Many Cyber Security Experts Don’t Understand The Systems They Are Trying To Secure

There is an old saying about not forcing a square peg into a round hole. The square peg is IT and Operating Technology (OT) network security. The round hole is the insecure Industrial Control System (ICS) field device. 

Without the ICS devices working properly, facilities cannot operate reliably and safely whereas facilities can operate without the IP networks, as demonstrated by the recovery from the 2015 Ukrainian power grid cyber attack.

The approach for offensive cyber operators when they attack an industrial or manufacturing system is to identify the impact they want to achieve and then study the systems to find out the best way to accomplish the goal. The approach of OT cyber security defenders is to assume that what needs to be defended are the OT networks and therefore it is not important to understand how the systems they are trying to protect work.

In order to defend and optimize the plants, buildings, facilities, and transportation, one needs to understand how the systems and components work. It doesn’t make sense that the approaches attackers have used to successfully compromise physical infrastructures continue to be ignored by the cyber defenders. 

The Gap Between OT And Engineering

IT and OT cyber security focuses on the Internet Protocol networks and are under the purview of the CISO. Control system field devices such as process sensors are used for reliability, safety, predictive maintenance, and cyber security. Control system cyber security focuses on the field devices such process sensors and their associated lower-level networks which are often serial.

These field devices have no cyber security and are under the purview of engineering. Protecting these field devices is different from protecting IT or OT networks and requires different technologies and training. When control systems are impacted, the results are obvious – trains or planes crash, pipelines rupture, power is lost. Because of the lack of control system cyber forensics and training, these incidents are generally not identified as being cyber-related. Yet, to date, there have been more than 11 million control system cyber incidents with more than 34,000 deaths. There is a need to address this cyber security gap in technology, training, and culture.”

Connecting The Dots

Unfortunately, dots are still not being connected in control system cyber security: incidents continue to occur in all sectors that are not shared within the sector or between sectors. That is obvious from my database where the same types of incidents occur within multiple sectors. The focus on IT and OT also limits recognizing cyber incidents that didn’t involve IP networks as being identified as being cyber-related. This was obvious from the RSA session.

Education

Cyber security is taught as a subdiscipline of computer science. There are very few universities that require an introduction to engineering for cyber security. Conversely, there are very few universities that require the engineering disciplines of electrical, mechanical, chemical, nuclear, or systems engineering to include an introduction to cyber security. This past year, I was a senior research associate at the University of Missouri Science and Technology. The course I supported required a capstone project to take an engineering/utility company and determine how well the student felt it met the NIST Cyber Security Framework. The students were neither engineers nor from the utility industry, and they could only use publicly available data for their projects.

They found issues that weren’t identified by the utilities’ cyber security organizations – appropriate training can work.

I also talked to a utility senior manager who was teaching a cyber security course at a university and felt it was too complex to even mention control systems. Unfortunately, this is the norm and it’s why there is such an education gap. The process sensor issues are not being addressed even with the work being done by CISA and ISA on OT cyber security training.

Lack Of Understanding Of Systems & Components

The fundamental approach for offensive cyber operators when they attack an industrial or manufacturing system is to identify the impact they want to achieve and then study the systems to find out the best way to accomplish the goal. That is, they want access to specific pumps, motors, valves, relays, etc. to accomplish their goal.

Accomplishing that goal may involve a combination of physical, IT, OT, and control system cyber approaches.

Additionally, offensive cyber operators may use the IP networks as part of their attack technique using approaches such as man-in-the middle attacks to provide the operators with misleading information. Often, the cyber approaches may be very basic as the control systems often are not designed to keep cyber attackers out. Consequently, state-of-the-art zero days are not needed. Process sensors are 100% trusted and are the input to OT monitoring systems that cannot detect or correct sensor data.

This means the offensive path of least resistance is where there is no cyber security - the process sensors and their ecosystems. This is what the ICS cyber “kill chain” defenders continue to ignore.

The fundamental approach of OT cyber security defenders is to assume that what needs to be defended are the OT networks and therefore that it is not important to understand how the systems they are trying to protect work. Unlike the offensive attacker’s attempt to cause a specific impact, compromising an OT network does not directly lead to an affect on specific pieces of equipment. For example, if the OT network is in a power plant, there is no understanding by many OT security defenders how a power plant and the equipment in the plant work and the associated system interactions. Process sensors are also the input to OT networks, and OT security experts commonly assume these to be uncompromised, authenticated, and correct which makes the attacks possible. It is not a “fair fight” when the defenders won’t address what the attackers are targeting especially when many of the networks and devices being targeted have no cyber logging or forensics.

Understanding how the systems and components work is not just a cyber exercise as the process sensors are the input for predictive maintenance, digital transformation, Industry4.0, smart manufacturing, smart grid, etc. In a recent plant test, the Windows-based HMI was not effective and, in fact, provided misleading information on the state of the process sensors and plant equipment.

Monitoring tools for process sensors and plant equipment need to be purpose-built, not general-purpose systems such as Windows. When sensors are wrong, equipment can be damaged and people can die.

Unfortunately, you don’t need to be a cyber expert to impact sensors. Two fast food workers told police they wanted their shift at the fast-food restaurant to slow down. During the interview, they told the police their intentions were that if the railroad crossing gates could malfunction and they could somehow block traffic, that would prevent people from getting to the restaurant, and they could have a slow night at work. Police said one of the fast food workers placed a makeshift device on the tracks that affected the crossing gate sensors. The railroad’s dispatch center could not have determined that the crossing gate signals were being intentionally disrupted. This was a control system cyber incident, one of many that have affected rail transportation.

Inadequate Government Approaches

Recent events have shown that pipeline cyber security requirements are inadequate and there have already been more than 125 recorded control system cyber incidents in water/wastewater that include complete loss of water, water hammer, chemical contamination  pumping contaminated water into the drinking water system This is trivial compared to the 2005 collapse of the Taum Salk earthen dam and the loss of billions of gallons of water because of inaccurate sensors.

The US Cyber Incident Reporting for Critical Infrastructure Act assumes cyber forensics exist, which is not the case for legacy ICS field devices. The zero trust initiative promtoted by CISA also does not apply to legacy control system devices that do not have minimal cyber security capabilities and are 100% trusted.

Summary

Control system cyber security is more than just protecting IP networks. In order to defend and optimize the plants, buildings, facilities, and transportation, one needs to understand how the systems and components work. It doesn’t make sense that the approaches attackers have used to successfully compromise physical infrastructures continue to be ignored by the cyber defenders.

Joe Weiss is Managing Partner at Applied Control Solutions

You Might Also Read: 

Industrial Control System Security Is Overlooked:

 

« Quantum Computing Raises As Many Problems As It Solves
Securing The Future Of Open Finance »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Digital Forensics Inc (DFI)

Digital Forensics Inc (DFI)

Digital Forensics Inc. is a nationally recognized High Technology Forensic Investigations and Information System Security firm

SecureNinja

SecureNinja

SecureNinja provides professional training, certifications & professional services related to all facets of Information Technology and Cyber Security.

Blake, Cassels & Graydon (Blakes)

Blake, Cassels & Graydon (Blakes)

Blakes is one of Canada’s top business law firms serving national and international clients in specialist areas including cyber security.

Swiss Cyber Think Tank (SCTT)

Swiss Cyber Think Tank (SCTT)

The Swiss Cyber Think Tank is a business network for Cyber Risk & Insurability, providing an industry-wide networking platform for insurers, technology and security firms.

Keynetic Technologies

Keynetic Technologies

Keynetic focuses on developing cybersecurity solutions for Industry 4.0.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Energia Ventures

Energia Ventures

Energia Ventures is a three-month intensive accelerator for entrepreneurs with an innovative business in the energy, smart grid, cleantech, and cybersecurity sectors.

Uptycs

Uptycs

Uptycs combines the open source universal agent, osquery, with a scalable security analytics platform for fleet visibility, intrusion detection, vulnerability monitoring and compliance.

Stratia Cyber

Stratia Cyber

Stratia Cyber is an independent, technology agnostic company providing high quality, pragmatic cyber security consultancy and expertise.

IoTeX

IoTeX

Building the connected world. IoTeX is a fast, secure, and decentralized platform that connects real world devices/data to the blockchain.

ADVA Optical Networking

ADVA Optical Networking

ADVA is a company founded on innovation and focused on helping our customers succeed. Our technology forms the building blocks of a shared digital future and empowers networks across the globe.

Allentis

Allentis

Allentis provide adapted solutions to ensure the security and performance of your information system.

Bytes Technology Group

Bytes Technology Group

Bytes is a leading provider of world-class IT solutions. Our growing portfolio of services includes cloud, security, licensing, SAM, storage, virtualisation and managed services.

CyberFOX

CyberFOX

CyberFOX is a global cybersecurity solutions provider focused on identity access management (IAM) for managed service providers (MSPs) and IT professionals.

TerraEagle

TerraEagle

Terraeagle is a boutique cyber security services company providing tailor-made solutions. Our core competency is in SOCaaS, MDRaaS & and Incident Response Retainer Services.

Windstream

Windstream

Windstream is a leading provider of advanced network communications and technology solutions for consumers, small businesses, enterprise organizations and carrier partners across the US.

Hubble

Hubble

Hubble grew from the idea that legacy solutions were failing to provide organizations with the asset visibility they needed to effectively secure and operate their businesses.

Blackwired

Blackwired

Blackwired has established a new category in cyber security with an intelligence-led model based on the USMC’s Combat Hunter programme ‘Left of Bang’.