Why are Industrial Control Systems difficult to secure against cyber attacks?

ICS networks are difficult to secure because they were not designed with cyber security in mind and often cannot be upgraded to meet minimal protection standards. According to Joseph Weiss, attackers have access to the latest zero-day exploits, creating an uneven battle. Detection of attacks affecting operational performance and resilience planning are considered essential responses.

What is BlackEnergy and how does it affect ICS networks?

BlackEnergy is malware used to attack Industrial Control Systems and energy infrastructure. A 2014 ICS Cyber Security Conference presentation detailed how Russian cyber actors used BlackEnergy and Havex to target the US grid. Neither NERC CIP nor NEI-0809 requires that BlackEnergy or other malware be removed from affected systems, and both standards exclude many systems classified as non-critical.

Do small utilities face ICS cyber attack risks?

Yes. A TrendMicro ICS honeypot program that emulated a small water utility in rural Missouri showed that cyber attackers from around the world targeted the facility within one hour of its appearance on the Internet. This demonstrates that inadequately secured ICS networks attract global threat actors regardless of facility size or operational importance.

What is the HART protocol and why is it a cybersecurity concern?

The HART protocol is the communication standard for 4-20 milliamp analog sensors used across multiple industries worldwide. A presentation at the 2014 ICS Cyber Security Conference by a Russian researcher demonstrated that the HART protocol is vulnerable to hacking. Because process sensors are not authenticated or secured, exploiting them directly poses significant risks to industrial operations.

Global Cyber Attacks on ICS Networks

Industrial Control Systems face a persistent and worsening cyber threat that existing standards fail to fully address. According to Joseph Weiss, PE, CISM, CRISC and ISA Fellow, malware such as CrashOverride, BlackEnergy, and Havex has targeted ICS networks across energy and utility sectors, yet neither NERC CIP nor NEI-0809 requires that malware be removed from affected systems.

How Long Have ICS Cyber Threats Been Known?

ICS cyber threats have been documented and demonstrated for decades, yet critical infrastructure operators continue to leave known vulnerabilities unaddressed. As early as 2004, white hat hackers at the Idaho National Laboratory exploited a disclosed vulnerability during the ICS Cyber Security Conference, opening and closing breakers from hundreds of miles away.

What Attacks Have Targeted ICS Infrastructure?

Documented attacks on Industrial Control Systems include state-sponsored intrusions and protocol-level exploits targeting critical infrastructure worldwide. At the 2014 ICS Cyber Security Conference, presentations detailed how Russian cyber actors attacked the US grid using Havex and BlackEnergy malware. At the 2014 Conference, we also had a presentation by a Russian researcher on hacking the HART protocol – the protocol for 4-20 milliamp analog sensors used in multiple industries world-wide.

Are Small Utilities Targeted by ICS Attackers?

Size and operational importance do not protect industrial facilities from cyber attack. A TrendMicro ICS honeypot program emulated a small water utility in rural Missouri and demonstrated that cyber attackers from around the world targeted the facility, including its ICS components, within one hour of its appearance on the Internet

If the news reports are to be believed, the radiation monitoring system (not the sensors) was compromised at Chernobyl and had to be operated in manual. As process sensors are still not authenticated or secure, consider the implications of hacking the actuals sensors and the attendant damage.

Why Is Securing ICS Networks So Difficult?

ICS networks present a fundamentally uneven security challenge because the systems were not designed for cyber security and often cannot be upgraded to meet even minimal protection standards. Attackers, by contrast, have access to the latest zero-day exploits and dedicate significant resources to finding and exploiting vulnerabilities.

The article was written by Joseph Weiss, PE, CISM, CRISC, ISA Fellow, IEEE Senior Member, MD ISA99. Joseph Weiss is an industry expert on control systems and electronic security of control systems, with more than 40 years of experience in the energy industry. Mr. Weiss spent more than 14 years at the Electric Power Research Institute (EPRI) where he led a variety of programs including the Nuclear Plant Instrumentation and Diagnostics Program, the Fossil Plant Instrumentation & Controls Program, the Y2K Embedded Systems Program and, the cyber security for digital control systems.