IT and OT collaboration is necessary for industrial cybersecurity because IT security teams hold the security knowledge while OT teams hold the domain expertise to assess how security measures affect industrial control systems. Without C-Level involvement, organizations face growing exposure from hackers who target ICS networks for damage and extortion.
Why Do IT and OT Need to Collaborate on ICS Security?
IT and OT collaboration is necessary because each discipline contributes something the other lacks. IT security teams understand how to identify and counter cyber threats, but OT teams understand the operational consequences when new security technologies interact with industrial control systems, including the risk of unintentionally disrupting physical processes.
Since the mid-1990s, many industrial companies have interconnected their industrial control systems (ICSs) to improve productivity, maintenance, and safety in the operational environment. Some of this interconnectivity was to the Internet. While, this connectivity helped to improved the efficiency, security was at best a minimal consideration. The lack of adequate security planning has resulted in the increased attack surface and resultant cyber attacks. In addition to the lack of security consideration, there was lack of collaboration between ICS Operational Technology (OT) – (the term “OT” didn’t exist at that time) and Information Technology (IT). The situation is very different today than it was in the 1990s or early 2000s:
- companies want to speed up and increase the connectivity between IT and OT to continue the business productivity improvement,
- hackers (individual or state sponsor) are now explicitly eyeing ICSs for damage and extortion, and
- the need to collaborate between IT and Operations (not just the term “OT”) is not just important, but necessary. This collaboration is important because IT security has the security knowledge, but OT has the domain expertise and understanding of how new IT/OT security technologies may affect the operational systems (essentially hacking your own systems). It is also critical to include the C-Level who need to consider security in the overall business plan as well as to assure that IT and OT are working seamlessly together.
Why Can’t Network Anomaly Detection Protect ICS Alone?
Network anomaly detection, which identifies threats such as malware and compromised network packets, cannot fully protect industrial control systems because it cannot be correlated with physical process anomalies. Without authenticated, secured process sensing for variables such as pressure, temperature, pipe pressure, and tank level, there is no way to confirm whether a physical process change results from a malicious attack.
How Does Raw Process Sensing Improve ICS Defense?
Raw process sensing provides an independent view of physical system behavior that remains valid regardless of network conditions or cyber interference. Because raw process sensing detects changes in boiler temperature, pipe pressure, voltage, and other operational variables without relying on network data, it gives operators an informed basis for deciding when to shut down a process.
Why Are ICS Networks So Difficult to Secure in IIoT?
With IIOT we are in a very uneven battle. ICSs were not made to be cyber secure and often cannot be upgraded to provide what many in the cyber security community would consider to be a minimal level of protection. On the other hand, the hackers (individual and state sponsored) are dedicated to finding and exploiting vulnerabilities and have been given access to the latest zero-day exploits. As we believe it is a losing battle to secure ICSs, we need to be able to detect cyber attacks that affect operational system performance and we need to have a resilience/recovery plan. This has been demonstrated in the Ukraine with the ability to operate the systems in manual operation for an extended period of time. We also need to reconsider whether critical control and/or safety systems should be connected to the Internet. If control and/or safety systems are connected to the Internet, there’s a need to provide some base-line cyber security controls and security policy to minimize the potential impact from any cyber attack due to this connectivity.
Should Critical Control Systems Connect to the Internet?
Organizations must carefully evaluate whether critical control systems and safety systems should be connected to the Internet at all. When such connectivity exists, baseline cybersecurity controls and a security policy are necessary to minimize the potential impact of any cyber attack.
The article was written by Joe Weiss, Applied Control Solutions, LLC and Richard Ku, Trend Micro.
