Enhancing Cybersecurity in OT (Operational Technology) Systems As They Integrate With IT Networks

As OT systems continue to integrate with IT networks, manufacturing companies require more robust cybersecurity measures to mitigate risks.

The rise of the Industrial Internet of Things (IIoT) has undeniably expanded the connectivity from device-level to the cloud, thereby increasing the attack surface of automated facilities. While direct connections to the cloud offer compelling business advantages, such as remote maintenance monitoring, key performance indicator (KPI) tracking, and process optimization, these benefits come at the cost of weakened security. Steve Fales, Director of Marketing at ODVA, explains, "These new connections may allow bad actors to infiltrate industrial networks, driving increased focus on security concepts like Zero Trust, which requires validation before connecting to any device. Additionally, the importance of deploying multiple security approaches to cover all parts of the network has significantly increased."

The Zero Trust concept assumes that the network is already compromised. This means every connection, regardless of origin, must be validated, providing only the minimal access needed for the shortest time possible. Moreover, all communications must be secure. To move towards Zero Trust, companies must encrypt communications, provide role-based access, authenticate endpoints, and ensure that communications are tamper-proof.

In addition to adopting Zero Trust, Steve recommends employing multiple security methods as part of a defense-in-depth strategy to ensure the security of industrial control networks. As part of a process-oriented holistic approach, physical security and employee training are excellent starting points. These are two simple yet effective methods to deter bad actors.

Implementing threat modeling is another essential way to understand network vulnerabilities and formulate response plans. Based on this, switch-based firewalls, deep packet inspection, whitelisting, and other network protections will be deployed in an orderly manner. Steve continues, "If a second channel network is opened due to direct connectivity, it's also crucial to protect the device layer. An example of device layer protection is EtherNet/IP's CIP Security, which provides device authentication, identity, data integrity, confidentiality, user authentication, and policy enforcement. CIP Security also offers flexible protection through profiles that can be implemented on-demand based on usage. Finally, as network attack behaviors and methods continuously evolve, it's necessary to regularly review and revise security strategies, training, and protective measures."

With the increasing number of automated devices directly connected to the cloud and the flattening of networks, having a well-resourced and planned security strategy is critical. "The new reality is that vulnerabilities are likely to occur, leading to the rise of the Zero Trust security approach, which requires validation for every connection and allows only necessary access. It's equally important to remember that physical security, employee training, and process-based approaches can offer very high returns on investment." Steve believes that protection must be implemented at the lowest levels. Security is a key driver of connecting automated devices to the cloud, leading to significant productivity gains, making it a valuable investment for future industrial operations.

Designing Security from the Ground Up

Traditionally, industrial enterprises have relied on the Purdue model for creating secure OT environments by segmenting physical processes, sensors, monitoring controls, operations, and logistics. However, as we've heard, more open platforms are now bringing OT network security into sharper focus.

Michael Lester, Director of Cybersecurity Strategy, Governance, and Architecture at Emerson, says, "Organizations now need to consider cybersecurity at the front-end engineering and design stage of control system projects-making the system secure by design. In the past, cybersecurity defenses were often added later. This is more expensive and less effective than incorporating cybersecurity into the project from the beginning."

Therefore, manufacturing companies now need to design OT software applications from the ground up, based on Zero Trust principles, to create inherently secure factories by design. Emerson's Chief Technology Officer, Peter Zornio, believes that achieving inherent factory security by design won't happen overnight; it will take years of effort, only fully realized as system software is gradually updated to incorporate security architecture. Each time it communicates with another software, it will need to seek authentication and possess the correct data access rights. Some of Emerson's latest products already include software with inherent design security, but realistically, it may take 5 to 10 years before all software in factories can support Zero Trust. However, when this becomes a reality, it will be the ultimate solution to cybersecurity issues.

Moreover, cybersecurity requires more than just technology. Michael believes that cybersecurity also requires changes in behavior and culture. The entire organization needs to deeply understand why and how to achieve cybersecurity, which is critical to driving meaningful behavior change. Therefore, building a cybersecurity culture that includes people, processes, and technology is important.

Stronger Measures for OT System Protection

As OT systems continue to integrate with IT networks, introducing internet-based communication protocols like MQTT and existing data transmission protocols such as HTTPS, CsCAN, and Modbus, the attack surface expands, bringing new attack vectors. This necessitates a set of stronger cybersecurity measures to reduce risks. Sean Mackey, Cybersecurity Engineer at Horner Ireland, suggests the following measures to help control engineers better protect their OT environments:

1. Understand the Environment: Fully understand the OT infrastructure, including industrial control systems, SCADA, PLCs, and other interconnected devices. Identify potential vulnerabilities by documenting assets, network architecture, protocols, and communication paths.
2. Risk Assessment and Asset Inventory: Conduct a thorough risk assessment to identify critical assets and potential vulnerabilities. Create an asset inventory, categorize systems based on their criticality, and assess associated risks. Prioritize security measures based on this assessment.
3. Network Segmentation: Implement robust network segmentation, such as air gaps, firewalls to filter and monitor traffic, and isolating critical systems to keep key OT assets separate from non-critical systems and external networks. Limit the impact of vulnerabilities or attacks by containing them within specific network segments and reducing the attack surface.
4. Access Control and Authentication: Implement strong access control and authentication mechanisms to limit unauthorized access to OT systems. Multi-factor authentication, role-based access control, and the principle of least privilege should be enforced to ensure that only authorized personnel can access critical systems.
5. Patch Management: Develop and implement a strict patch management process to keep OT systems up-to-date with known vulnerabilities. This includes firmware and software updates related to any vulnerability fixes for PLCs/HMIs. Prioritize patches based on criticality.
6. Network Monitoring and Intrusion Detection: Deploy robust network monitoring tools and intrusion detection systems (IDS) to detect and respond to unusual activities in real time. Monitor network traffic, system logs, and behavior patterns to identify potential threats or security breaches promptly.
7. Endpoint Security: Implement endpoint protection solutions, such as firewalls, antivirus software, and intrusion prevention systems, for similar devices on the same network, to protect your industrial devices from malware and unauthorized access.
8. Encryption: Encrypt data both in transit and at rest to prevent unauthorized interception or tampering. Implement strong encryption protocols for network communication, such as Transport Layer Security (TLS), particularly when using X.509 certificates in MQTT-heavy industries, and encrypt sensitive data stored on OT devices.
9. Incident Response Plan: Develop a comprehensive incident response plan that outlines the procedures for detecting, containing, and mitigating cybersecurity incidents. Define roles and responsibilities, establish communication protocols, and conduct regular drills to ensure preparedness for cyberattacks.
10. Employee Training and Awareness: Train OT personnel on cybersecurity best practices, including recognizing phishing attempts, identifying suspicious activities, and responding to security incidents. Foster a culture of cybersecurity awareness, enabling employees to actively participate in protecting OT systems.
11. Vendor Risk Management: Assess and manage cybersecurity risks associated with third-party vendors and suppliers that provide OT components or services. Develop contractual agreements that stipulate security requirements and regularly audit vendors.
12. Compliance and Regulatory Requirements: Stay informed about industry-specific regulations and compliance standards related to OT cybersecurity, such as NIST SP 800-82 and ISA/IEC 62443. Ensure OT systems comply with these requirements to avoid legal and regulatory repercussions and minimize the risk of OT breaches due to poor cybersecurity implementation.

Ensuring Full Protection of OT Systems

In OT environments, most systems are critical, meaning any disruption or compromise can have far-reaching consequences. Daniel Sukowski, Global Business Development IIOT at Paessler, emphasizes that given the stakes, effectively protecting OT environments has never been more important. However, achieving this goal has never been more challenging. In an interconnected and digital world, the exponential growth of IIOT devices leads to increasingly complex systems. Previously isolated OT networks are now being opened to connect new systems and devices from external sources, often across regions. While this connectivity offers many advantages, it also introduces significant risks.

To fully protect OT systems, companies should invest in monitoring technology. Daniel suggests, "An effective monitoring system with a centralized dashboard and alerting capabilities can give enterprises a more comprehensive picture. It can consolidate data from all locations (OT environments, IIoT sensors, wired and wireless networks, and traditional IT devices and systems) under one protective platform. It provides comprehensive visibility, which is more important than ever as cybercriminals continue to evolve and mature."

Furthermore, companies need to regularly conduct security audits and risk assessments of their operational systems to help identify vulnerabilities. This should include information security risks, cyber risks, and all common OT operational risks. Another part of the challenge is ongoing training for all relevant employees. Training content should be regularly updated to ensure that companies operate in accordance with the latest guidelines and regulations. For example, when the upcoming NIS2 Directive becomes national law in all EU member states in October 2024, employees need to ensure they and their broader business remain compliant.

The NIS2 Directive builds upon the original NIS Directive (NISD) by updating the current EU cybersecurity laws. Its goal is to strengthen OT security, streamline reporting, and create consistent rules and penalties across the EU. By expanding its scope, NIS2 will require more companies and sectors to implement cybersecurity measures.

Please click on the link below to read more：

Introducing The Reeman Moon Knight Robot Chassis

Introducing The Flash Food Delivery Robot

Introducing The Nurse Hospital Delivery Robot