SA Instrumentation & Control attended the recent Honeywell User Group (HUG) EMEA in The Hague, Netherlands. We spoke to a number of Honeywell cyber security specialists about issues confronting manufacturers.
Honeywell reports that there has been a significant increase in industrial cyberattacks over the last 12 months. However, it also acknowledges that a fair portion of this increase can be attributed to the fact that clients are improving the monitoring systems in their plants. This means that end-users are becoming increasingly aware of attacks of which they were previously ignorant. The result of this increasing awareness is leading to a change in the manner in which users defend against cyberattacks.
Current approach to industrial cyber security
Typically the current end-user approach to cyber security involves the following steps:
• Signature-based detection (anti-virus, intrusion detection systems (IDS)).
• Perimeter-based protection (firewalls).
• Understanding the current trends, attack vectors, threats.
O i.e. we identify them, and
O protect against them.
According to Eric Knapp, Honeywell’s chief engineer, Cyber Security Solutions and Technology, “Honeywell already has secure data connections into more than 400 plants/sites around the world where it is providing managed security services. We’re working with McAfee, Symantec, Palo Alto, Cisco and Microsoft to test and ensure that current cyber security measures are implemented in the industrial cyber security space.
Cyber security solutions laboratory – the future
“However, Honeywell does not believe that industry’s current approach to industrial cyber security is sufficient. We believe that a more holistic approach is necessary. As a result Honeywell has developed the industry’s first cyber security solutions laboratory in Atlanta (GA) US. We are in the process of opening a second in Dubai, to service the greater needs of our Europe, Middle East, Asia (EMEA) clients, and a third lab in Asia-Pacific.
“The laboratory contains physical equipment at all physical layers. In the lab we can test integration of cyber security systems to ensure that they are compliant with the client’s configuration. We can create a virtual image of the plant locations so that they, in an offline environment, can perform new equipment testing, test new technologies and perform penetration testing.
Which countries are leading the fight against industrial cybercrime?
It appears that that Qatar, UAE and Saudi Arabia have a clear understanding of the importance of cyber security. All three have initiated tertiary workforce education with bachelor’s and master’s degrees in cyber security.
ICT Qatar already requires that all cyber-attack data must be turned over to the local CERT within 30 days. Failure to do so with will result in a 6 month jail-term for the Chief Technical Officer (CTO) and thereafter, deportation.
In Qatar it is also possible to insure one’s company against cybercrime.
Understanding the attacker
Marina Krotofil, (Lead Security Researcher at Honeywell’s Industrial Security Laboratory) is employed to perform defensive research for industrial control systems. She believes that one shouldn’t believe everything that you see in the mass media.
Krotofil argues that television programmes and the movie industry have led the public to believe that as soon as a hacker logs onto an industrial network, the attacker will be able to do whatever he/she wants. “In movies the hacker is able to look into a data packet, modify a process variable and disrupt the plant.”
Krotofil says, “This is wrong. Data is never transmitted on the networks or stored on the servers in a human comprehensible way. Depending on where the hacker logs onto network, they may or may not have access to the relevant data. Additionally, this data will be encoded in a non-comprehensible way.
“If you understand what the attacker needs to do and why, one can know where to look for them and learn how to protect against them. Additionally, one can then decide which data is most sensitive and how best to hide it e.g. on an isolated encrypted server.
Readers interested in the impact of cybercrime on the IIoT can find the full interview at http://instrumentation.co.za/+J1953
© Technews Publishing (Pty) Ltd | All Rights Reserved
printer friendly version