Creating a cybersecurity culture for industrial control systems

Many critical infrastructures rely heavily on flow control for containment, control and movement, and the measurement of liquids, gasses, and slurries. Critical infrastructure providers (CIP) include water and wastewater, agricultural irrigation systems, oil and natural gas pipelines, discrete and process manufacturing, and transportation systems.

Operational technology (OT)[1], used in industrial control systems (ICS) for flow control, has been a critical part of operating, monitoring and maintaining physical infrastructure for decades. However, as OT has become digital, information technology (IT) has been an increasing part of that evolution, providing platforms, software and networks to enhance control and functionality.

Unlike IT, the core deliverable of OT is not information. Instead, the core deliverable of OT is a management of state. For example, if a valve needs to be opened or closed, OT can open or close it; If a gas pipeline experiences pressure beyond its operating parameters, OT can bring it back within tolerance levels.

The industrial internet stretches from traditional OT, such as supervisory control and data acquisition (SCADA) systems, to the emerging Internet of Things (IoT)[2] whose "nervous system" is digital and software-based. The Industrial Internet of Things’ (IIoT), sometimes referred to as Industry 4.0, control elements such as sensors, valve actuators and pumps are acquiring a "digital skin," exponentially increasing the digital presence in flow control ICS.

The nature of the risks is different between IT & OT worlds:

• Business risks are mainly related to the confidentiality and integrity of the data processed and hosted by the IT systems, which leads to intangible consequences such as loss of know-how and loss of reputation.
• For OT systems, business risks are related to the availability, integrity, reliability and safety of the ICS itself. Risks include operational consequences in the physical world such as production shutdown and financial losses, environmental damage and the inability to control the process or to obtain accurate information about its state.

Common beliefs that OT environments were impervious to outsider threats are now known to be false. Industrial corporations are increasingly connected with each other to improve efficiencies and OT systems are starting to resemble IT systems. To take advantage of the digital supply chain benefits, industrial corporations may allow suppliers to connect to automation systems for maintenance and asset management services. This integration provides significantly less isolation for OT from the outside world, creating a greater need to secure these systems. According to Frost & Sullivan,[3] the supply chain introduces weaknesses, allowing threats and entry point access to critical infrastructures which requires thinking of the value chain as a whole.

OT environments are vulnerable and exposed to cyberattacks. Persistent design vulnerabilities (PDVs) are inherent in OT systems as part of their function.[4] The International Society of Automation (ISA), describes it this way: "OT systems are not designed to ensure resilience against concerted attacks that intend to place components in dangerous operating states. This is expected to be a growing area of cyberattack and engineering research." As OT environments incorporate IT technologies, IT-related vulnerabilities are introduced.

Because of the longer OT life cycle (10 to 15 years), widely dispersed and legacy systems cannot be patched or upgraded in typical IT security fashion. As a result, OT environments remain highly vulnerable for long time periods.

Meanwhile, in addition to the nature of OT environments, the knowledge and skills needed to attack OT networks are spreading rapidly, so that the OT-related cyber risks have reached a critical threshold and require immediate action.

OT cybersecurity and regulatory risk

It is generally accepted that a significant governance, knowledge, and experience gap exists between the IT and OT domains. OT staff have process engineering expertise but little or no cybersecurity training and understanding. Closing this gap to make OT staff part of the cybersecurity chain is critical.

More broadly, on behalf of senior executives, chief security officers (CSO) and chief information security officers (CISO) are requested to establish a consistent cybersecurity operating model integrating the OT environments to address the following issues:

• What are the major OT assets to protect? Are they vulnerable? Where are they located? Are external and internal threats considered? Does the organization understand the origin of threats (e.g. cyber criminals, competitors, governments, rogue employees, etc.)?
• How shall OT cybersecurity be governed within the organization? Is it well-integrated into the corporate governance? Are the roles and accountabilities well-defined among industrial site directors, IT, OT and cybersecurity stakeholders?
• What are the major OT cyber risks the organization faces? What are the risks of compromising the OT network to enter the corporate IT network or vice versa? Is the organization able to detect abnormal events and weak signals of cyberattacks?
• How can OT staff members be made aware of their roles related to cybersecurity? Did control engineers receive some basic cybersecurity awareness training?
• In the event of a serious OT cyber incident, which incident response and crisis management process needs to be developed?

Especially for CIP or operators of essential services, increasing regulatory pressure will require the CSO and the CISO to accelerate the enforcement of cybersecurity best practices and the readiness to detect and provide notification of severe cyber incidents.

The United States National Institute of Science and Technology (NIST) Framework and the European Networking and Information System (NIS) Directive requires critical operators to conduct risk assessments exercises and to detect and provide notification of their severe cyber incidents to the national or federal information security agencies (to avoid potential systemic effects). Therefore, the main current CSO and CISO challenge is to raise awareness at the industrial director’s level and to increase their influence across the organization to address in a holistic way increasing OT-related risks.