The Complexities Of Operational Technology Make It Vulnerabe

A range of critical vulnerabilities affecting hundreds of operational technology (OT) vendors and networks are emerging across various industries, including energy distribution infrastructure, production vehicles and robotics, food and pharmaceuticals.

Typically, these affect operational networks integrated into industrial command and control systems, which, because of their operational complexity, require a high level of sophistication to install cyber security controls.   

The notorious Stuxnet exploit first demonstrated that even air-gapped and heavily supervised networks can be infiltrated, software modified and routine processes sabotaged.  Fifteen years later, the OT environment remains an attack vector due to its environmental complexity.

OT complexity creates broad attack opportunities.  work processes involving reduced interfaces and involvement of IT personnel in working and manufacturing operating environments and due to the difficulty in monitoring operational networks because of the presence of multiple components from different manufacturers and protocols.These also include the ability to import and read different types of protocols into a single, unified screen for cross-referencing and alerting to unusual events. Improving the monitoring capability of OT networks will help better cyber control and protection in operational networks.

The key to planning controls wisely in the face of risks should be based on the analysis of the network’s typology.

The most popular among them is the Purdue model, another model is the Triangular model (based on ISA 95). The advantage of analysing network typology is the ability to associate controls to layers according to the network’s hierarchy and also enables a picture of the state of controls in relation to each layer. One of the trends in recent years is the ability to monitor Level 0, connected with the ability to measure the end physical action. This capacity enables separation and independence in computing and software processes and the ability to manipulate through them. It also enables to base on the final result as a measure and control for the process as a whole.

The adversary’s modes of operation reflect advanced attack competencies, creativity, which is also based on the gathering and use of technologies and tools for preliminary intelligence gathering, the availability of ready made attack tools on the Dark Net, as as well as Zero-Day attack capabilities. 

All these require from the defender creativity, active protection processes that acknowledge the attacker’s capabilities in order to know the gathering methods, such as the use of Shodan, to create robust controls capable of defending the boundaries of OT networks. 

Cyber security resilience  can measured, among other parameters, by the period of time and the ability to return to productivity at the work environment after an attack. 

Organisations need to adapt quickly to the expansion of cyber security threats in 2022, particularly to protect critical OT infrastructure. As hybrid work has clearly become the norm across industries and more OT devices connect to corporate networks each day, IT and OT security leaders will need to consolidate teams, policies, tools and reporting to both protect their organisations and to comply with the inevitable flood of new regulations coming down the pike.

Power-Technology:     Gartner:        Verdict:       I-HLS:        Forescout:    Security Magazine: 

Infosecurity Magazine:       ESET:  

You Might Also Read:

Industrial Companies At Risk As Attacks Double: