Process Sensor Cyber Security Is A Vital Issue

Process sensors are ubiquitous and are under the auspices of the engineering organizations. Process sensors are the input to control and safety systems and provide input for operator decisions.

Like our fingers, eyes, and ears that provide input to the brain to make the right decisions, if the process sensor input is not secure and accurate, catastrophic failures can occur.

This has often meant that attention to safety, which the engineering organizations understand, has outrun attention to security, which is something that the engineering organizations have tended to view as the responsibility of the IT organization. In turn, the IT organizations have tended to overlook process sensor security, seeing that as an engineering responsibility that’s outside their own scope.

At the process sensor level, however, safety and security are really the same issue.

The Challenge Of Securing Process Sensors

Some example process sensor cyber-related incidents include:

  • Dam collapse from erroneous low-level readings
  • Sensor malfunctioned resulting in the release of 10 million gallons of untreated wastewater
  • Safety relief valve in a nuclear plant did not lift because the pressure sensor never reached its setpoint 
  • One voltage sensor failure in combined cycle plant in Florida caused a 200MW load swing at the plant that resulted in a 50MW load swing in New England
  • Tank farm explosions from erroneous level sensor readings
  • Airplane crashes from erroneous sensor readings
  • Refinery explosion from erroneous sensor readings

Three US national laboratories did a detailed survey issues in 2021 of sensors used in building controls and heating, ventilation, and air conditioning (HVAC), Sensor impacts on building and HVAC controls: A critical review for building energy performance.  According to this document, “Cybersecurity threats are increasing, and sensor data delivery could be hacked as a result. How hacked sensor data affects building control performance must be understood. A typical situation could include sensor data being modified by hackers and sent to the control loops, resulting in extreme control actions. To the best of the authors’ knowledge, no such study has examined this challenge.”

Process sensors have no cyber security, authentication, or cyber logging. Consequently, it is not possible to know whether these incidents were intentional or malicious but made to look like they were unintentional.  

There are three questions that are often asked about cyber security of process sensors:

  • Do you need a physical presence to compromise the sensor? No, it can be done remotely.
  • How much harm can cyber-related sensor impacts cause? The field calibrator calibrates one sensor at a time but connects insecurely to the Internet. The Asset Management Systems (AMS) has access to thousands of sensors. Meanwhile, the AMS has insecure connections to the Internet and often is connected to the Corporate Enterprise Resource Planning (ERP) systems. Some real examples of catastrophic failures from sensor issues were provided.
  • What happens when the compromised sensor data is sent to the cloud to be used in big data analytics for IOT or Industry4.0 applications? The sensor data is assumed to be uncompromised.

These deficiencies lead to a need for a training environment to:

  • Better understanding of how an adversary may interrupt, degrade, or possibly damage and destroy infrastructure.
  • Develop forensic capability to detect process sensor cyber-related issues.

It should be noted that an appropriate training facility would accomplish the above tasks  whether the sensor issues are malicious or unintentional.

Process sensor security may amount to a gap in standards and regulation

Three significant events have highlighetd the importance of estblishing robust cybers security practices:

- Based on discussions with the Transportation Security Administration (TSA), the recognition that the TSA pipeline cyber security guidelines did not address control systems including the sensors.

- The “discovery” in Abu Dhabi that more than 3000 sensors had no ability to have passwords https://www.controlglobal.com/blogs/unfettered/a-vulnerability-worse-than-log4j-and-it-can-blow-up-facilities-and-shut-down-the-grid/.

- The realisation that current pipeline cyber security guidelines effectively excluded the process sensors -  "Inventory should not include individual instruments that are not network connected".

As the cyber insecure sensors in the Abu Dhabi petrochemical plant show, digital sensors have built-in backdoors for performing remote calibration and other maintenance activities. That makes sense as a convenient, labor-saving design feature. It makes the sensors easier to upgrade and maintain. These same backdoors, however, can be exploited as vulnerabilities, even when the sensors do not appear to be connected to networks.

In essence, the backdoor in the process sensors allows for two-way communication to/from the Internet with no cyber security protection.  

An indication of the disconnect between engineering and cyber security is that many engineers would be willing to pay extra to have the backdoors because it makes their jobs easier despite the cyber risk. The same cyber vulnerabilities in the process sensors also exist for the field calibrators and the AMS. At the 2016 ICS Cyber Security Conference, the U.S. Air Force Institute of Technology (AFIT) and a Russian security researcher independently demonstrated how process sensor cyber vulnerabilities could be exploited. 

While considerable progress has been made for control system (Guidance now exists with the ISA/IEC-62433 standards, NIST SP800 series standards, and various other guidance documents), however, these standards do not yet address cyber security considerations at the lower levels and additional research, training, and testing to improve process sensor cyber security is required from both industry and government.

The discussions must be trans-disciplinary and must include engineers and facility operators as well as IT and OT networking personnel. The numerous actual control system cyber incidents clearly demonstrate that current approaches fail to sufficiently consider the engineer/operator roles and responsibilities in identifying and mitigating threats. This will need cooperation between physical security, network security, and engineering/operational security disciplines which can be fostered and enhanced via collaboration between professional associations and industry groups. 

The networking community currently dominates cyber security and views all sectors as effectively being an extension of IT. Meanwhile, the engineering community has limited participation in cyber security decision making process as the engineering equipment that is often vulnerable is ignored by networking cyber security. 

 A cross-disciplinary approach represents an important first step in bringing the engineering discipline to help address the cyber security of control systems which is generally not done when the focus is just securing the networks.

There are two distinct categories of process sensors to be addressed:

  • Legacy devices - These are the devices currently in use and those still being built. There is no cyber security in these devices or cyber security standards to address these device limitations.
  •  Nextgen devices - Nextgen is still “on the drawing board”. ISA/IEC62443-4-2 can addresses these devices. However, at today’s funding level, Nextgen is arguably years from a prototype.

Historically, the network community has questioned whether process sensors should be within the scope of cyber security efforts. They question if process sensors are computers and if they are on networks. Process sensors may not look like computers, but they have similar components such as microprocessors which perform familiar computing functions. Sensors are also on networks, often serial as opposed to routable networks.

The confusion may arise because many in the networking community view networks as being routable networks and therefore don’t recognize serial networks as being networks.

A way forward for process sensor security

Consideration should be given to establish a formal Group involving the relevant are engaged to develop policy and to determine what organizations are best suited to oversee this new and expanding area of training and research for control system field device cyber security.

This Group should develop a White Paper to clearly define what is unique about legacy control system field devices and what needs to be done to provide improved cyber security and identify the resources needed  to speed up  developing cyber security standards, frameworks, recommended practices, and information sharing.

Historically, standards have been driven by industry. It’s time for the industry that relies on process sensors to take the lead in closing the gap between cyber security and safety engineering.

Joe Weiss is Managing Partner at Applied Control Solutions

You Might Also Read:

Industrial Control System Security Is Overlooked:

 

« North Korean Hackers Stole $400m In Crypto Currency
REvil Cyber Ransomware Gang Members Arrested »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

NSFOCUS Information Technology

NSFOCUS Information Technology

NSFOCUS is a global service provider and enterprise DDoS mitigation solution provider.

Cyberwatch

Cyberwatch

Cyberwatch is a Vulnerability Scanner & Fixer software that helps you to detect and fix the vulnerabilities of your Information System.

Towergate Insurance

Towergate Insurance

Towergate Insurance is a leading UK specialist insurance broker. Business products include Cyber Liability Insurance.

Center for Strategic Cyberspace & International Studies (CSCIS)

Center for Strategic Cyberspace & International Studies (CSCIS)

CSCIS seeks to advance global cyberspace security and prosperity by providing strategic insights for cyberspace and policy solutions to decision makers.

Tempered Networks

Tempered Networks

Tempered Networks delivers the first purpose-built platform for IIoT cybersecurity that allows customers to connect and secure devices in minutes without the need for specialized skills.

Uppsala Security

Uppsala Security

Uppsala Security built the first crowdsourced Threat Intelligence platform known as the Sentinel Protocol, which is powered by blockchain technology.

SDG Corp

SDG Corp

SDG is a global cybersecurity, identity governance, risk consulting and advisory firm, addressing complex security, compliance and technology needs.

Futurae Technologies

Futurae Technologies

Futurae - enabling trust and invisible security for your users on all devices and applications. Strong customer authentication (SCA) made easy.

Center for Medical Device Cybersecurity (CMDC) - University of Minnesota

Center for Medical Device Cybersecurity (CMDC) - University of Minnesota

CMDC’s mission is to foster university-industry-government partnerships to assure that medical devices are safe and secure from cybersecurity threats.

Advantio

Advantio

Advantio offers a unique combination of technologies and managed, advisory and testing services to increase your cyber resilience and compliance.

FortifyIQ

FortifyIQ

FortifyIQ's mission is to advance maximum security against side-channel attacks across the entire computing spectrum.

Infiot

Infiot

Infiot is a pioneer in enabling secure, reliable access with zero trust security, network optimization, edge-intelligence and AI driven operations for all remote users, devices, sites and cloud.

Aiden Technologies

Aiden Technologies

Aiden simplifies your IT process, giving you peace of mind and security by ensuring your computers get exactly the software they need and nothing else.

HackersEra

HackersEra

HackersEra is a leading offensive cybersecurity service provider. We enable our clients to operate in a more secure environment efficiently and produce more value.

InfoSight

InfoSight

InfoSight offers proven Cyber Security, Regulatory Compliance, Risk Management and Infrastructure Solutions to protect your business and your customers from cyber crime and fraud.

CyberTee

CyberTee

CyberTee is an Alliance designed for and by independent cybersecurity professionals to address the talent shortage.