Technology & Innovation

Cyber-security – what are the risks from increased connectivity?

September 04, 2017

Global

September 04, 2017

Global
Edgard Capdevielle

Chief Executive Officer

 As CEO of Nozomi Networks, Edgard has a front-row seat to the cyber-security challenges facing infrastructure operators around the globe and the role technology innovation is playing to protect critical systems from escalating threats.  He is a proven thought leader in the security space, who is often invited to share his perspective in panel discussions and as a keynote speaker. His insights and views have been cited by media and he has a number of articles published globally.

Prior to joining Nozomi Networks, Edgard held positions with Imperva, Data Domain and EMC. He has an MBA from the University of California at Berkeley and a Bachelor's degree in Computer Science and Electrical Engineering from Vanderbilt University.

 

Cyber-security practices in critical infrastructure traditionally relied upon isolation of the operational networks from the enterprise environment and the outside world to avoid attacks and minimise incidents. Today, that approach is no longer tenable as increased connectivity and converged platforms have blurred that divide.

With the ‘air gap’ consigned to history, and cyber-criminals looking for ways to breach organisations, new technological advancements need to be embraced to allow the benefits of Industry 4.0 and the modern factory to be realised, securely.

Modern operational technology: increased connectivity and convergence

The combination of increased automation, standardisation of technology and expanding connectivity has revolutionised industries, including oil and gas, petrochemicals, transportation and utilities. Wireless communications (such as satellite links, Wi-Fi, 4G, etc.,) and the adoption of standards (such as Ethernet, TCP/IP, etc.,) have established operational connectivity to createSmart Plants’, often referred to as Industry 4.0.

In modern industries, machines, devices, sensors and people connect and communicate with one another, offering the ability to make decisions and implement fixes without even having to physically enter the industrial plant or visit the factory floor. Service degradation can be identified while still minor, rather than only becoming apparent once failure has occurred. Required maintenance can be performed in hostile or remote environments, often with fixes delivered at the touch of a button.

The benefits of increased connectivity and convergence come with great advantages.  However, they also come at a cost.

Flexible means permeable

When systems are connected - whether it is Operational Technology (OT) being connected to IT systems internally within the same building, or allowing for external access, they have the potential to be discovered by anyone looking, and this leaves them vulnerable to attack. On the maintenance front, the pervasiveness of Windows systems and other standard IT technology in the control systems demands continuous service, connectivity, upgrades and patches further making the wall permeable.

Just as an engineer can access systems remotely, hackers too do not need physical access to knock something offline or tamper with settings.

This isn’t all theoretical as, in June this year, the National Cyber Security Centre (NCSC) - part of the UK's intelligence agency GCHQ, . The report goes as far as to say that a number of Industrial Control System engineering and services organisations are likely to have been compromised. It’s not an isolated incident as Irish energy organisations are also thought to have been targeted by hackers. In the US, the Department of Homeland Security also In its 2015 annual report, it confirmed that the National Cybersecurity and Communications Integration Center/Industrial Control Systems Cyber Emergency Response Team had responded to , and this is increasing year over year.

Those working within the sector are not naïve to the risks. The findings of a recent showed that 69% of ICS security threats are high or severe and critical. Organisations must assume that all parts of critical infrastructure are being probed for vulnerabilities 24 hours a day, seven days a week.

Strengthening defences

To reap the full benefits of increased modernisation and connectivity, critical infrastructure networks and devices connected must be secure. The challenge is that many networks and devices were not designed with security in mind.

As a starting point, operators should implement the mitigations recommended by ICS-CERT, which include verifying that control systems are deployed securely and that no devices have a direct Internet accessible configuration. In addition, the US Department of Homeland Security recommends the use of network behavioural analysis to detect anomalies in traffic and take appropriate action.

Fortunately, network behavioural analysis that is safe for OT environments is now readily available thanks to new technology. Using advances in computer science, such as machine learning (ML) and Artificial Intelligence (AI), these solutions build an internal representation of an industrial network and the physical processes that they support. Baselines are established and communication or process behaviour that deviates are instantly detected and presented in consolidated, prioritised, context-aware alerts. Having this operational visibility provides immediate insights for faster troubleshooting and remediation of cyber-security and process incidents. It makes it easier for engineers and plant operators to identify affected devices and apply compensating controls before industrial process are impacted.

Organisations historically have focused on strengthening security by isolating OT from IT, building a barrier between the corporate environment from the industrial network.  Today, that approach is no longer tenable.  Rather than reversing or even hindering connectivity and its benefits, modern industries deserve intelligent protection. By harnessing the power of machine learning combined with artificial intelligence, connectivity can be introduced securely.

 

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

 

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week