Cybersecurity in Manufacturing: How to Keep the Threats at Bay

In practice, to integrate such technologies, manufacturers are increasing connectivity between their operational technology (OT) networks and external environments such as IT networks and even the internet. Such connectivity allows them, for example, to integrate their management platforms such as enterprise resource planning (ERP) and manufacturing execution systems (MES) with shop floor data and reduce manual labor. While these new solutions and the connectivity, complexity and automation associated with them have tremendous value, they expose valve and other manufacturers to new cybersecurity risks.

Connecting the OT networks to external environments exposes legacy devices, which were designed with no cybersecurity in mind, to adversarial access. Historically, most devices in OT networks are unpatched—their software has not been updated—and have minimal security capabilities, if any. An attack against an OT network in a factory can have multiple devastating outcomes that can hurt manufacturers’ revenue stream, public reputation, competitive edge and even lead to regulatory intervention.

OT NETWORKS’ VULNERABILITES

The main current cyber threats against OT networks today are:

• Ransomware attacks: Well-known ransomware campaigns such as WannaCry and Not Petya caused disruption to many manufacturers worldwide. Companies like Merck, Renault, Nissan, Honda and Taiwan Semiconductor Manufacturing Company, Limited, reported that the malicious code infected thousands of systems in their OT network. Once it successfully infects a device, the ransomware holds the device for ransom, denying access and stopping its normal operation. Such attacks have led to significant operational downtime in many factories, causing damage estimated in hundreds of millions of dollars. Even though these attacks were not targeting OT networks specifically, the collateral damage caused to these vulnerable environments was significant. Even if your organization is not the target of a cyber-attack, it doesn’t mean it won’t become a victim.
• Operational downtime: Attackers access the crucial systems in OT networks to effectively map the operational industrial process and to build tools that can bring down the process. The latest known examples of such attacks occurred in 2015 and 2016 when hackers brought down the electricity supply in the Ukraine on two separate occasions. These first ever “cyber blackouts” left hundreds of thousands of people without power during cold December days. The attackers penetrated into the production network through external connections to the IT network, manipulating devices to stop their activities and cut the power supply. In this case, the adversaries took advantage of the low security measures in the industrial control system (ICS) devices and the overall lack of security tools and awareness in the power companies.
• Endangered safety: One of the top priorities in manufacturing plants is the safety of the employees and equipment. Attackers can sabotage this critical aspect in OT networks and put safety at risk. In 2015, the German government published that a blast furnace at a steel mill was attacked and suffered massive damage due to manipulation of industrial communications. In another case in 2017, Triton/Trisis malware targeted Schneider Electric’s safety systems, mostly in the Middle East. The bottom line is that the new connected factory environment could lead to virtual and physical risks that might endanger employees.

SECURING YOUR OT NETWORK

Manufacturers looking to secure their OT networks must create an OT security team with both security and OT expertise. Such combined expertise in a hybrid group effectively addresses security needs while considering the unique characteristics of OT networks, such as the importance of availability and safety. The OT security team needs to change the OT security strategy from “How can I isolate my network?” to “How can I secure it while it’s connected?” Such a transition is critical since traditional methods such as air-gaps and OT network isolation are simply not effective when business units require increasing connectivity to implement Industrial IoT technologies.

Once IT and OT converge, they can effectively work together to create an advanced manufacturing environment that is productive, safe and secure.

Here are some of the steps these teams should take and the questions they should ask:

1. Gain visibility: What does our environment look like? What devices do we have? How are they connected? What interfaces does the OT environment have with the IT network? What connection do we have to the internet? What vulnerabilities are these devices exposed to?
2. Assess the risk: What are the cyber risks to our business? How can an attacker gain access to critical systems? What are the most critical devices? What security measures do we already have in place? What is our risk exposure?
3. Define a security strategy: How should our OT network architecture be designed? How can our segment between IT and OT functions? Can we create zones and micro-segmentation within our OT network? What security policies should be defined? How can we increase employee awareness of security threats?
4. Implement security controls: Do we have continuous control over our network? Can we detect in real time when something wrong or anomalous occurs within our environment? Can we detect changes to our assets and architecture? Do we have control over what comes in and out of our OT network?
5. Integrate OT security in your organization: How does OT security fit in our existing security procedures? How can our dedicated OT security tools integrate with our existing tools such as firewalls and network management, and security information and event management (SIEM)? How can our security team handle new types of information coming from the OT environment?

Manufacturers need to understand that OT security threats and risks are real and require the proper attention and resources. They need to allocate the right personnel, design a strategy that fits their specific business and risks, and implement dedicated OT security tools that allow them to gain security and control in their ever-connecting Industrial IoT networks.

Organizations need to have continuous visibility into their environments that will enable them to constantly reduce their risk and measure the effectiveness of their security actions. With today’s growing requirements for advanced technologies on the shop floor, it’s critical to not treat security as a burden. Instead, you can embed security early in the digital transformation and address security as an enabler of advanced manufacturing capabilities.

Yoni Shohet is co-founder and vice president for business development at SCADAfence (www.scadafence.com).