Some Expert Predictions For Industrial Cyber Security

Nearly every aspect of modern life depends on industrial control systems (ICS) operating as expected. As ICS devices become increasingly connected, they also become increasingly vulnerable. Most commercial and critical infrastructure industrial organisations are underprepared for the digital convergence of their Information Technology (IT) and Operational Technology (OT)  environments.

ICS operators need to get a robust cybersecurity program in place, and fast. IT and OT, with the adoption of Industrial Internet of Things (IIoT), are rapidly changing and converging. As they evolve, hackers search for new attack vectors and new attack surfaces to compromise. So, what does all this mean for your organisation and for industrial cybersecurity? 

Here are seven  predictions about what the cyber security experts at Tenable, the leaders in industrial control systems at Belden and the researchers from  IBM/ Ponemom think that  industry faces this year, along with recommendations for how you can prepare your organisation. First, though, let’s look at the industry changes influencing our predictions.

Background Perspective
Air gapping used to be a sufficient way to protect networks and devices. Today, it’s impossible to ignore that your mission-critical and industrial processes are vulnerable to intrusion and disruption. A 2019 Report from Ponemon Institute found that 90% of respondents with OT infrastructure said they suffered at least one damaging IT or OT cyberattack in the past two years. Attackers hit nearly two-thirds of them at least twice. 

Because of these increasing attacks, many industrial and critical infrastructure organisations are investing in ways to secure their OT infrastructure in addition to their IT infrastructure. 

Many industrial devices are running older, highly-vulnerable versions of Windows that have not been hardened or patched. Operators often feel that they can’t take these systems down for routine maintenance to improve security because they are critical for the overall operation of the plant or service. There’s also the concern that an upgrade/update might interrupt operations. In some cases, security vulnerability scans typical in IT environments are too disruptive to use in OT environments. 

In fact, many ICS environments may still have specialised industrial protocols and equipment that don’t use TCP/IP (the most common communication protocol for IT networks and security tools). 

Seven Future Predictions

1. Technology convergence will open up new attack vectors
The convergence of IT, OT and the adoption of IoT will accelerate at an unprecedented pace in the next few years. The boundaries between them will continue to dissolve. This new reality will create new attack surfaces and attack vectors your team should monitor and defend. 

OT systems, which are characterised by a wide range of legacy, proprietary and non-standard protocols and interfaces, will enable an abundance of attack options even as it becomes increasingly difficult to protect them. 

Recommendation: Whether or not you air gap your industrial control systems, OT-based attacks are a real and present danger. The mantra of “set it and forget it” is not an adequate way to administer OT environments. Early detection of OT threats will require continuous monitoring at the network and device level. 

2. OT-to-IT attacks will be reality
While lateral attacks that gain a foothold in IT and spread to OT networks have been well documented in the past 24 months, soon we will see the emergence of OT-to-IT attacks. For example, we can expect attacks that intentionally compromise ICS devices in OT networks to gain access to IT networks and assets such as customer databases. 

Attackers will target OT environments because traditionally they are not as well defended as IT systems. That makes them a path of least resistance for attackers looking to target IT data repositories.

Recommendation: Create cooperation between IT and OT security and promote information sharing to detect these attacks. Also, leverage device integrity to identify problems at the device level and stop attacks before they spread across the network.

3. Attacks will expose weak links in OT security
In their search for the path of least resistance, attackers will target OT infrastructures such as branches or remote locations for large organisations. Typically, these remote/smaller sites connect to a larger OT network and, in the case of energy providers, to regional grids. They also tend to have the lowest defenses and are most vulnerable to attack. As a result, attackers will seek to compromise a remote site, or even a small energy provider, hoping to create a cascading impact.

Recommendation: To avoid disruption of mission critical operations and lateral IT data-gathering invasions, pay equal attention to checking OT infrastructure at branch and remote locations as you do to your primary sites. Attackers can exploit these remote locations to launch backhaul attacks into headquarters or partner sites.

4. The definition of critical infrastructure will broaden
The traditional perception of critical infrastructure will dramatically expand beyond energy grids to include more non-traditional targets. We can expect mainstream identification of critical infrastructure to include industries such as building management systems, transportation and logistics, heavy construction equipment, food and beverage supply chains and others. Expect more widespread recognition of the US Department of Homeland Security 16 critical infrastructure sectors. In addition, because 2020 is a presidential election year in the US, election system security will be front-of-mind.

Recommendation: Infrastructures labelled as non-critical, too small or too isolated, previously not considered targets, will now require protection and monitoring. 

5. Cloud-based ICS-as-a-Service will gain broad acceptance 
Organisations will recognise the cloud as a reliable means to deliver OT security to locations where it’s not practical or feasible for a physical deployment. Cloud-delivered OT security follows the same objection/acceptance trajectory as other technology infrastructure building blocks: on-premises CRM versus a Software-as-a-Service cloud-based tool like Salesforce, local versus online antivirus and, more recently, host- versus cloud-based endpoint detection and response (EDR).  

Recommendation: Consider cloud delivered OT security alternatives for remote or distributed locations that currently lack controls as vigorous as those at your primary installations.

6. IT will have a bigger ownership role in collaborative security 
In next year most industrial organisations will recognise security must be a shared responsibility between OT and IT teams. 
With the advent and growing awareness of both internal and external security threats, collaboration between IT and OT teams has steadily increased over the past 24 months. While OT teams have traditionally objected to IT intervention in ICS networks, we expect to see IT teams leverage their decades of experience to lead OT security. 
We predict IT teams will collaboratively set guidelines for OT security projects, with critical support and input from OT teams.

Recommendation: Because an IT security approach differs significantly from OT security priorities and challenges, organisations will need a melding of the two approaches. Adopt best practices from both IT and OT security protocols to develop a new architecture optimised for visibility, security and control.

7. The cyber skills gap will spread to OT
By 2022, ISC2 predicts there will be 1.8m unfilled OT security jobs, on top of the current global IT security skills shortage (more than 4 million unfilled positions). 

In the year ahead, we predict the combined OT-IT skills gap will create new risks: an organisation’s existing personnel may lack requisite IT and OT cross-security skills and qualified candidates for new roles will be scarce. 

Tenable:      Belden:      IBM:        Tenable:

You Might Also Read:  

Cyber Skills Shortages Stands At Four Million:

AI And IoT Have Created The AIoT:

 

 

« GDPR's Impact In The US And Globally
British CEOs Worry About Cyber Attacks While Their Businesses Are Under-Insured »

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Service Supplier Directory

Cyber Security Service Supplier Directory

Free Access: Cyber Security Service Supplier Directory listing 5,000+ specialist service providers.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

SANS Institute

SANS Institute

SANS is the most trusted and by far the largest source for information security training and security certification in the world.

Data Barracks

Data Barracks

Data Barracks offer Infrastructure, Disaster Recovery and Backup services from some of the most secure data centres in the world, supported by experts

Kirkland & Ellis

Kirkland & Ellis

Kirkland & Ellis LLP is an international law firm with offices in the USA, Europe and Asia. Practice areas include Data Security & Privacy.

Wallix

Wallix

Wallix is a software company offering privileged access management solutions for enterprises, public organizations and cloud service providers

LATRO Services

LATRO Services

LATRO Services is a complete solution provider to discover, locate, and eliminate telecom fraud.

CyPhyCon

CyPhyCon

CyPhyCon is an annual event exploring threats and solutions to cyber attacks on cyber-physical systems such as industrial control systems, Internet of Things and Industrial Internet of Things.

Cyber NYC

Cyber NYC

Cyber NYC is a suite of strategic investments to grow New York City’s cybersecurity workforce, help companies drive innovation, and build networks and community spaces.

AlertFusion

AlertFusion

AlertFusion is a platform that makes security operations more effective. It complements existing tools and technologies, unifies operations, enhances process maturity and drives efficiencies.