classic | mobile
 

Search...

SA Instrumentation & Control Buyers' Guide

Technews Industry Guide - IIoT 2018

Technews Industry Guide - Maintenance, Reliability & Asset Optimisation

 

Industrial control system cybersecurity
March 2018, IT in Manufacturing


In Part 1 in the series of cybersecurity articles for 2018 (http://www.instrumentation.co.za/58931n), we looked at risk assessments within industrial control systems (ICS), including creating an ICS cybersecurity policy. In Part 2, we look at asset discovery (and continuing to do so), and vulnerability management on an ICS.

Vulnerabilities in the ICS environment represent a significant risk to organisations that run control systems, be that a manufacturing, mining or critical infrastructure organisation. These vulnerabilities are becoming more widely exploited by cyber criminals as was evident with the recent Triton and Crashoverride malware variants.

Asset discovery

The best way of understanding your assets is by keeping a comprehensive asset (PLC, HMI, engineering workstations, etc.) register. Without a comprehensive asset register, it will be difficult to protect your systems effectively, as the asset register will assist you in understanding your network by defining the assets (i.e. vendor, model number) and defining how the assets communicate.

In Part 1, we discussed conducting a risk assessment (RA) and if the RA is conducted correctly, you should have a great base to work from. There are various tools that can assist you with identifying assets, such as Grass Marlin (discussed in Part 1), Wireshark and if you are really brave, there is arp-scan that will allow you to identify live hosts. As a cautionary note, please make sure that you are familiar with the tools mentioned above, or that you have tested the tools in an offline environment, as incorrect use could result in unwanted results and failures on the ICS systems. ICS asset scanning can fill a whole book on its own, but the use of these aforementioned tools is well documented and there are plenty of in-depth articles available to assist. There are also some great commercial-off-the-shelf (COTS) solutions available, and most of these solutions tend to offer more than just asset identification and tagging, some going so far as to map out the entire ICS network. The asset register will also help with effective network segmentation (which we will cover in Part 6), network security monitoring (which we will discuss in Part 4), and vulnerability management, which we will discuss next.

Vulnerability management

Vulnerability management, or should I say effective vulnerability management, which includes scanning for vulnerabilities and patching them, is a critical component in protecting both hardware and software systems. In OT/ICS systems however, this gets a little trickier, which I will elaborate on now. The first problem is that of finding the vulnerabilities, as most control assets are not designed to be ‘interrogated’, as is the case for IT assets. The second problem is that if you have managed to identify vulnerability, you are not able to patch it as most control networks operate 24/7/365.

So, if we are unable to scan our assets and cannot patch the vulnerabilities, what do we do? An effective cybersecurity strategy for applying patches combined with specifically developed ICS vulnerability scanning solutions can help. First, one needs to identify the different components of the ICS network(s), and as discussed above, an in-depth asset register will help in this regard. Each set of components will require a different strategy, and then these need to be documented and implemented in the overall cybersecurity program.

Putting things into perspective

Scenario 1

The engineering workstations are only utilised daily between the working hours from 07h00 to 17h00. This would potentially allow us to scan for vulnerabilities, identify which patches need to be applied and then patch the engineering workstations during off peak hours. (As a cautionary note, and in line with industry best practice, it is strongly recommended that patches are tested before applying them.)

Scenario 2

The control room workstations and the PLCs are used 24/7. We are therefore unable to scan these machines for vulnerabilities, and also unable to patch them. For this, we need to look towards non-intrusive passive scanners such as OpenVAS, or my personal recommendation of the Bandolier Project, which is a joint initiative between Digital Bond and Nessus from Tenable. In a nutshell, a passive scanner monitors network traffic at the packet layer to determine services and to identify and assess vulnerabilities, without affecting asset or network performance.

Patching is bit more difficult as the only real time slots we would have to apply these is during a shutdown. Generally, these occur between 1 and 5 times per year, and this period provides an ideal opportunity to patch the effected systems. The problem is that these times are normally reserved for engineers and vendors to make their changes, and to slot in new assets. This is where you need to fight for your piece of the pie and get board-level management buy in, so that you are allocated a time frame to apply your fixes.

Conclusion

To effectively manage vulnerabilities, you need to understand your assets and continuously monitor them for any changes, along with understanding your network(s). Vulnerabilities are not just classified as hardware or software flaws, they could also arise through incorrectly configured devices such as PLCs, industrial switches or control systems and other engineering workstations. This means that it is no longer just the ICS networks that are at risk, safety systems just became vulnerable as well.

Tommy Thompson is a passionate cybersecurity professional with some 15 years’ experience. Starting as a firewall engineer in 2001, Thompson has assisted a variety of companies in numerous roles with their cybersecurity problems. He holds a BComm degree in Information Management from Oxford Brookes University (UK) and he is certified by PECB (Canada), as a Scada Security Professional (CSSP).

For further information contact Tommy Thompson, +27 (0)11 463 0096, tommy@nclose.com


Credit(s)
Supplied By: Nclose
Tel: +27 11 463 0096
Fax:
Email:
www: www.nclose.com
Share via email     Share via LinkedIn   Print this page

Further reading:

  • Endress+Hauser’s IIoT technology masters the mining challenge
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, Endress+Hauser, IT in Manufacturing
    When it comes to the mining business, the company is intent on mastering the challenges of extracting and processing precious metals and minerals by increasing efficiency, improving safety and protecting ...
  • Industrial control system ­cybersecurity
    July 2018, Nclose, This Week's Editor's Pick
    In the last three articles on cybersecurity in ICS environments, we have covered risk assessments, asset discovery and vulnerability management, and environment hardening. In this month’s article, we ...
  • Schneider Electric innovations shine in Germany
    July 2018, Schneider Electric South Africa, IT in Manufacturing
    In an ever-changing digital world, for everything from new business models and new consumer technologies to new infrastructure, energy and power systems, the digital transformation is inescapable. The ...
  • Three important technologies to slash manufacturing input costs
    July 2018, IT in Manufacturing
    Local manufacturing firms continue to face headwinds from heightened global competition from countries such as China and India, to sluggish demand and macroeconomic conditions, to critical skills shortages ...
  • Faster quality reviews for life ­sciences companies
    July 2018, Emerson Automation Solutions, IT in Manufacturing
    Emerson has released Quality Review Manager, an application designed to reduce the time it takes to release therapies to patients by decreasing the time and effort required for product quality reviews. ...
  • Top automation trends in the era of Industry 4.0
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, IT in Manufacturing
    The Fourth Industrial Revolution (Industry 4.0) refers to the current era of convergence between automation and data exchange technologies in manufacturing. The top five trends that will characterise ...
  • Yokogawa’s cybersecurity solutions
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, Yokogawa South Africa, IT in Manufacturing
    Cybersecurity is a hot topic in the industrial automation world and includes network and system security. Yokogawa has strengthened its product line to face these challenges by strengthening its cyber ...
  • How to prove payback on an Industry 4.0 project
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, Festo, IT in Manufacturing
    As industry changes amid the drive towards digitalisation, organisations are looking to achieve real business results from their engagement with new technologies. Marketing hype detailing theoretical ...
  • Siemens turns Industrie 4.0 vision into reality with Digital Enterprise portfolio
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, Siemens Digital Factory & Process Indust. & Drives, IT in Manufacturing
    Siemens is continuously enhancing its Digital Enterprise portfolio for Industrie 4.0, the fourth industrial revolution, i.e. created the technical platform for this transformation with its range of innovative ...
  • Smart irrigation system saves water and energy
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, 1Worx, IT in Manufacturing
    Founded in 2008, Shock Wave Engineering provides Internet of Things (IoT) solutions in the agriculture and mining industries. The company provides systems for both standard and customised development ...
  • Safe landing every time
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, Siemens Digital Factory & Process Indust. & Drives, IT in Manufacturing
    Aeronautics research institute studies aircraft braking operations using simulation software from Siemens.
  • Bringing the connected enterprise to life
    Technews Industry Guide: Industrial Internet of Things & Industry 4.0, Rockwell Automation, IT in Manufacturing
    Rockwell Automation simplifies analytics for industrial productivity.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual





 

         
    classic | mobile

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.