As industrial control system (ICS) security managers, we know cyber attackers have skills well beyond traditional information technology (IT) intrusions and data exfiltration techniques. They have long since set their sights on operating technology (OT) environments and demonstrated an understanding of ICS and the skills to develop ICS-capable attack tools to gain access and cause negative effects.
Cybersecurity attacks often focus on internal system damage, where the consequences for ICS are greater and potentially external in nature as well, because attacks can affect the safety of people and the environment, depending on the type of facility. ICS intrusions can change physical changes with potentially catastrophic consequences – consider for example a compromised safety instrumented system (SIS) that fails to monitor and safely shutdown a gas pipeline in an over-pressurized condition.
Consequences of modern ICS cyber-attacks on an even grander scale can include:
- Large power grid blackouts in large cities and entire regions
- Failure of critical manufacturing equipment
- Massive business financial losses
- Paralysis of smart city emergency infrastructure in large municipalities
- Injury of plant workers
- Serious environmental damage.
ICS intrusions will continue to occur and likely increase in their severity and range of consequences across critical infrastructure sectors. However, managing control system cyber risk and tactical ICS/OT defense is doable and it can protect critical resources and focus on recovery that improves resilience and reduces mean recovery time.
Proactive ICS cyber defense and incident recovery
Whether you are a new, experienced or “step-up, step-over, or in-place ICS security manager”– the title of a blog on the SANS ICS418: Security Essentials for Managers course – you will do well to focus on ICS-specific defenses to prevent adversaries from getting into an industrial network in the first place. In parallel however, to protect critical infrastructure before an attack does occur, you’ll need to work with engineering teams to refine the recovery processes to improve resilience going forward.
As ICS security managers, we need to support our teams and lead them to success. This first means positioning our team members and technologies in an Active Defense position within the Sliding Scale of Cyber Security. Active cyber defense is the process of trained ICS analysts leveraging technology to monitor, respond to, and learn from threats internal to the control network. Active Defense is most effective built on top of ICS network architecture, followed by passive defenses and a documented asset inventory.
The right asset inventory information to aid rapid recovery
ICS asset identification can be broken down into four methods to be completed individually or combined for improved accuracy by your team: Physical Inspection, Passive Traffic Analysis, Active Scanning, and Configuration Analysis. Each method has different risks and times required to be completed.
Practical steps your team can take to establish an ICS asset inventory are to combine physical inspection, configuration analysis, and passive network traffic capture as follows, for example:
- Start by reviewing any already-created network diagrams and engineering documentation like “as-built documents” to capture the assets said to be in production.
- Use an encrypted laptop with at least a basic spreadsheet application to start cataloging and storing ICS asset information during a physical site walk-through. Don’t forget your safety training certificate and personal protective equipment to enter the site.
- Augment physical inspection with passive network packet captures on critical network segments that host critical ICS assets (PLCs, data historians, human-machine interfaces (HMIs) and engineering workstations) by using either a SPAN configuration off of a fully managed switch or a hardware network TAP.
- Ensure that field device configurations are securely recorded, stored, and available for comparison during an incident so that engineering staff can recover/reload the current uncontaminated project files and device settings during restoration efforts.
At a minimum, your team should capture the attributes below from the commonly targeted critical assets such as PLCs, data historians, HMIs and engineering workstations, core network devices, and active SIS being used. This can be used to understand the risk surface based on vulnerability disclosures and help to map protections on adversary’s tradecraft obtained from through intelligence sources.
– This originally appeared on SANS Institute’s website. SANS Institute is a CFE Media and Technology content partner.
Do you have experience and expertise with the topics mentioned in this article? You should consider contributing content to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
