Industrial control system cybersecurity
March 2018, IT in Manufacturing
In Part 1 in the series of cybersecurity articles for 2018 (http://www.instrumentation.co.za/58931n), we looked at risk assessments within industrial control systems (ICS), including creating an ICS cybersecurity policy. In Part 2, we look at asset discovery (and continuing to do so), and vulnerability management on an ICS.
Vulnerabilities in the ICS environment represent a significant risk to organisations that run control systems, be that a manufacturing, mining or critical infrastructure organisation. These vulnerabilities are becoming more widely exploited by cyber criminals as was evident with the recent Triton and Crashoverride malware variants.
The best way of understanding your assets is by keeping a comprehensive asset (PLC, HMI, engineering workstations, etc.) register. Without a comprehensive asset register, it will be difficult to protect your systems effectively, as the asset register will assist you in understanding your network by defining the assets (i.e. vendor, model number) and defining how the assets communicate.
In Part 1, we discussed conducting a risk assessment (RA) and if the RA is conducted correctly, you should have a great base to work from. There are various tools that can assist you with identifying assets, such as Grass Marlin (discussed in Part 1), Wireshark and if you are really brave, there is arp-scan that will allow you to identify live hosts. As a cautionary note, please make sure that you are familiar with the tools mentioned above, or that you have tested the tools in an offline environment, as incorrect use could result in unwanted results and failures on the ICS systems. ICS asset scanning can fill a whole book on its own, but the use of these aforementioned tools is well documented and there are plenty of in-depth articles available to assist. There are also some great commercial-off-the-shelf (COTS) solutions available, and most of these solutions tend to offer more than just asset identification and tagging, some going so far as to map out the entire ICS network. The asset register will also help with effective network segmentation (which we will cover in Part 6), network security monitoring (which we will discuss in Part 4), and vulnerability management, which we will discuss next.
Vulnerability management, or should I say effective vulnerability management, which includes scanning for vulnerabilities and patching them, is a critical component in protecting both hardware and software systems. In OT/ICS systems however, this gets a little trickier, which I will elaborate on now. The first problem is that of finding the vulnerabilities, as most control assets are not designed to be ‘interrogated’, as is the case for IT assets. The second problem is that if you have managed to identify vulnerability, you are not able to patch it as most control networks operate 24/7/365.
So, if we are unable to scan our assets and cannot patch the vulnerabilities, what do we do? An effective cybersecurity strategy for applying patches combined with specifically developed ICS vulnerability scanning solutions can help. First, one needs to identify the different components of the ICS network(s), and as discussed above, an in-depth asset register will help in this regard. Each set of components will require a different strategy, and then these need to be documented and implemented in the overall cybersecurity program.
Putting things into perspective
The engineering workstations are only utilised daily between the working hours from 07h00 to 17h00. This would potentially allow us to scan for vulnerabilities, identify which patches need to be applied and then patch the engineering workstations during off peak hours. (As a cautionary note, and in line with industry best practice, it is strongly recommended that patches are tested before applying them.)
The control room workstations and the PLCs are used 24/7. We are therefore unable to scan these machines for vulnerabilities, and also unable to patch them. For this, we need to look towards non-intrusive passive scanners such as OpenVAS, or my personal recommendation of the Bandolier Project, which is a joint initiative between Digital Bond and Nessus from Tenable. In a nutshell, a passive scanner monitors network traffic at the packet layer to determine services and to identify and assess vulnerabilities, without affecting asset or network performance.
Patching is bit more difficult as the only real time slots we would have to apply these is during a shutdown. Generally, these occur between 1 and 5 times per year, and this period provides an ideal opportunity to patch the effected systems. The problem is that these times are normally reserved for engineers and vendors to make their changes, and to slot in new assets. This is where you need to fight for your piece of the pie and get board-level management buy in, so that you are allocated a time frame to apply your fixes.
To effectively manage vulnerabilities, you need to understand your assets and continuously monitor them for any changes, along with understanding your network(s). Vulnerabilities are not just classified as hardware or software flaws, they could also arise through incorrectly configured devices such as PLCs, industrial switches or control systems and other engineering workstations. This means that it is no longer just the ICS networks that are at risk, safety systems just became vulnerable as well.
Tommy Thompson is a passionate cybersecurity professional with some 15 years’ experience. Starting as a firewall engineer in 2001, Thompson has assisted a variety of companies in numerous roles with their cybersecurity problems. He holds a BComm degree in Information Management from Oxford Brookes University (UK) and he is certified by PECB (Canada), as a Scada Security Professional (CSSP).
For further information contact Tommy Thompson, +27 (0)11 463 0096, firstname.lastname@example.org
- How industry benefits from digital mobile solutions
March 2018, Pepperl+Fuchs, IT in Manufacturing
The networking of people, processes, machines, and systems will not just shape the markets of the future, it is the biggest challenge and opportunity of today’s world. Companies that make use of the possibilities ...
- What is the future of blockchain in manufacturing?
February 2018, Absolute Perspectives, IT in Manufacturing
In manufacturing circles, it is probably fair to say that there is some uncertainty as to exactly what future impact blockchain may have on manufacturing systems. A number of cloud solution providers ...
- Guided operator solutions
February 2018, Adroit Technologies, IT in Manufacturing
At parts assembly production sites, where parts are picked from stock, it is almost inevitable that picking mistakes will occur. As parts become more complex and their component types increase, the problem ...
- Combine edge and operational data to maximise IoT value
February 2018, IT in Manufacturing
For industrial companies engaged in digital transformation, analytics are key to turning large volumes of data into business value to enhance operations and improve the customer experience. Facing intense ...
- Yokogawa releases web-based operations platform
February 2018, Yokogawa South Africa, IT in Manufacturing
Yokogawa has announced the release of FAST/TOOLS R10.03, the latest version of a web-based real-time operations management and visualisation software solution that scales perfectly from a small and hybrid ...
- Risk management in automotive manufacturing
January 2018, Rockwell Automation, IT in Manufacturing
In automotive manufacturing operations, risks that go unaddressed can lead to missed production targets, safety incidents and vehicle recalls.
- Choosing the best IIoT platform
January 2018, RJ Connect, IT in Manufacturing
Industrial computers vs. development boards.
- The mine of the future
January 2018, IT in Manufacturing
The mining industry is in a crisis. Failure to get the policy, legislative, administrative and operating environment right is being compounded by a decline in resource demand and resulting excess capacity, ...
- EcoStruxure for the mining and metals industry
January 2018, Schneider Electric South Africa, IT in Manufacturing
In the second quarter of 2017, the South African mining industry expanded by 3,9% on the back of increased production of coal, gold and other metal ores such as iron and manganese. A further driver for ...
- Synaptic Business Automation
January 2018, Yokogawa South Africa, IT in Manufacturing
Yokogawa working with customers to implement ideal business solutions.
- Industrial control system cybersecurity - Part 1: Risk assessment
January 2018, Nclose, IT in Manufacturing
In my articles last year, I pointed out how companies are not doing enough around cybersecurity and how they have a false sense of security about their industrial control system (ICS) networks, thinking ...
- Digital transformation and collaborating robotics
December 2017, Omron Electronics, IT in Manufacturing
Reflections on how to cope with societal discourse.