Some Expert Predictions For Industrial Cyber Security

Nearly every aspect of modern life depends on industrial control systems (ICS) operating as expected. As ICS devices become increasingly connected, they also become increasingly vulnerable. Most commercial and critical infrastructure industrial organisations are underprepared for the digital convergence of their Information Technology (IT) and Operational Technology (OT)  environments.

ICS operators need to get a robust cybersecurity program in place, and fast. IT and OT, with the adoption of Industrial Internet of Things (IIoT), are rapidly changing and converging. As they evolve, hackers search for new attack vectors and new attack surfaces to compromise. So, what does all this mean for your organisation and for industrial cybersecurity? 

Here are seven  predictions about what the cyber security experts at Tenable, the leaders in industrial control systems at Belden and the researchers from  IBM/ Ponemom think that  industry faces this year, along with recommendations for how you can prepare your organisation. First, though, let’s look at the industry changes influencing our predictions.

Background Perspective
Air gapping used to be a sufficient way to protect networks and devices. Today, it’s impossible to ignore that your mission-critical and industrial processes are vulnerable to intrusion and disruption. A 2019 Report from Ponemon Institute found that 90% of respondents with OT infrastructure said they suffered at least one damaging IT or OT cyberattack in the past two years. Attackers hit nearly two-thirds of them at least twice. 

Because of these increasing attacks, many industrial and critical infrastructure organisations are investing in ways to secure their OT infrastructure in addition to their IT infrastructure. 

Many industrial devices are running older, highly-vulnerable versions of Windows that have not been hardened or patched. Operators often feel that they can’t take these systems down for routine maintenance to improve security because they are critical for the overall operation of the plant or service. There’s also the concern that an upgrade/update might interrupt operations. In some cases, security vulnerability scans typical in IT environments are too disruptive to use in OT environments. 

In fact, many ICS environments may still have specialised industrial protocols and equipment that don’t use TCP/IP (the most common communication protocol for IT networks and security tools). 

Seven Future Predictions

1. Technology convergence will open up new attack vectors
The convergence of IT, OT and the adoption of IoT will accelerate at an unprecedented pace in the next few years. The boundaries between them will continue to dissolve. This new reality will create new attack surfaces and attack vectors your team should monitor and defend. 

OT systems, which are characterised by a wide range of legacy, proprietary and non-standard protocols and interfaces, will enable an abundance of attack options even as it becomes increasingly difficult to protect them. 

Recommendation: Whether or not you air gap your industrial control systems, OT-based attacks are a real and present danger. The mantra of “set it and forget it” is not an adequate way to administer OT environments. Early detection of OT threats will require continuous monitoring at the network and device level. 

2. OT-to-IT attacks will be reality
While lateral attacks that gain a foothold in IT and spread to OT networks have been well documented in the past 24 months, soon we will see the emergence of OT-to-IT attacks. For example, we can expect attacks that intentionally compromise ICS devices in OT networks to gain access to IT networks and assets such as customer databases. 

Attackers will target OT environments because traditionally they are not as well defended as IT systems. That makes them a path of least resistance for attackers looking to target IT data repositories.

Recommendation: Create cooperation between IT and OT security and promote information sharing to detect these attacks. Also, leverage device integrity to identify problems at the device level and stop attacks before they spread across the network.

3. Attacks will expose weak links in OT security
In their search for the path of least resistance, attackers will target OT infrastructures such as branches or remote locations for large organisations. Typically, these remote/smaller sites connect to a larger OT network and, in the case of energy providers, to regional grids. They also tend to have the lowest defenses and are most vulnerable to attack. As a result, attackers will seek to compromise a remote site, or even a small energy provider, hoping to create a cascading impact.

Recommendation: To avoid disruption of mission critical operations and lateral IT data-gathering invasions, pay equal attention to checking OT infrastructure at branch and remote locations as you do to your primary sites. Attackers can exploit these remote locations to launch backhaul attacks into headquarters or partner sites.

4. The definition of critical infrastructure will broaden
The traditional perception of critical infrastructure will dramatically expand beyond energy grids to include more non-traditional targets. We can expect mainstream identification of critical infrastructure to include industries such as building management systems, transportation and logistics, heavy construction equipment, food and beverage supply chains and others. Expect more widespread recognition of the US Department of Homeland Security 16 critical infrastructure sectors. In addition, because 2020 is a presidential election year in the US, election system security will be front-of-mind.

Recommendation: Infrastructures labelled as non-critical, too small or too isolated, previously not considered targets, will now require protection and monitoring. 

5. Cloud-based ICS-as-a-Service will gain broad acceptance 
Organisations will recognise the cloud as a reliable means to deliver OT security to locations where it’s not practical or feasible for a physical deployment. Cloud-delivered OT security follows the same objection/acceptance trajectory as other technology infrastructure building blocks: on-premises CRM versus a Software-as-a-Service cloud-based tool like Salesforce, local versus online antivirus and, more recently, host- versus cloud-based endpoint detection and response (EDR).  

Recommendation: Consider cloud delivered OT security alternatives for remote or distributed locations that currently lack controls as vigorous as those at your primary installations.

6. IT will have a bigger ownership role in collaborative security 
In next year most industrial organisations will recognise security must be a shared responsibility between OT and IT teams. 
With the advent and growing awareness of both internal and external security threats, collaboration between IT and OT teams has steadily increased over the past 24 months. While OT teams have traditionally objected to IT intervention in ICS networks, we expect to see IT teams leverage their decades of experience to lead OT security. 
We predict IT teams will collaboratively set guidelines for OT security projects, with critical support and input from OT teams.

Recommendation: Because an IT security approach differs significantly from OT security priorities and challenges, organisations will need a melding of the two approaches. Adopt best practices from both IT and OT security protocols to develop a new architecture optimised for visibility, security and control.

7. The cyber skills gap will spread to OT
By 2022, ISC2 predicts there will be 1.8m unfilled OT security jobs, on top of the current global IT security skills shortage (more than 4 million unfilled positions). 

In the year ahead, we predict the combined OT-IT skills gap will create new risks: an organisation’s existing personnel may lack requisite IT and OT cross-security skills and qualified candidates for new roles will be scarce. 

Tenable:      Belden:      IBM:        Tenable:

You Might Also Read:  

Cyber Skills Shortages Stands At Four Million:

AI And IoT Have Created The AIoT:

 

 

« GDPR's Impact In The US And Globally
British CEOs Worry About Cyber Attacks While Their Businesses Are Under-Insured »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Galaxkey

Galaxkey

Galaxkey is a data protection product that protects email, documents and any data using access control and an encryption platform.

Asavie

Asavie

Asavie provide solutions for Enterprise Mobility Management and secure IoT Connectivity.

CYQUEO

CYQUEO

CYQUEO is your professional partner and system integrator. We secure your organization against advanced cyber threats.

Red4Sec

Red4Sec

Red4Sec are experts in ethical hacking, audits of web and mobile applications, code audits, cryptocurrency audits, perimeter security and incident response.

Kaspersky Industrial CyberSecurity (KICS)

Kaspersky Industrial CyberSecurity (KICS)

Kaspersky addresses all the cybersecurity needs of industrial organizations in its Kaspersky Industrial CyberSecurity (KICS) portfolio.

Adyta

Adyta

Adyta specializes in cybersecurity solutions adapted to the needs of sovereign institutions, business groups and other organizations that handle information and sensitive or classified data.

Fly Ventures

Fly Ventures

Fly Ventures is a seed-stage venture capital fund for outstanding teams building Enterprise and Deep Tech startups in Europe.

Internet 2.0

Internet 2.0

Internet 2.0 is a Cyber Security technology company with a core focus on developing affordable but sophisticated cyber security solutions.

FirstWave Cloud Technology

FirstWave Cloud Technology

FirstWave Cloud Technology is a global cyber security company which has been delivering Cybersecurity-as-a-service solutions to the market since 2004.

Digistor

Digistor

Digistor is a leading manufacturer of industrial-grade flash storage products, secure storage products, and Removable Secure Data Storage.

Cyberani Solutions

Cyberani Solutions

Cyberani Solutions was created to fulfill the cybersecurity needs of industry and government in Saudi Arabia, and across the Middle East and North Africa regions.

Ultima

Ultima

Ultima are on a mission to help businesses unlock their true potential by using the right IT to protect your company’s revenue and reputation – 24/7.

One Step Secure IT

One Step Secure IT

One Step provide Managed IT Services, Cybersecurity Protections, and Compliance to businesses in the USA nationwide.

Cyber Qubits

Cyber Qubits

Cyber Qubits is a cybersecurity training and consulting company focused on developing the next generation of cybersecurity professionals.

UFS Technology

UFS Technology

UFS, the bank technology outfitter for community banks, provides purpose-built, bank-exclusive technology services and solutions including cybersecurity.

Xcede

Xcede

Xcede are global technology recruitment specialists. We connect companies with exceptional professionals who empower growth.