Editor's Choice


Industrial control system ­cybersecurity

July 2018 Editor's Choice

In the last three articles on cybersecurity in ICS environments, we have covered risk assessments, asset discovery and vulnerability management, and environment hardening. In this month’s article, we will look at how to start monitoring industrial control system networks, in what is called network security monitoring (NSM). NSM is not confined to security monitoring though, as most system owners’ state, the best return on investment for a NSM tool is often through finding incorrectly configured ICS devices and gaining a more in-depth understanding as to how the ICS assets communicate.

The benefits of NSM tools in the ICS environment

NSM deployments are not very common in ICS environments, but we are starting to see an increase in the number of customers implementing these solutions as their systems become more digitised, driven by the IIoT and Industry 4.0. Owners and operators are slowly starting to see the benefit of deploying such a system to help them gain more insight and visibility into their ICS networks. The golden rule of cybersecurity is that you cannot protect what you cannot see, and NSM helps you to ‘see’ your networks, thus enabling you to build stronger cybersecurity controls.

The NSM tool will enable you to collect, analyse, and correlate data across your ICS network(s), which will help to not only detect potential security risks, but also to identify network connectivity issues and configuration problems. NSM tools do present some challenges though, but that is an entire article on its own. These challenges are extremely well documented online and need to be investigated and, more importantly, understood before implementing any NSM tool. I would, however, like to highlight two of the main challenges that I often come across, these being: the massive amount of data that is collected by the monitoring tools; and the amount of time required to correlate and disseminate this data, to turn it into intelligent actionable information.

Now that I’ve told you about NSM tools, you’re probably starting to ask: “Well where do we start? And what do I need to begin monitoring?”

Both are valid questions. If you bring on too many information sources you and your team will be inundated with information, bring on too few, and you will leave areas of your network potentially exposed. The most effective way to implement NSM is to bring on segment by segment, or zone by zone. If you have already implemented the Purdue Model (PERA), the hard work of segmenting into zones is mostly completed. If you have not yet adopted this architecture, look for current established zones, like your perimeter, the engineering workstations, etc, and start collecting the data from those sources. This data will then be ingested into the NSM solution, and intelligence will be built and tweaked over time, to provide actionable reports. This process can then be repeated for each new segment/zone that is added to the NSM solution.

Recommendations

There are a few very good NSM solutions that are available commercially, which have the ability to ingest specific ICS data. These solutions also come with great support options from the respective vendors and partners. There are also quite a few options for open source solutions, specific to control systems, which are well documented online: including Security Onion, BroIDS, OSSEC and Snort, to name a few. These were initially developed for IT systems, but they have since evolved to include support for ICS networks.

However, there is no ‘one solution that fits all’. What we have found works very effectively is a combination of the tools mentioned above, and some others. One of the better guides I have read in this regard is from The Spanish Security and Industry CERT, certsi_, which has published a fantastic research piece on not only NSM, but also intrusion prevention/detection (IPS/IDS) https://tinyurl.com/y95roj4b. I strongly recommend that you download this guide and share it with your team.

Conclusion

In closing, whilst there are a number of NSM tools available, it is strongly recommended to combine these with industry best practices, for effective monitoring of an ICS network infrastructure. There are quite a few practitioners/vendors out there who claim that a SIEM (security information and event management) is the same as network monitoring, but it is not. Be careful and do your homework – there are only a limited number of vendors whose products are proven to work in an ICS environment.

Tommy Thompson

Tommy Thompson is a passionate cybersecurity professional with some 15 years’ experience. Starting as a firewall engineer in 2001, Thompson has assisted a variety of companies in numerous roles with their cybersecurity problems. He holds a BComm degree in Information Management from Oxford Brookes University (UK) and he is certified by PECB (Canada), as a Scada Security Professional (CSSP).

For further information contact Tommy Thompson, +27 (0)11 463 0096, [email protected]





Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Cutting-edge robotics and smart manufacturing solutions
Yaskawa Southern Africa Editor's Choice
Yaskawa Southern Africa made a compelling impact at this year’s Africa Automation and Technology Fair.

Read more...
A cure for measurement headaches in contract manufacturing
VEGA Controls SA Editor's Choice
A contract manufacturing organisation provides support to pharmaceutical and biotechnology companies in the manufacturing of medications, formulations and substances. VEGA’s measurement solutions offer accuracy and reliability for monitoring levels and pressures during the manufacturing process.

Read more...
PC-based control for a food capsule and pod packaging machine
Beckhoff Automation Editor's Choice
For TME, a machine builder specialising in the packaging of powdered foods, Beckhoff’s PC-based control technology offers unlimited opportunities when it comes to performance and innovative capacity in terms of flexibility, scalability and openness.

Read more...
Simple and efficient level measurement in the mining, minerals and metals industries
Endress+Hauser South Africa Editor's Choice Level Measurement & Control
Measuring devices in the mining, minerals and metals industries face the challenge of varying material states and long distances in measurement height. Endress+Hauser’s answer to these challenges is the new Micropilot family.

Read more...
PC-based control for fertiliser
Beckhoff Automation Editor's Choice Fieldbus & Industrial Networking
On a farm in the USA, valuable ammonia is extracted from slurry and processed into ammonium sulphate. NSI Byosis has transformed this complex process into a flexible modular system. This modular approach requires an automation solution with flexible scalability in both hardware and software, which this Dutch company has found in PC-based control from Beckhoff.

Read more...
Loop signature 28: Things to consider when tuning.
Michael Brown Control Engineering Editor's Choice Fieldbus & Industrial Networking
I was giving a course at a remote mine in the middle of the Namibian desert. We were discussing tuning responses, and as I always do on my courses, I mentioned that in my opinion ¼ amplitude damped tuning is not desirable, and is in fact not good.

Read more...
Control without complexity
Editor's Choice Motion Control & Drives
In an era where precision, performance and smart control define industrial success, the right driver can make all the difference. At Axiom Hydraulics, we’ve seen firsthand how the Sun Hydraulics XMD series transforms hydraulic systems, from mining and construction to agriculture and automation.

Read more...
The thermal combustion balancing act
Editor's Choice
From carbon taxes to export tariffs, and cost containment to security of supply and sustainability, companies are under increasing pressure to switch to greener fuel sources. Associated Energy Services warns that this pivotal change has some potentially serious knock-on effects.

Read more...
What’s driving the IE3 motor revolution?
WEG Africa Editor's Choice
The International Efficiency 3 (IE3) motor standard will soon become South Africa’s legal minimum standard, mandating that local suppliers offer more efficient electric motors. What is driving this change, and how does it affect the many industries that rely on these modern electric workhorses?

Read more...
Unlocking the smart factory
ElectroMechanica Editor's Choice Motion Control & Drives
At ElectroMechanica, we recognise that transitioning to smart automation isn’t just about adopting new technology; it’s about solving real challenges. Labour shortages, rising costs and downtime due to outdated machinery make digital transformation essential for long-term competitiveness.

Read more...