.png?width=40&height=40&name=search%201%20(1).png){kind=small}
Revolutions have a habit of creating new problems that their advocates did not anticipate, and the Fourth Industrial Revolution is no exception. For example, it seems safe to say that most of the engineers who overhauled industrial control systems (ICS) by linking them to the internet did so with the aim of expanding and optimizing functionality, not with the intent of creating new avenues for industrial espionage. Likewise, the bookkeepers who approved the introduction of connected systems probably did so because they were looking to save money and increase efficiency, not because they hoped to facilitate the sabotage of critical infrastructure networks.
Nevertheless, as any cybersecurity professional can attest, the unexpected has happened. Connected ICS solutions have given cybercriminals and other rogue actors a means of targeting operational technology (OT) systems, as well as information technology (IT) networks. And their activities pose genuine threats, as evidenced by the US government’s conclusion that last year’s hacking of Solar Winds server software had compromised a wide range of public- and private-sector entities, including the operators of critical infrastructure facilities.
In short, organizations that make use of sophisticated ICS face real problems. So what are the best ways to address the situation?
The US government has already put forward a policy solution. In 2004, it established the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS).
Since then, CISA has taken on a dual mission. First, it leads federal authorities’ efforts to identify, assess, and manage cyberthreats. Second, it partners with other public- and private-sector entities with the aim of helping them to manage risks and to maximize their resilience in the face of those risks.
As its name might indicate, the agency’s efforts in both directions aim to safeguard the country’s critical infrastructure. CISA defines critical infrastructure as “the physical and cyber systems and assets that are so vital to the United States that their incapacity or destruction would have a debilitating impact on our physical or economic security or public health or safety.” It also identifies the systems and assets in question as those supporting the operations of vital sectors of the economy, including but not limited to agriculture, communications, defense, energy, finance, healthcare, manufacturing, transportation, and utilities.
Since all of those critical sectors make use of connected ICS, CISA has evolved a strategy for combating cyberthreats to the OT networks that sustain critical infrastructure operations. It spelled that strategy out in detail in July 2020, when it released “Securing Industrial Control Systems: A Unified Initiative,” a report on CISA goals for the FY 2019-2023 period. That document outlines plans for expanding cooperation between public- and private-sector entities in order to expand access to cybersecurity resources, to anticipate and prevent cyberattacks, and to ensure that ICS are made to be secure by design and not as an afterthought.
At Garland Technology, we believe that one of the single most important considerations in these decisions ought to be visibility. To put it bluntly, critical infrastructure operators will have a hard time protecting operational networks that they cannot represent in forms that allow for visual scans, even if they make good decisions in every other respect.
Accordingly, they can’t expect optimal results unless they implement best practices in visibility fabric architecture. If they do, they stand a much better chance of eliminating the blind spots that can hinder ICS security solutions from ensuring continuous monitoring of devices and equipment, as well as detecting anomalies and threats.
In practical terms, this means choosing solutions that allow operators to conduct thorough analyses of packet data visibility. It means taking the time to ensure that security and infrastructure strategies facilitate the deployment of products that work with inline security tools to monitor, manage, and direct data flows, such as network test access points (TAPs), air-gapped virtual TAPs, and data diodes.
And above all, it means adhering to the principle that you can’t secure what you can’t see.
Looking to add OT visibility to meet CISA recommendations, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do.
