OT/ICS Cybersecurity

Last night, I was watching a classic western movie called Big Jake. If you haven't seen it, Big Jake is a 1970s American Western film starring John Wayne, Richard Boone, and Maureen O'Hara. The story revolves around the McCandles ranch which is being attacked by the Fain gang, who kidnap the grandchild of Jake and Martha McCandles for a $1 million ransom. Jake McCandles and his sons then embark on a mission to bring Jacob "Little Jake" back home safely. 

You may be wondering; this doesn't sound like a standard post from Nick Cappi. It isn't technical, it's not a product update, and LinkedIn is a professional platform. So why am I telling you about my television-watching habits? 

Well, there is a scene in the movie from which we can all learn. Towards the end of the film, 'Big Jake' McCandles confronts John Fain, the leader of the Fain gang. Big Jake says to John, "And now you understand. Anything goes wrong, anything at all... your fault, my fault, nobody's fault... it won't matter." This is the lesson I think we can all learn from. 

When "anything goes wrong, anything at all" — like an unplanned outage — it doesn't matter if it's a cyberattack (your fault), an inadvertent change (my fault), or a natural disaster (nobody's fault) ... it won't matter because the outcome is still the same. You're down and need to get things back up and running. Having the people, processes and technology that help you respond and recover from these events is critical to your business success. 

I've been involved in three recovery events. None of them were cyberattacks. One was an inadvertent change where an engineer made a change without understanding the consequences, wiping all the configuration data from the configuration host machine. Another was a natural disaster: where a hurricane flooded the rack room containing all the process control equipment. The last was an explosion. Thankfully, no one was injured, but it caused a prolonged power outage, taking down all control systems. 

Despite the obvious system outages, all three events had some things in common: 

People 

·        A corporate-level belief that they had good, up-to-date backups. 

·        A site-level belief that such events could not or would not happen to them. 

Process 

·        Defined backup processes were not followed regularly or completely. 

·        Recovery processes lacked alternative scenarios for when the standard process faced challenges. 

·        Minimal or no concept of multiple trusted restore points. Copying the same data to multiple places does not constitute multiple trusted restore points. 

Technology 

·        None of these systems were restored using the technology defined in their standard recovery processes.

·        All systems were restored using Hexagon's PAS OT Integrity Platform (PAS Automation Integrity™ or PAS Cyber Integrity® products).

The key takeaway is that being prepared for any disruption, regardless of the cause, is essential. Ensuring your team is equipped with the right mindset, robust processes and reliable technology can make all the difference in recovering swiftly and effectively.