Many Cyber Security Experts Don’t Understand The Systems They Are Trying To Secure

There is an old saying about not forcing a square peg into a round hole. The square peg is IT and Operating Technology (OT) network security. The round hole is the insecure Industrial Control System (ICS) field device. 

Without the ICS devices working properly, facilities cannot operate reliably and safely whereas facilities can operate without the IP networks, as demonstrated by the recovery from the 2015 Ukrainian power grid cyber attack.

The approach for offensive cyber operators when they attack an industrial or manufacturing system is to identify the impact they want to achieve and then study the systems to find out the best way to accomplish the goal. The approach of OT cyber security defenders is to assume that what needs to be defended are the OT networks and therefore it is not important to understand how the systems they are trying to protect work.

In order to defend and optimize the plants, buildings, facilities, and transportation, one needs to understand how the systems and components work. It doesn’t make sense that the approaches attackers have used to successfully compromise physical infrastructures continue to be ignored by the cyber defenders. 

The Gap Between OT And Engineering

IT and OT cyber security focuses on the Internet Protocol networks and are under the purview of the CISO. Control system field devices such as process sensors are used for reliability, safety, predictive maintenance, and cyber security. Control system cyber security focuses on the field devices such process sensors and their associated lower-level networks which are often serial.

These field devices have no cyber security and are under the purview of engineering. Protecting these field devices is different from protecting IT or OT networks and requires different technologies and training. When control systems are impacted, the results are obvious – trains or planes crash, pipelines rupture, power is lost. Because of the lack of control system cyber forensics and training, these incidents are generally not identified as being cyber-related. Yet, to date, there have been more than 11 million control system cyber incidents with more than 34,000 deaths. There is a need to address this cyber security gap in technology, training, and culture.”

Connecting The Dots

Unfortunately, dots are still not being connected in control system cyber security: incidents continue to occur in all sectors that are not shared within the sector or between sectors. That is obvious from my database where the same types of incidents occur within multiple sectors. The focus on IT and OT also limits recognizing cyber incidents that didn’t involve IP networks as being identified as being cyber-related. This was obvious from the RSA session.

Education

Cyber security is taught as a subdiscipline of computer science. There are very few universities that require an introduction to engineering for cyber security. Conversely, there are very few universities that require the engineering disciplines of electrical, mechanical, chemical, nuclear, or systems engineering to include an introduction to cyber security. This past year, I was a senior research associate at the University of Missouri Science and Technology. The course I supported required a capstone project to take an engineering/utility company and determine how well the student felt it met the NIST Cyber Security Framework. The students were neither engineers nor from the utility industry, and they could only use publicly available data for their projects.

They found issues that weren’t identified by the utilities’ cyber security organizations – appropriate training can work.

I also talked to a utility senior manager who was teaching a cyber security course at a university and felt it was too complex to even mention control systems. Unfortunately, this is the norm and it’s why there is such an education gap. The process sensor issues are not being addressed even with the work being done by CISA and ISA on OT cyber security training.

Lack Of Understanding Of Systems & Components

The fundamental approach for offensive cyber operators when they attack an industrial or manufacturing system is to identify the impact they want to achieve and then study the systems to find out the best way to accomplish the goal. That is, they want access to specific pumps, motors, valves, relays, etc. to accomplish their goal.

Accomplishing that goal may involve a combination of physical, IT, OT, and control system cyber approaches.

Additionally, offensive cyber operators may use the IP networks as part of their attack technique using approaches such as man-in-the middle attacks to provide the operators with misleading information. Often, the cyber approaches may be very basic as the control systems often are not designed to keep cyber attackers out. Consequently, state-of-the-art zero days are not needed. Process sensors are 100% trusted and are the input to OT monitoring systems that cannot detect or correct sensor data.

This means the offensive path of least resistance is where there is no cyber security - the process sensors and their ecosystems. This is what the ICS cyber “kill chain” defenders continue to ignore.

The fundamental approach of OT cyber security defenders is to assume that what needs to be defended are the OT networks and therefore that it is not important to understand how the systems they are trying to protect work. Unlike the offensive attacker’s attempt to cause a specific impact, compromising an OT network does not directly lead to an affect on specific pieces of equipment. For example, if the OT network is in a power plant, there is no understanding by many OT security defenders how a power plant and the equipment in the plant work and the associated system interactions. Process sensors are also the input to OT networks, and OT security experts commonly assume these to be uncompromised, authenticated, and correct which makes the attacks possible. It is not a “fair fight” when the defenders won’t address what the attackers are targeting especially when many of the networks and devices being targeted have no cyber logging or forensics.

Understanding how the systems and components work is not just a cyber exercise as the process sensors are the input for predictive maintenance, digital transformation, Industry4.0, smart manufacturing, smart grid, etc. In a recent plant test, the Windows-based HMI was not effective and, in fact, provided misleading information on the state of the process sensors and plant equipment.

Monitoring tools for process sensors and plant equipment need to be purpose-built, not general-purpose systems such as Windows. When sensors are wrong, equipment can be damaged and people can die.

Unfortunately, you don’t need to be a cyber expert to impact sensors. Two fast food workers told police they wanted their shift at the fast-food restaurant to slow down. During the interview, they told the police their intentions were that if the railroad crossing gates could malfunction and they could somehow block traffic, that would prevent people from getting to the restaurant, and they could have a slow night at work. Police said one of the fast food workers placed a makeshift device on the tracks that affected the crossing gate sensors. The railroad’s dispatch center could not have determined that the crossing gate signals were being intentionally disrupted. This was a control system cyber incident, one of many that have affected rail transportation.

Inadequate Government Approaches

Recent events have shown that pipeline cyber security requirements are inadequate and there have already been more than 125 recorded control system cyber incidents in water/wastewater that include complete loss of water, water hammer, chemical contamination  pumping contaminated water into the drinking water system This is trivial compared to the 2005 collapse of the Taum Salk earthen dam and the loss of billions of gallons of water because of inaccurate sensors.

The US Cyber Incident Reporting for Critical Infrastructure Act assumes cyber forensics exist, which is not the case for legacy ICS field devices. The zero trust initiative promtoted by CISA also does not apply to legacy control system devices that do not have minimal cyber security capabilities and are 100% trusted.

Summary

Control system cyber security is more than just protecting IP networks. In order to defend and optimize the plants, buildings, facilities, and transportation, one needs to understand how the systems and components work. It doesn’t make sense that the approaches attackers have used to successfully compromise physical infrastructures continue to be ignored by the cyber defenders.

Joe Weiss is Managing Partner at Applied Control Solutions

You Might Also Read: 

Industrial Control System Security Is Overlooked:

 

« Quantum Computing Raises As Many Problems As It Solves
Securing The Future Of Open Finance »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Sapphire

Sapphire

Sapphire deliver flexible and scalable cybersecurity solutions, helping organisations to detect, protect, respond and remediate against cyber threats.

Wilson Sonsini Goodrich & Rosati (WSGR)

Wilson Sonsini Goodrich & Rosati (WSGR)

WSGR is the premier provider of legal services to technology, life sciences, and growth enterprises worldwide. Practice areas include cybersecurity and data protection.

BetterCloud

BetterCloud

BetterCloud puts IT in control of the modern workplace through user lifecycle management, data discovery, and IT and security automation purpose-built for SaaS.

SEWORKS

SEWORKS

SEWORKS provides offensive and defensive app security that ensures mobile and web apps are safe from dangerous hacking threats.

Digital Ship

Digital Ship

Digital Ship provides news, information, conferences and events focused on digital ship systems, information technology and security relating to maritime operations.

7 Elements

7 Elements

7 Elements is an independent IT security testing company providing expertise in technical information assurance through security testing, incident response and consultancy.

Edvance

Edvance

Edvance operates a range of cybersecurity businesses including value added cybersecurity solutions distribution, security technology innovation and development, and SaS solution offerings.

Italtel

Italtel

Italtel is a multinational ICT company that combines networks and communications services with the ability to innovate and develop solutions for digital transformation.

Privacyware

Privacyware

Privacyware's ThreatSentry combines a state-of-the-art Web Application Firewall and port-level firewall with advanced behavioral filtering to block unwanted IIS traffic and web application threats.

ARIA Cybersecurity Solutions

ARIA Cybersecurity Solutions

The ARIA ADR Automatic Detection & Response solution was designed to find, verify, and stop all types of attacks - automatically and in real time.

CyberScotland

CyberScotland

The CyberScotland Partnership is a collaboration of key strategic stakeholders, brought together to focus efforts on improving cyber resilience across Scotland in a coordinated and coherent way.

Pratum

Pratum

Pratum is an information security services firm that helps clients solve challenges based on risk, not fear.

CodeHunter

CodeHunter

CodeHunter is a malware hunting SaaS platform designed to detect all variations of malware, known and unknown, without the need for source code or signatures.

SGTech

SGTech

SGTech is the leading trade association for Singapore's tech industry, offering focused support and development to both strategic and emerging sectors in the industry.

Versent

Versent

Versent is an Australian-born technology company, focused on architecting, building & operating cloud native applications, data streams, platforms, and services.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.