Air Gapping Critical Process Control Networks

While many manufacturers are scrambling to add data access and control from anywhere in the world, the cybersecurity approach at Chevron might surprise you. The company opts to air gap critical systems to disconnect them from the Internet as much as possible (though no system is 100 percent isolated).

Byron K. Wallace, Chevron’s cybersecurity process control network vulnerability assessor acknowledged that this style might not suit every company. “We go to a bit of an extreme,” he said. “It’s not a one-for-all model… The core functions are the same, but the application is different industry to industry.”

Regardless of your connectivity strategy, Wallace shared advice on cyber-securing for industrial companies:

Learn from others’ mistakes by researching what happened to companies that have been hacked. A lot of this information is kept private, but network vulnerability assessment companies can provide that information if you work with them.

Train all of your employees on security policies and breaches so it’s not just system administrators watching, but everyone.

Change passwords frequently. It might seem obvious, but Wallace said many entities still have default passwords on their devices, including one major metropolitan city’s IP cameras.

Get involved by asking your vendors about their security policies and what the updates will do to your equipment. “You may trust [your supplier], but you have to protect your own assets,” he said. If your vendor can access your process control system, ensure you add layers of security.

Beyond collecting intrusion detection and protection system (IDS/IPS) data logs, analyze them for patterns or anomalies.

Perform “fire drills.” Once you have policies in place, simulate breaches to test staff readiness. For example, send a phishing email to see who in your company clicks. Include executive management in the test—they could be the worst offenders.

The process of securing assets might sound daunting, but Wallace said companies can start by identifying the most critical systems. “Start small, putting safeguards around those systems, and then keep moving forward,” he said. 

AutomationWorld

« Your Server Has Been Hacked… What Next?
Infrastructure Security in the Age of Ransomware »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

A-SIT Secure Information Technology Center

A-SIT Secure Information Technology Center

A-SIT was founded in 1999 as a registered nonprofit association and is established as a competence center for IT-Security.

Nubo Software

Nubo Software

Nubo’s Virtual Mobile Infrastructure creates a virtual corporate device on your employee smartphones and tablets. Enable unlimited mobility without leaving any data at risk.

Open Systems International (OSI)

Open Systems International (OSI)

Our innovative Operations Technology (OT) solutions are highly scalable and can be deployed by various utility companies to monitor, control and optimize their real-time operations.

Procilon Group

Procilon Group

Procilon Group specialize in the development of cryptographic software as well as strategic advice on information security and data protection.

Zivaro

Zivaro

Zivaro provides transformational consulting and technology services to help clients attain real business value from their technology investments.

Ogasec

Ogasec

Ogasec is a cybersecurity company formed by the merger between Aker and N-Stalker in 2017. Solutions include Security & Connectivity Networking, Application Security, and Managed Security Services.

Clari5

Clari5

Clari5 redefines real-time, cross channel banking Enterprise Fraud Management using a central nervous system approach to fight financial crime.

Axonius

Axonius

Axonius is the only solution that offers a unified view of all assets and their coverage, empowering customers to take action to enforce their organization’s security policies.

GCHQ Apprenticeships

GCHQ Apprenticeships

GCHQ, the UK intelligence and security organisation, offers a unique three-year Cyber Security Degree Apprenticeship with employment on successful completion.

Shift5

Shift5

Shift5 focus on securing operational technology (OT) by building best-in-class, dual-use products serving military and commercial entities.

NetNordic Group

NetNordic Group

NetNordic is a Nordic system integrator focusing on solutions and services in the area of networking, smart data centers, cybersecurity, and unified communication.

Voodoo Security

Voodoo Security

Voodoo Security is a specialized information security consulting firm focused on security assessments, risk and compliance analysis, and cloud security.

ESC - Enterprise Security Center

ESC - Enterprise Security Center

ESC is a system house specializing exclusively in IT security - Security Implementation & Optimization, Operations, Managed Security Services.

MicroAge

MicroAge

Powered by five decades of experience, lasting partnerships, client relationships, and the values that guide us daily, MicroAge is here to help you secure, accelerate, and transform your business.

National Cybersecurity Agency (ACN) - Italy

National Cybersecurity Agency (ACN) - Italy

The ACN is the National Authority for Cybersecurity in Italy. the Agency promotes public-private initiatives to strengthen the national cybersecurity and resilience posture.

EPAM Systems

EPAM Systems

Since 1993, EPAM Systems has leveraged its advanced software engineering heritage to become a leading global digital transformation services provider.