The Growing Importance of OT Cyber Security and Risk Management for Resilient Operations of Critical Infrastructures

May 30, 2023

Srinath Sridhar

OT Cyber security has been a talk worldwide emphasizing the importance of securing operational systems and data in a risk-prone world with everyday targeted cyber-attacks reported widely. Industries have been isolated from cyber threats until decades ago with no exposure to hazards or ransom-motivated attacks. Recently, increasing risks to operational technology systems with the motive of ransomware-type attacks or disruption-type attacks can potentially cause process safety risks and production loss, impacting the operations of industrial plants.

To stay competitive, Energy industries have adopted the latest technologies in every field to deliver operational excellence and profitable growth. There is no evidence to counter the power of data intelligence for operational excellence, which every industry finds a sweet spot for sustainable growth.

Growing digitization brings us the inevitable side effects – cyber threats and attack surfaces where our area of focus must be pointed to create safe cyber operations to deliver on sustainable growth targets.

International standards like IEC 62443, NIST 800-82, NERC CIP, CIS, and local regulatory standards from NCIIPC guide us to secure operational technology systems with various steps outlined to enhance security OT systems in critical national infrastructure sites.

It is well recognized that no single cyber security solution or technology can guarantee complete protection against all risks since threats constantly evolve and can eventually outsmart any technology. Therefore, it's unrealistic to think we can completely eliminate cyber threats. Instead, the focus should be on building cyber resiliency and minimizing the impact or consequences of cyber-attacks to reduce operational risk.

As threats in Operational Technology (OT) continue to evolve, cyber security defenders and experts highlight the need for a layered approach termed defense-in-depth to security rather than relying on a single-point solution. New-age threats are becoming increasingly sophisticated, as seen in previous attacks like Colonial Pipeline, Stuxnet, and SolarWinds, to name a few. It is also noticed that most of the attacks originated from the IT networks and migrated to the OT networks, and only a few OT-targeted attacks like Stuxnet. A single-point solution is no longer enough to tackle these types of risks effectively, and robust multi-step security controls are recommended.

Companies are starting to implement network security technologies and approach like network segmentation, firewalls, intrusion detection systems (IDS), and unidirectional gateways, which are only holistic with strengthening the roots such as complete comprehensive inventory and asset visibility as 1% hidden risk can have a disastrous impact on operations and process safety in complex industrial facilities.

Begin your OT security with the below steps:

Asset Inventory Management – The saying "You can't protect what you can't see" is an indisputable truth. Conducting a thorough inventory is the initial crucial step toward evaluating the obvious and concealed risks, particularly in the case of legacy OT systems commonly found at industrial sites. The challenge in complex sites like refineries and petrochemical sites is with isolated/islanded assets, and most of the assets in level 1 and level 0 are not connected to the network. The foundational step in the OT cybersecurity program is deep asset visibility and comprehensive inventory for IT and OT endpoints covering islanded or air-gapped assets for more effective risk management. Maintaining a complete inventory of OT endpoints, including hardware and software, configuration data, control strategies, I/O cards, firmware, applications, and any custom data, is paramount.
Vulnerability Management – It is not justified to have vulnerable OT assets as industrial plants are not connected to an external network. The effective approach towards risk reduction is reducing the attack surfaces through managing vulnerabilities with required patching across OT & IT assets in the industrial facilities. It is interesting to note how deep visibility across OT assets can reveal critical hidden vulnerabilities in the case of isolated and air-gapped assets. To manage vulnerabilities efficiently, targeting those OT assets with high-risk scores and impact factors can be helpful in each industrial site context for effective risk reduction. Enable enterprise-wide, a holistic image of multiple risk domains, with a clear understanding of vulnerabilities and enhanced risk-based decision-making.
Configuration Management – This aspect is essential, but unfortunately, it tends to be ignored. Cyber-attacks have more than one objective besides ransomware, such as causing damage to industrial plants or creating reputational impact. For instance, attackers can alter critical configurations of Distributed Control Systems (DCS) or Safety Instrumented Systems (SIS), as seen in the Triton attack. This can lead to an immediate shutdown and unsafe conditions with severe consequences if the procedures are not followed in a sequential order or standard operating procedure. Baselining the good configuration can help quickly detect unauthorized configuration changes and reduce the mean time to recovery (MTTR). Understanding configuration changes can also help with key insights for forensics analysis during a cyber incident. Control strategy maps can help identify complex interconnections, assisting in planning an effective incident response and managing risk.
Risk Analytics – To effectively manage and minimize the impact of risks, it is crucial to understand how they spread. This is where understanding risk propagation path comes into play. Risk Analytics tools can help by providing detailed insights into various risks, such as asset discovery, vulnerabilities, unauthorized configuration changes, and real-time threats. Unlike the IT security strategy, removing or disconnecting the OT endpoint is not an option. It leads to process safety risk if it is linked to safety systems or impacts plant operations (huge cost impact) if it deviates from procedural steps. Prioritizing risk-reducing and vulnerability remediation activities that shrink the attack surface and quickly providing paths that reduce the greatest risk with the least effort.
Backup & Recovery – A robust cyber strategy would involve reliable and updated backup and recovery to ensure business continuity and limit the financial impact. The appropriate question would be – Do we have the right backup, including configurations of OT assets for a quick recovery? The answer to this question forms the basis of an effective incident response plan in mitigating the financial impact and downtime.

Hexagon’s PAS Cyber Integrity delivers comprehensive inventory, vulnerability, and risk management for OT assets in complex asset-intensive industrial plants like Oil & Gas, Chemicals & Power plants. PAS Cyber Integrity reduces OT Inventory and documentation efforts by 70%. Hexagon helps mitigate OT/ICS cybersecurity risk by enabling you to assess your risk utilizing a proprietary risk scoring method to visualize and comprehend risk within the industrial facility in your own context. Armed with this powerful insight, you will be more equipped to focus your OT security investments on the activities that reduce the most risk to make your industrial operations safer and more resilient.