Latest from Plant Operations
The rise of interconnected OT and IT systems is often attributed to how business models have evolved with the purpose of enhancing operational efficiency. For instance, SCADA networks deployed along oil pipelines now collect oil output data that is essential to billing and pricing systems. This increase in data collection allows companies to predict with higher levels of accuracy not only levels of oil production and output but also expected revenue.
However, it should be noted that these interconnected systems do not only bring benefits—a downside is that the likelihood of introducing cybersecurity threats to OT systems increases significantly. What is compounding this complex issue even further is that ransomware attacks are increasing in their severity. This type of malware exploits Windows vulnerabilities and attacks insufficiently protected systems.
With increasingly similar cybersecurity incidents occurring in OT systems, business owners and regulators are keen to seek solutions that enhance industrial cybersecurity and allow businesses to keep functioning normally.
In this article, we will introduce the defense-in-depth concept that allows companies to leverage their existing network infrastructure and investment to build the first line of their network defense. Later in the article, we will discuss the benefits and advantages of how industrial intrusion prevention systems can further protect OT systems.
What Is the Security Boundary Concept?
When enhancing cybersecurity, it's vital to understand how your industrial systems are exchanging data within different systems and how they connect to IT-level systems. In an ideal scenario, when traffic crosses other systems, there should be boundaries between each design to ensure the traffic has good "cyber-hygiene" even if it is authenticated and authorized.
However, it's challenging, and often unrealistic to build boundaries between every system, as it involves significant expenditure, and often has a detrimental effect on the efficiency of network communications. For these reasons, it's highly recommended to divide OT systems into different digital cells and zones and build up the boundaries to find the right balance between expenditure and acceptable levels of risk.
How to Build Security Boundaries
1. Network Segmentation
Physical Layer Segmentation
This is known as air gapping when two networks are physically isolated. When the operations and security of one system need to be independently maintained, an air gap is a potential solution. However, as mentioned earlier, it is increasingly difficult to arrange networks this way due to business and operational requirements.
Data Link/Network (Layer 2/Layer 3) Segmentation
As industrial control systems may have been built decades ago, one of the key challenges, but also essential requirements for network administrators, is to leverage existing infrastructure while ensuring industrial control systems remain secure. One approach that is frequently deployed is to segregate traffic between different network segments using a VLAN (Virtual LAN), which is one of the functions of managed Ethernet switches. Some Ethernet switches feature Access Control Lists (ACL) at the port level, which can help improve VLAN security as data enters the switch. An alternative is to deploy firewalls to protect industrial applications and data especially when you need to deal with traffic on Layer 2 and Layer 3 networks.
Layer 4-7 Network Segmentation
Further segmentation can be applied through Deep Packet Inspection (DPI). DPI offers granular control over network traffic and helps you filter industrial protocols based on the requirements of the application. When you have multiple devices on the same network, theoretically, they all have the ability to communicate with each other.
However, there are certain scenarios, when for example, Controller A should only communicate with Robotic Arm A at a specific time, then DPI technology can help engineers to define which controllers can perform read/write commands or even the direction of traffic.
2. Micro-Segmentation
In some situations, additional protection for critical assets is necessary, and a good way to achieve this is to use an intrusion prevention system to micro-segment the network.
What makes micro-segmentation particularly helpful for industrial networks is that it can be used to segregate the network into even smaller sub-networks. What's beneficial about this approach is that the virtual patch function of an IPS can help mitigate the risk of known vulnerabilities.
For example, some systems might be operating on Windows XP, which Microsoft does not provide security updates for anymore. Under this scenario, even though there are known vulnerabilities, it may not be feasible to perform security updates. Watch the video below to see how IPS virtual patch works.
Secure Remote Access
According to cybersecurity experts, remote desktop protocols are sometimes exploited to spread malware or conduct unauthorized activity. As remote connections have become more and more prevalent due to the necessity of increasing operational efficiency and the need to perform troubleshooting quickly, it's unsurprising that building security boundaries between two field sites is being talked about more frequently.
Instead of using software to build remote connections, which can easily lead to vulnerabilities in the long term, it highly recommended to build VPN tunnels and ensure that access control mechanisms are maintained properly.
Typical Scenarios
Manufacturing: Interconnected factory networks need proper network segmentation to reinforce industrial network security. Furthermore, network redundancy is also required to ensure the availability of the industrial control system.
Secure Substation Monitoring: A power grid that covers a vast area needs IEC 61850 certified VPN solutions to monitor the intelligent electronic devices (IEDs) at each remote substation.
As business owners are no longer able to enjoy the benefits and security of completely air-gapped networks, it is imperative for business owners and engineers to enhance security boundaries through different approaches including network segmentation, micro-segmentation, and secure remote access. Each of these approaches fulfills additional network requirements and helps improve cybersecurity not just by forming perimeter protection but also by preventing lateral movement of unauthorized traffic.
