Many Cyber Security Experts Don’t Understand The Systems They Are Trying To Secure

There is an old saying about not forcing a square peg into a round hole. The square peg is IT and Operating Technology (OT) network security. The round hole is the insecure Industrial Control System (ICS) field device. 

Without the ICS devices working properly, facilities cannot operate reliably and safely whereas facilities can operate without the IP networks, as demonstrated by the recovery from the 2015 Ukrainian power grid cyber attack.

The approach for offensive cyber operators when they attack an industrial or manufacturing system is to identify the impact they want to achieve and then study the systems to find out the best way to accomplish the goal. The approach of OT cyber security defenders is to assume that what needs to be defended are the OT networks and therefore it is not important to understand how the systems they are trying to protect work.

In order to defend and optimize the plants, buildings, facilities, and transportation, one needs to understand how the systems and components work. It doesn’t make sense that the approaches attackers have used to successfully compromise physical infrastructures continue to be ignored by the cyber defenders. 

The Gap Between OT And Engineering

IT and OT cyber security focuses on the Internet Protocol networks and are under the purview of the CISO. Control system field devices such as process sensors are used for reliability, safety, predictive maintenance, and cyber security. Control system cyber security focuses on the field devices such process sensors and their associated lower-level networks which are often serial.

These field devices have no cyber security and are under the purview of engineering. Protecting these field devices is different from protecting IT or OT networks and requires different technologies and training. When control systems are impacted, the results are obvious – trains or planes crash, pipelines rupture, power is lost. Because of the lack of control system cyber forensics and training, these incidents are generally not identified as being cyber-related. Yet, to date, there have been more than 11 million control system cyber incidents with more than 34,000 deaths. There is a need to address this cyber security gap in technology, training, and culture.”

Connecting The Dots

Unfortunately, dots are still not being connected in control system cyber security: incidents continue to occur in all sectors that are not shared within the sector or between sectors. That is obvious from my database where the same types of incidents occur within multiple sectors. The focus on IT and OT also limits recognizing cyber incidents that didn’t involve IP networks as being identified as being cyber-related. This was obvious from the RSA session.

Education

Cyber security is taught as a subdiscipline of computer science. There are very few universities that require an introduction to engineering for cyber security. Conversely, there are very few universities that require the engineering disciplines of electrical, mechanical, chemical, nuclear, or systems engineering to include an introduction to cyber security. This past year, I was a senior research associate at the University of Missouri Science and Technology. The course I supported required a capstone project to take an engineering/utility company and determine how well the student felt it met the NIST Cyber Security Framework. The students were neither engineers nor from the utility industry, and they could only use publicly available data for their projects.

They found issues that weren’t identified by the utilities’ cyber security organizations – appropriate training can work.

I also talked to a utility senior manager who was teaching a cyber security course at a university and felt it was too complex to even mention control systems. Unfortunately, this is the norm and it’s why there is such an education gap. The process sensor issues are not being addressed even with the work being done by CISA and ISA on OT cyber security training.

Lack Of Understanding Of Systems & Components

The fundamental approach for offensive cyber operators when they attack an industrial or manufacturing system is to identify the impact they want to achieve and then study the systems to find out the best way to accomplish the goal. That is, they want access to specific pumps, motors, valves, relays, etc. to accomplish their goal.

Accomplishing that goal may involve a combination of physical, IT, OT, and control system cyber approaches.

Additionally, offensive cyber operators may use the IP networks as part of their attack technique using approaches such as man-in-the middle attacks to provide the operators with misleading information. Often, the cyber approaches may be very basic as the control systems often are not designed to keep cyber attackers out. Consequently, state-of-the-art zero days are not needed. Process sensors are 100% trusted and are the input to OT monitoring systems that cannot detect or correct sensor data.

This means the offensive path of least resistance is where there is no cyber security - the process sensors and their ecosystems. This is what the ICS cyber “kill chain” defenders continue to ignore.

The fundamental approach of OT cyber security defenders is to assume that what needs to be defended are the OT networks and therefore that it is not important to understand how the systems they are trying to protect work. Unlike the offensive attacker’s attempt to cause a specific impact, compromising an OT network does not directly lead to an affect on specific pieces of equipment. For example, if the OT network is in a power plant, there is no understanding by many OT security defenders how a power plant and the equipment in the plant work and the associated system interactions. Process sensors are also the input to OT networks, and OT security experts commonly assume these to be uncompromised, authenticated, and correct which makes the attacks possible. It is not a “fair fight” when the defenders won’t address what the attackers are targeting especially when many of the networks and devices being targeted have no cyber logging or forensics.

Understanding how the systems and components work is not just a cyber exercise as the process sensors are the input for predictive maintenance, digital transformation, Industry4.0, smart manufacturing, smart grid, etc. In a recent plant test, the Windows-based HMI was not effective and, in fact, provided misleading information on the state of the process sensors and plant equipment.

Monitoring tools for process sensors and plant equipment need to be purpose-built, not general-purpose systems such as Windows. When sensors are wrong, equipment can be damaged and people can die.

Unfortunately, you don’t need to be a cyber expert to impact sensors. Two fast food workers told police they wanted their shift at the fast-food restaurant to slow down. During the interview, they told the police their intentions were that if the railroad crossing gates could malfunction and they could somehow block traffic, that would prevent people from getting to the restaurant, and they could have a slow night at work. Police said one of the fast food workers placed a makeshift device on the tracks that affected the crossing gate sensors. The railroad’s dispatch center could not have determined that the crossing gate signals were being intentionally disrupted. This was a control system cyber incident, one of many that have affected rail transportation.

Inadequate Government Approaches

Recent events have shown that pipeline cyber security requirements are inadequate and there have already been more than 125 recorded control system cyber incidents in water/wastewater that include complete loss of water, water hammer, chemical contamination  pumping contaminated water into the drinking water system This is trivial compared to the 2005 collapse of the Taum Salk earthen dam and the loss of billions of gallons of water because of inaccurate sensors.

The US Cyber Incident Reporting for Critical Infrastructure Act assumes cyber forensics exist, which is not the case for legacy ICS field devices. The zero trust initiative promtoted by CISA also does not apply to legacy control system devices that do not have minimal cyber security capabilities and are 100% trusted.

Summary

Control system cyber security is more than just protecting IP networks. In order to defend and optimize the plants, buildings, facilities, and transportation, one needs to understand how the systems and components work. It doesn’t make sense that the approaches attackers have used to successfully compromise physical infrastructures continue to be ignored by the cyber defenders.

Joe Weiss is Managing Partner at Applied Control Solutions

You Might Also Read: 

Industrial Control System Security Is Overlooked:

 

« Quantum Computing Raises As Many Problems As It Solves
Securing The Future Of Open Finance »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

E-Tech

E-Tech

E-Tech has been providing system support and information technology consulting services including Internet and Network Security assessments.

UCD Centre for Cybersecurity and Cybercrime Investigation

UCD Centre for Cybersecurity and Cybercrime Investigation

UCD Centre for Cybersecurity and Cybercrime Investigation is Europe's leading centre for research & education in cybersecurity, cybercrime and digital forensics.

IX Associates

IX Associates

IX Associates is a UK based IT Integration business specialising in risk, compliance, eDefence, and network security solutions.

Security Weekly

Security Weekly

Security Weekly provides free content within the subject areas of IT security news, vulnerabilities, hacking, and research.

CERT.AZ

CERT.AZ

The national Cyber Security Center of the Republic of Azerbaijan.

CERT.BY

CERT.BY

The National Computer Emergency Response Team of the Republic of Belarus.

Professional Information Security Association (PISA)

Professional Information Security Association (PISA)

PISA is an independent and not-for-profit organization for information security professionals, with the primary objective of promoting information security awareness and best practice.

Cyber DriveWare

Cyber DriveWare

DriveWare analyzes new traffic in the I/O layer and blocks malware and cyber attacks which organizations have no means to protect against.

Network Integrated Business Solutions (NIBS)

Network Integrated Business Solutions (NIBS)

NIBS is an IT services provider offering a range of services with the aim of simplifying and securing technology.

Crypto Quantique

Crypto Quantique

Crypto Quantique's ground-breaking technology radically simplifies the process of generating a hardware root of trust in an IoT device.

IntelligInts

IntelligInts

IntelligInts provide 24×7 threat monitoring, hunting, alerting, and mitigation in our world class Security Operations Center.

ISTC Foundation

ISTC Foundation

ISTC Foundation is one of the leading innovation centers in Armenia, founded by joint initiative of IBM, USAID, Armenian Government and Enterprise Incubator Foundation.

Analygence

Analygence

ANALYGENCE is your trusted partner for mission support, cyber solutions, and management services.

Zaviant Consulting

Zaviant Consulting

Zaviant Consulting is a leading data security and privacy consulting firm assisting organizations comply with constantly evolving security frameworks and privacy regulations.

HIFENCE

HIFENCE

HIFENCE delivers cybersecurity and networking services that make your company safer and more secure. That’s all we do, so you can concentrate on all the things that you do best.

Cyphershield

Cyphershield

Cypershield is a Security and Smart Contract audit company providing professional smart contract auditing services for varied Crypto projects.