Spotlight – Q&A |
j then immediately they’re logging that, giving them a legitimate login to get into your network. This makes it even harder for someone to identify if it’s legitimate or not. Employees need to understand what to look for, it would only take an extra few seconds on an email to check who it’s from, check that it’s not an external address, etc. The last thing that I’ll say here is don’t feel like you as an organisation have to go it alone. There are a lot of next gen tools that are developed specifically for the OT space, and even more specifically for water, that can really help fight the newest threats that are becoming more and more advanced.
What types of tools to improve cyber security are available? There are a few different categories based on the NIST framework of tools. Categories fall into the following areas: ● Identify: these are tools that help with an asset inventory. They’re identifying what’s on the network because if you don’t know what you have, it can be very difficult to protect it.
● Permit: these tools look at who’s accessing the system, and will authorise who can and can’t get gain access, giving you a secure network. It includes things like network segmentation and firewalls, the multi factor authentication tools. Even things like Active Directory to help control who can and can’t get to different things.
● Protect: this covers patch management HOST intrusion detection, removable media control, endpoint protection and antivirus - the things that that form a barrier around those devices from malicious tools.
● Detect: this includes things like anomaly detection where we’re using artificial intelligence to identify what’s on the network, how it communicates, and what is its normal day to day process. When something is happening that’s different, it will highlight that to you. It gives you actionable data that you can go and resolve, rather than having to try to monitor everything separately.
● Respond: this is one of the most important tools. Everyone knows what to do in their facility if there’s a fire but very few know what to do in the case of a cyber attack. Attackers are hoping that you’ll be confused, panic and react incorrectly. Having backup and recovery, knowing what to do, and practising what to do in the case of an incident is very important and will really help in making sure that the facility is an unattractive target to attackers.
Should cybersecurity be built into the facility in its early stages of development? Yes, absolutely. We’ve seen facilities that are delivered with malicious software in them already. It has been suggested that within the first five minutes of operation, an IoT device is initially polled as part of an attack. There’s an incredible amount of gaps that are left when facilities are created or brought online without any cybersecurity, for it to be added later. It’s really trying to reinvent after the fact. There are enough advancements in tools and processes today to launch a facility from day one that is really cyber resilient. This can then be maintained over time rather than trying to play catch up from day one.
10 | December 2021 |
www.waterpowermagazine.com
Is it harder to build cybersecurity in older facilities? Truthfully it can be harder and a lot of that comes down to the age of the equipment. They’re not as easy to secure and they may be more sensitive to monitoring and things of that nature. But that doesn’t mean that it’s impossible – anything is better than nothing. The goal of a facility shouldn’t be to be hack proof. Hack proof is a fallacy. It would be very difficult and costly to achieve. What they should do is try to be an unattractive target. Even if the facility is 100 years old, there are methods to help secure the equipment they have, and make sure that it’s resilient and sustainable. Just because the facility is older and uses older equipment, it doesn’t mean that it’s not worth investing in cybersecurity. You can still protect the devices that are connected and keep them safe, so that they’re not posing a risk to anything that’s deeper into the network.
Is there any additional information our readers should know about cybersecurity? Something we hear a lot is that companies think it’s an IT issue – those in the operational side think ‘oh we’ll let IT take care of it.’ However, there’s still a large number of cyber attacks that come in from the IT space, and then filter into the OT space, due to a lack of cybersecurity in the operational environment. The critical thing to know is that with operational equipment or critical infrastructure equipment, like PLC, SCADA, IoT, the way that they operate, and the languages and protocols they use are very different than what IT is typically used to seeing. It’s important to understand that difference, and not
just try to apply the same IT principles that you use in an office space, because it will miss things. IT doesn’t know what to look for in that environment. Yes, it is an IT issue, but it’s also an OT issue as well, because of those specifics that are proprietary to those devices, those protocols for PLC, SCADA, power management, building management, etc. From an attack perspective both represent vulnerabilities, both have their own methods of being attacked. It’s very important that we’re on top of maintenance and patching, and give responsibility of ownership to both sides of the equation, not just assign it to one. It’s also OK to ask for outside help. Schneider deals with some of the biggest and brightest companies in the world, and they still need help. There are areas where expertise and outside insights are useful so don’t think that you have to go it alone. It’s okay to ask cybersecurity experts outside of your organisation for help and guidance, to make sure that you’re secure. It’s better to get that help and understand what to do and correct any issues instead of not knowing and potentially causing a concern.
Lastly, with all of that said, I do think that there’s a lot of optimism in the OT security market today, especially in water and utilities. There’s a lot of tools now that make cybersecurity management easier. It doesn’t require a full staff of folks working on a computer 24/7 to manage, there are tools that can do a lot of that for you so you can focus on other things. There are standards and support at country level
to help secure critical infrastructure at its core. Over the last couple years there’s been a lot of interest and excitement in getting this secured, so now’s a great time to be an organisation looking at how to secure your infrastructure. It’s not too late. ●
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37
