Cybersecurity is becoming an increasingly important aspect of plant safety as new strategies and technologies are implemented. Eugene McCarthy reports.
Tofino Security, a brand of Belden, and a leader in signal transmission solutions for mission-critical applications, has published new research showing that patching is often ineffective in providing protection from the multitude of vulnerability disclosures and malware targeting critical infrastructure systems today. Patching is routinely carried out by process industry companies.
While patching such systems is important as part of an overall defence in depth strategy, the difficulties of patching for industrial systems mean that compensating controls such as Tofino Security Profiles are often a better method of providing immediate protection, says the research.
Since the discovery of the Stuxnet malware in 2010, industrial infrastructure has become a key target for security researchers, hackers, and government agents.
Designed years ago with a focus on reliability and safety, rather than security, supervisory control and data acquisition (SCADA) and industrial control systems (ICS) products are often easy to exploit. As a result, there has been exponential growth in government security alerts for these systems in the past two years. In addition, they have attracted some of the most sophisticated (Stuxnet, Night Dragon, Flame) and damaging (Shamoon) cyberattacks on record.
Eric Byres, cto and vice president of engineering at Tofino Security, investigated the effectiveness of patching for protecting control systems from vulnerability exploits and malware. His work revealed that: the number of vulnerabilities existing in SCADA/ICS applications is high, with as many as 1805 yet to be discovered vulnerabilities existing on some control system computers; the frequency of patching needed to address future SCADA/ICS vulnerabilities in both controllers and computers probably exceeds the tolerance of most SCADA/ICS operators for system shutdowns.
Unlike IT systems, most industrial processes operate 24/7 and demand high uptime. Weekly shutdowns for patching are unacceptable; even when patches can be installed, they can be problematic. There is a 1 in 12 chance that any patch will affect the safety or reliability of a control system, and there is a 60 per cent failure rate in patches fixing the reported vulnerability in control system products. In addition, patches often require staff with special skills to be present. In many cases, such experts are often not certified for access to safety regulated industrial sites. In addition, patches are available for less than 50 per cent of publically disclosed vulnerabilities, and many critical infrastructure operators are reluctant to patch as it may degrade service and increase downtime.
When patching is not possible, or while waiting for a semi-annual or annual shutdown to install patches, an alternative is to deploy a workaround, also known as a 'compensating control'.
Compensating controls do not correct the underlying vulnerability; instead, they help block known attack vectors. Examples of compensating controls include product reconfigurations, applying suggested firewall rules, or installing signatures that recognise and block malware.
Unidirectional security gateways
Meanwhile Waterfall Security Solutions and software and security technology company OPSWAT have announced a joint solution for protecting unidirectionally-protected critical industrial infrastructures.
Waterfall's hardware-enforced Unidirectional Security Gateways safely and securely integrate industrial networks with corporate networks. OPSWAT's Metascan server technology enables scanning of files with up to 30 antivirus engines simultaneously. Together, Waterfall's Unidirectional Gateways are able to scan data using OPSWAT's Metascan engine before the data is transferred through the gateway system. The joint solution can be used to ensure that data entering critical networks or corporate networks is free of malware.
Easing the compliance process
Siemens also offers assistance in the cyber security compliance process. Its in-house cyber emergency response team (CERT) can help customers achieve NERC critical infrastructure protection (CIP) compliance.
The company's on-site cyber security and NERC CIP assessments are designed to help identify any existing security vulnerabilities in control systems, related IT infrastructures and beyond.
Together with its cyber security alliance partners, Siemens provides comprehensive security audits to assess compliance with NERC CIP-002 through to CIP-009. Such assessments are conducted by Siemens' own cyber security experts and, as needed, with experts from its alliance partners.
The process includes evaluating current control systems, and related cyber systems to assess whether they meet the controls relevant CIP-005, 007 and 009 sections. These sections also can be addressed separately from the overall assessment.
According to Invensys, now part of Schneider Electric, many process industries are facing cyber security challenges driven by internal requirements, industry standards, or government regulations. Its solutions cover life cycle methodology, cyber security network management, security best practices, and secure data acquisition (Fig.1).
To this end the company has published a raft of online best practices datasheets that cover topics such as: industry-agnostic best practices, success stories from different industries, the top five cyber myths for industry, detailed description of onsite security assessments, and the role of managed security services
