Revolutions have a habit of creating new problems that their advocates did not anticipate, and the Fourth Industrial Revolution is no exception. For example, it seems safe to say that most of the engineers who overhauled industrial control systems (ICS) by linking them to the internet did so with the aim of expanding and optimizing functionality, not with the intent of creating new avenues for industrial espionage. Likewise, the bookkeepers who approved the introduction of connected systems probably did so because they were looking to save money and increase efficiency, not because they hoped to facilitate the sabotage of critical infrastructure networks.
Nevertheless, as any cybersecurity professional can attest, the unexpected has happened. Connected ICS solutions have given cybercriminals and other rogue actors a means of targeting operational technology (OT) systems, as well as information technology (IT) networks. And their activities pose genuine threats, as evidenced by the US government’s conclusion that last year’s hacking of Solar Winds server software had compromised a wide range of public- and private-sector entities, including the operators of critical infrastructure facilities.
In short, organizations that make use of sophisticated ICS face real problems. So what are the best ways to address the situation?
Policy solutions: CISA’s five-year strategy calls for expanding cooperation across the sector
The US government has already put forward a policy solution. In 2004, it established the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS).
Since then, CISA has taken on a dual mission. First, it leads federal authorities’ efforts to identify, assess, and manage cyberthreats. Second, it partners with other public- and private-sector entities with the aim of helping them to manage risks and to maximize their resilience in the face of those risks.
As its name might indicate, the agency’s efforts in both directions aim to safeguard the country’s critical infrastructure. CISA defines critical infrastructure as “the physical and cyber systems and assets that are so vital to the United States that their incapacity or destruction would have a debilitating impact on our physical or economic security or public health or safety.” It also identifies the systems and assets in question as those supporting the operations of vital sectors of the economy, including but not limited to agriculture, communications, defense, energy, finance, healthcare, manufacturing, transportation, and utilities.
Since all of those critical sectors make use of connected ICS, CISA has evolved a strategy for combating cyberthreats to the OT networks that sustain critical infrastructure operations. It spelled that strategy out in detail in July 2020, when it released “Securing Industrial Control Systems: A Unified Initiative,” a report on CISA goals for the FY 2019-2023 period. That document outlines plans for expanding cooperation between public- and private-sector entities in order to expand access to cybersecurity resources, to anticipate and prevent cyberattacks, and to ensure that ICS are made to be secure by design and not as an afterthought.
Operational solutions: Each individual actor is under pressure the make the right decisions
These all sound like reasonable ideas. So far, though, CISA’s plans don’t seem to have drawn an enthusiastic response. Coverage of the five-year strategy document has been muted, with nearly all media outlets describing the report in terms that mirrored the agency’s own press release rather than assessing its impact. (One notable exception was Nextgov.com, which pointed out that CISA had not addressed private-sector entities’ concerns about liability for cyberattacks.)This raises the question, then, of how the cybersecurity risks identified and targeted by CISA actually play out on the ground, on the shop floors of the organizations that operate the country’s critical infrastructure system.
There’s no single answer to this question. There can’t be, because all of the infrastructure operators affected by these risks operate with some degree of independence. Private companies are, by definition, not part of any government body, even though they remain subject to federal, state, and local laws. Meanwhile, public-sector entities may answer to state or local administrations rather than the federal government, and even federal-level entities do not always act in concert.
As a result, much depends on the specific defense strategies formulated by individual operators. That is, each and every entity involved must decide how to reduce risks, detect threats, and ensure operational visibility so that they can ensure continuous monitoring of their IT and OT assets (along with their firmware) and detect threats and anomalies, such as malware and device malfunctions, in real time. Moreover, they all have to make these decisions preemptively, so that they can predict, prepare for, and practice for real-life threats (and not just address them after the fact).
Visibility solutions: You can’t secure what you can’t see
At Garland Technology, we believe that one of the single most important considerations in these decisions ought to be visibility. To put it bluntly, critical infrastructure operators will have a hard time protecting operational networks that they cannot represent in forms that allow for visual scans, even if they make good decisions in every other respect.
Accordingly, they can’t expect optimal results unless they implement best practices in visibility fabric architecture. If they do, they stand a much better chance of eliminating the blind spots that can hinder ICS security solutions from ensuring continuous monitoring of devices and equipment, as well as detecting anomalies and threats.
In practical terms, this means choosing solutions that allow operators to conduct thorough analyses of packet data visibility. It means taking the time to ensure that security and infrastructure strategies facilitate the deployment of products that work with inline security tools to monitor, manage, and direct data flows, such as network test access points (TAPs), air-gapped virtual TAPs, and data diodes.
And above all, it means adhering to the principle that you can’t secure what you can’t see.
Looking to add OT visibility to meet CISA recommendations, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do.
