Industrial Cybersecurity
Operational Technology keep essential services running and as long as they are working, no one notices. These systems maintain control of system variables such as flow, temperature, or chemical dosing and require complex integration with equipment located over a large geographical area. Loss of control of these variables can lead to significant economic impact, equipment downtime, loss of fire protection or safety systems and in some cases, physical injury or death.
We utilize Cybersecurity principals based on the ISA/IEC 62443 set of standards. These standards assist us in helping clients identify their operational risks and developing a clear, sustainable path towards safe and efficient operation of their critical equipment. Our solutions our customized to each Client to align with budgets and timelines. We develop solutions to provide peace of mind and build confidence in your industrial system. Failures cannot be eliminated; however, their impact can be managed.
What is Industrial Cybersecurity and how is it different from the Cybersecurity we hear about in the news?
Industrial Cybersecurity covers the world of Operational Technology. This is the critical equipment and networks that operate power systems, water treatment plants, industrial processes and mining operations. Industrial Cybersecurity prioritizes the availability of equipment where a failure may have direct impacts to health, safety, environment and operation. By comparison, conventional Cybersecurity (that you typically hear about in the news) prioritizes the confidentiality of data (i.e. credit card data) in the IT realm.
Industrial Cybersecurity is a relatively new and commonly overlooked area in the world of high availability, long lifespan processes. Industrial network infrastructure is the backbone of your operation. Modern processes typically utilize, and rely, on a plethora of networked devices to control everything from power and process control to base level instrumentation. Industrial networks must work in parallel with existing IT infrastructure to carefully define accountability and establish a multi-layered, Defense in Depth. By building multiple layers of defense, the failure of (or attack on) a single device can be limited by reducing the size of exposure. This in turn reduces the potential damages or impacts to safety.
In developing our workflows and implementing our services, we typically utilize a multi-layered Defense in Depth strategy embedded in the framework of a Cybersecurity Management System. It sounds like a mouthful but what does that really mean? To assist in understanding what that means and how Industrial Cybersecurity applies to your facility, we have developed a series of answers to common questions. Please see the link below for further information.
Does Industrial Cybersecurity apply to me?
Do you operate or maintain facilities or processes that require high availability or in which a failure of process control system would result in impacts to health, safety or environment? If the answer is yes, then Industrial Cybersecurity applies to you.
My PLC is 20 years old. What is the direct replacement?
When modernizing equipment, it is essential to consider your options. Before you start, is your documentation in line? A direct replacement of the controller might work the same as before, but is that process required? Could it be accomplished with a more cost-effective solution that utilizes technologies that did not exist 20 years ago? Maybe there is another component that is at higher risk for failure or compromise.
By looking at modernization from an Industrial Cybersecurity perspective, we can validate the selection of the equipment to be modernized and how it integrates. When looking at the system from a risk management perspective, it can be clearly identified where the highest value in modernization can be achieved and then turned into a staged implementation. This way, the solution not only meets your budget, but provides peace-of-mind and improves the resilience of your facility.
Our IT department already has a Cybersecurity program in place. Why do I need a separate plan for Industrial Cybersecurity?
IT and OT (Operational Technology) need to work hand in hand. Most industrial systems today have some type of routable network (i.e. Ethernet). If you have remote access or (cringe) internet available on your Operational Equipment, than IT and OT networks are likely interconnected somewhere.
Can IT departments look after OT systems?
Sure, if they have the resources and realize the implications. The priorities of the departments can be broken down using the CIA acronym. For IT departments, this is typically Confidentiality, Integrity and Availability. For example, it is essential that email and banking transactions remain confidential. The impacts of a breach of confidentiality can typically lead to legal actions and financial ramifications. In the OT world, the priorities are reversed, with Availability being paramount. Operational systems must prioritize availability to ensure that safety systems and processes continue to operate. The impacts of a breach of availability can typically lead to safety system failures and process shutdowns that may have a financial impact but can also have impacts to health, safety and the environment. For example, what is the expected availability of a chlorine dosing system in a water treatment plant? Does it need to operate 9-5 Monday to Friday or are the weekends important too? In the event of an operational failure, who is responsible for looking after the equipment. In the end, is comes down to accountability. Who is accountable for that industrial, OT, system?
Can’t we just use the policies from our IT department and apply them to our OT network?
While the world of IT is well versed in Cybersecurity practices, there are different levels of service, operating environments (including PPE for service personnel), equipment lifespans, patching schedules and consequences from failure. It is essential that IT and OT departments work together, however they need to understand where accountabilities lie. For example, what is the anticipated lifespan of that equipment being serviced? IT equipment is typically 3-5 years and OT equipment is typically 15-20 years.
I regularly receive false alarms from my system, is this normal? Have I been hacked? How can I regain control of my industrial network?
In OT systems, availability is paramount. You must be able to rely on the system to provide real-time, and up-to-date information. Are the alarms a result of network issues, computer issues, software issues or actual alarms? It is not normal. A properly functioning industrial network must be reliable and contain fail-safes to ensure high availability of critical data.
For further information on alarms, check out this following post;
The CMOS battery died in my PLC. Can you re-program it for me?
Unfortunately, this question arises more that it should and ultimately leads to us responding with “Do you have the original program?”. Where does the accountability for operation of the system sit and what type of Disaster Recovery plans are in place? Have they been tested? A critical component of a Cybersecurity Management System is a disaster recovery plan. Accidents happen, faults are made, equipment fails, the important thing is minimizing the risk and reducing the costs of remediation.