Standing up to cyber threats

It is a battlefield out there

Author: Dr Dorian Hindmarsh, Commercial Director, Proeon Systems

We do not like to admit it, but our appetite for technology and the connected everything is blurring our admission we’re at war. It’s not a conflict in the true sense of the word, with hand-to-hand combat and bombs, but it is a conflict that affects us all. It can damage people, business, finances and of course the environment.

By using digital technology as our basis for control, passing information and simplifying tasks, we need to understand that there are new issues to contend with. Historically, remote sites, offices or plants were communicated to via telephone lines, voices, people to people, direct instructions (and this does still happen in certain places). However, as we start to rationalise, assess and review, we see that technology has developed many answers to problems we didn’t know we needed solving and potentially, given rise to more problems.

Remotely controlling assets, processes and transactions, monitoring back at the head office, the remote sites and collating information are now the metrics of good business practice. Data is often more valuable than the product or process that’s being monitored.

The energy sector is a prime example of this: a high value, high demand commodity, with many assets positioned remotely and a requirement to gather as much detail as possible, where risk is not just financial, but also impacts the broader dependants, right up to governments.

The blurring of the terms operations technology (OT) and information technology (IT) into a confusing array of network switches, industrial PLCs and office PCs with a smorgasbord of interfaces, access levels, functions and communications platforms is seriously not helping unpick this either.

So, what’s the easiest option?

We’re all human. We look for the easiest solution to a complex problem and the fastest way to take the problem away. Well, we typically build a wall. It’s easy: brick by process-orientated brick we build up, protecting our valuable assets. Taller, to present an imposing barrier to the enemy. Thicker through complex passwords and procedures to slow down the advance from chipping away.

Defence is easy: use another brick and stack them high, make it thick.

There must have been a point in history when the wooden motte-and-bailey fortification was replaced by a stone wall and castellations, a moment in time when the stones were replaced by steel reinforced concrete and bunkers. Now surface-to-air missiles and fast interceptor jets defend.

And just like the evolution of our physical walls, defence technology is progressing, evolving with Digital 4.0

The issue is defence: it is reactionary, it reacts to a new threat, adapts passively, slowly and with a different meter. And some may argue that it has no other choice. I beg to differ.

Let’s look at the aggressor, the protagonist, the lobber-of-stones. Let’s not get specific with clichés over teens in back bedrooms mounting attacks on your operations for spite, we need to look at all aspects, from hostile governments to financially incentivised groups in offices bigger than yours, terrorists and disgruntled employees.

Motivation is for another time, but let’s talk about scale and the resources of the aggressor. In any war, generally, there are many battles and many casualties; however, the aggressor is not hanging around, waiting, counting the next shipment of bricks to arrive. They are dynamic, agile, entrepreneurial, scheming. Their aim is to break through a growing brick wall, after all. The pace is different. Trying an attack on your defences with tight focus, there are no restrictions, no procedures to follow, no regulations to be audited against – they can literally try anything. Rather like a business entrepreneur, they’re looking for a niche. A high failure rate is a given, each attempt to gain access is a learning curve (often shared with others), and useful knowledge is gained about the height and thickness of your wall.

This attacking aggressor, for whatever reason, will not rest until your wall is breached.

So, what can you do?

Well, conformance to a standard is a start (ISO/IEC27001, IEC62443, etc. etc.). That will tell you where to place your bricks, what type of mortar you need and maybe even how to use a portcullis to allow staff in and out. These procedures will integrate into your business management systems and quality management systems and enable you to spot areas for improvement on obvious risk, and this should be your first step!

However, they, the aggressors, know this too. That’s the issue with standards…they’re standard!

Thinking beyond that first step, perhaps you could consider technology changes, reduce risk through common mode failure reduction. One OEM might be a target for a would-be cyber ninja, and if your entire plant runs on that OEM’s equipment, you may suffer.

Can you maintain the separation of OT and IT? Sure, they use similar hardware, but failing to secure the rogue USB memory stick with that cartoon meme that’s been going round the finance office may be an epic fail for the engineering department later on.

Upgrades and the latest tech: this is an area you should get to grips with. If each rogue opponent on the other side of the growing wall can try new things at each failing, so can you. Develop a strategy of continuous improvement (a term bandied around a lot) but before initiating the latest tech on your fleet of offshore wind turbines or your hydrogen plant, try building a model first. The adapted term is a ‘digital twin’ and for many it means different things, but building a functioning digital model in a safe environment (sometimes called a ‘sandbox’) can enable you to quickly and efficiently test successes and failures long before you install it on your plant.

This twin of your plant’s control process has many advantages, and when maintained in parallel, can give you the ability to test OEM systems patches for compatibility, make changes to process for improvement, highlight challenges and build a perfect staff training facility. All within the safety of an offline environment.

Why not? It’s what your aggressor is doing, except their sandbox is your real-life system.

Staff need to understand their role and accountability in all aspects of cybersecurity, keeping them informed, trained and on-side is as important as your systems. No point building a castle and leaving the fire door open, is there? People are often seen as the most common point of failure for cybersecurity. But with the right mix of training, discipline and knowledge, we can mitigate against it.

And finally, layers of protection are often at the heart of any defence system, but do not discount the option to unplug it entirely. Do you need to connect it? Can it be on its own island?