registrars, trademark protection specialists and managers of online reputational risk in the world today.

Software Diversified Services (SDS)

Software Diversified Services (SDS)

SDS provides the highest quality mainframe software and award-winning, expert service with an emphasis on security, encryption, monitoring, and data compression.

CyberSheath Services International

CyberSheath Services International

CyberSheath integrates your compliance and threat mitigation efforts and eliminates redundant security practices that don’t improve and in fact might probably weaken your security posture.

Everbridge

Everbridge

Everbridge provides enterprise software applications that automate and accelerate organizations’ operational response to critical events in order to keep people safe and businesses running.

Moviri

Moviri

Moviri combines security technology engineering, intelligence expertise and our data science DNA to help companies manage digital risk end-to-end.

Fifosys

Fifosys

Fifosys is a professional technology infrastructure specialist, delivering a broad portfolio of high quality technical and strategic managed services.

Coralogix

Coralogix

Coralogix are rebuilding the path to observability using a real-time streaming analytics pipeline that provides monitoring, visualization, and alerting capabilities without the burden of indexing.

Xobee Networks

Xobee Networks

Xobee Networks is a Managed Service Provider of innovative, cost-effective, and cutting-edge technology solutions in California.