Not enough is being done around industrial cybersecurity
August 2017, IT in Manufacturing
From energy plants to airports, and mines to the manufacturing shop floor, companies are realising that the IIoT, (Industrial Internet of Things) presents an enormous potential for better efficiencies and sustained growth. Operational Technology (OT) and Information Technology (IT) networks are becoming more interconnected to take advantage of this potential, and although this could transform OT (scada, DCS, ICS) procedures and methods, it also brings with it new risks to the OT environment – risks for which the industry is not yet equipped to handle, cyber risks.
OT cyber attacks are not just theory, they are happening
Just in the last few months, we have seen two outbreaks of ransomware that brought a stop to production at a few of the world’s leading automotive manufacturers. To add to this, there have been several other well-publicised attacks against OT systems, and these attacks are only going to increase. These incidents are not just specific to one sector, as all industries in the OT space could be affected.
Critical infrastructure attacks are not just targeted at power companies, as was the case with a Ukraine power company that was attacked twice in a period of twelve months, resulting in over 80 000 households being affected. These attacks are also targeting water utility companies. In the past few years, there have been three major attacks against water utilities – in the first attack, a cyber criminal managed to compromise the OT environment and spill 800 000 litres of raw sewage into surrounding areas, including a 4-star hotel. In a second attack, an unknown group of cyber criminals compromised a utility’s OT systems and changed the chemical balance for drinking water. The affected water had to be pumped out to sea. In the most recent attack, a water department’s smart meter central management unit was hacked and used to reprogram all the smart meters.
There have also been cyber attacks against manufacturing companies. In one case against a glue manufacturing company in northern America, hackers managed to get into the OT system and then hold the company to ransom. In a more recent attack, a pharmaceutical company was compromised and the hackers aimed not only to steal the IP, but also at disrupting the manufacturing processes.
The risks and where to start
We need to acknowledge that these risks exist and pose a real threat to the industry. OT systems were not designed with security in mind; they were designed and built with availability, integrity, and uptime as the principal requirements. We need to create the awareness and understanding that these systems, that were in some cases previously separate (air-gapped), now need to be protected. Industrial espionage, cyber criminal gangs, extortion and ransom – these are just some of the threats that form part of the new threat landscape to OT systems. Attacks and disruptions on OT systems put reputation, production, people, and profits at risk.
Inserting a firewall between the corporate IT network and the OT environment is no longer enough. It’s a start, but the companies running these types of new generation OT systems need to build a more resilient infrastructure.
The cybersecurity process should start with the collaboration between the OT and IT teams. The IT team understands cybersecurity and the OT team understands ICS and scada and their unique requirements. A second step would be to perform a passive risk assessment along with segmenting your OT environment. During the assessment process, all OT assets will be identified, classified and then lastly, assigned a level of risk. The above process will also assist with the grouping of similar assets, which will allow for successful segmentation to help protect the various OT layers, along with adding a layered defence to the OT environment. There also needs to be the formulation of a functional cybersecurity policy, as this will help to outline where the company needs to go, and more importantly, what is needed to achieve the parameters set out in the cybersecurity policy.
To end it off, staff need to participate in cybersecurity awareness training. An educated employee can make better decisions when faced with a potential fraudulent email or someone who has contacted them, stating they are from IT and need to reset a password. An educated employee will also think twice about inserting a USB drive, perhaps found outside the parking lot, into the corporate network.
For more information contact Tommy Thompson, Nclose, +27 (0)11 463 0096, firstname.lastname@example.org, www.nclose.com
- Key digital transformation IT concepts for operations
December 2018, IT in Manufacturing
Rather than focus on the digital transformation IT concepts through a technical lens, this article looks at them in terms of their implication on industrial operations.
- Data centre management as a service
December 2018, IT in Manufacturing
DMaaS aggregates and analyses large sets of anonymised customer data that can be enhanced with machine learning.
- Operator guided solutions
December 2018, Adroit Technologies, IT in Manufacturing
At parts assembly production sites, where parts are picked from stock, it is almost inevitable that picking mistakes will occur. As parts become more complex and their component types increase, the problem ...
- Software for low voltage distribution planning
November 2018, ElectroMechanica, IT in Manufacturing
New software from Hager facilitates planning and configuration of low voltage switchgear.
- SKF ups the digital ante at Göteborg plant
November 2018, SKF South Africa, IT in Manufacturing
Swedish group, SKF, has been implementing digital transformation since 2015, investing close to €19 million to carry out its digital revolution at the Göteborg plant which has, for over a century, been ...
- 3D software eliminates programming
November 2018, ASSTech Process Electronics + Instrumentation, IT in Manufacturing
More and more industrial users are discovering the potential of three dimensional software-aided object measurement. With the VisionApp 360 software, Wenglor now offers a smart tool that makes 3D object ...
- Advanced data management from Siemens
November 2018, Siemens Digital Factory & Process Indust. & Drives, IT in Manufacturing
Siemens is innovating its data management software for process analytical technology (PAT) with Simatic Sipat version 5.1, which allows users to monitor and control the quality of their products in real-time ...
- The 5 stages of cybersecurity awareness
October 2018, IT in Manufacturing
Before any of these recommendations can be implemented, managers must first understand and accept the risks they face and the potential consequences. An understanding of human behaviour can help.
- How adding services to products could start your journey towards an Industry 4.0 solution
October 2018, Absolute Perspectives, This Week's Editor's Pick, IT in Manufacturing
For manufacturers, digital transformation involves understanding a range of new technologies and applying these to both create new business and to improve the current operation. Industry 4.0 provides ...
- Energy management software
October 2018, Yokogawa South Africa, IT in Manufacturing
Energy management solutions from KBC, a subsidiary of Yokogawa Electric Corp.
- Using IIoT analytics to build customer solutions
October 2018, Parker Hannifin Sales Company South, IT in Manufacturing
Parker’s Voice of the Machine platform contextualises the data collected from machines.
- Key considerations when designing IIoT networks for smart businesses
October 2018, RJ Connect, IT in Manufacturing
In the era of the IIoT, industries have opportunities to become more productive, more efficient and more dynamic. For example, the IIoT provides businesses with new capabilities such as dashboards that ...