The promising prospects of Industry 4.0, coupled with the pressure to go “smart,” is driving manufacturers and critical infrastructure organizations to integrate OT (Operational Technology) and IT (Information Technology) networks. While this integration offers sizable business benefits, it also inadvertently exposes the highly-critical OT environment to the attack surface. Interconnecting IT and OT environments without adequate security prompts adversaries to exploit an IT access point or a cloud vulnerability to break into internet-facing OT/Industrial Control Systems (ICS).
With the discovery of two new variants of OT malware —Industroyer2 and InController/PipeDream—security researchers foresee a rising trend in OT-based cyberattacks in 2023 and strongly recommend that organizations shore up their OT defenses.
The Catastrophic Effects of Cyberattacks on OT
Operational Technology is a combination of hardware and software used to monitor and control industrial operations in manufacturing facilities and critical infrastructures. It includes, among others, PLCs (Programmable Logic Controllers), SCADA (supervisory control and data acquisition) systems, DCS (distributed control systems), and lighting controls. These are used to control physical devices such as pumps, valves, conveyor belts, electricity meters, and light poles.
When the OT systems controlling these mission-critical devices are attacked, the impact is far-reaching and debilitating, affecting a nation’s critical infrastructure, economy, security, and public safety. Here are two real-world examples from the recent past that demonstrate the gravity of these consequences:
The ransomware attack that took down the mighty Colonial Pipeline last year was one of the biggest attacks on critical infrastructure in recent history. The attack forced the company to shut down its ICS for a week, causing fuel panic-buying, supply shortage, price hikes, and widespread chaos.
In another dangerous incident in February last year, hackers broke into the SCADA systems of a Florida city’s water treatment plant with the intent of increasing the level of sodium hydroxide (Lye) and poisoning the water supply. While the attack was thwarted in time, it did put public safety in danger and raised concerns of similar types of attacks.
Time to move to a modern and cloud-based private PKI
Why are OT Systems at Increased Risk?
Due to their highly critical nature of operations, OT systems have long been air-gapped and made impermeable for outside access. But with organizations now interconnecting their OT systems to IT networks, OT systems have suddenly become accessible.
The risk is further compounded by the use of legacy OT systems with outdated security. As the typical lifespan of OT systems is measured in decades, organizations hardly plan for security patches, maintenance, or upgrades, leaving vulnerabilities unaddressed.
For example, in water treatment facilities, most of the pumping equipment and controls do not even require passwords for access and don’t use encryption for communications. This means that an attacker just needs to sit on the IT network long enough to find a password and then use it to enter the OT network and disrupt water services. Research suggests brute force attack is one of the most commonly used attack tactics against OT systems.
Another growing risk factor is the increased proliferation of IIoT (Industrial IoT) devices. Because of their distributed location, insecure communication channels, and outdated software, these connected devices have become launch pads for OT-focused attacks.
In addition to the above factors, there is also the lack of skill to work with OT technology. As the focus has long been on securing IT systems, OT system operators are neither aware of the security risks nor trained on cybersecurity. As “availability” is a top priority in an OT environment, operators always put the continuous operation of OT systems above the integrity and confidentiality of data, increasing the risk of security breaches.
How Can Public Key Infrastructure Help Protect OT Systems?
Perimeter-based security controls such as firewalls are no longer enough to protect OT systems against sophisticated attacks. Patching or hardening systems doesn’t help either as many systems do not support these changes. Physical replacement is yet again a costly affair. A practical and reliable approach to securing the OT environment would be to implement identity-based security so every OT system can protect itself with a micro-perimeter of its own, regardless of its location.
Public Key Infrastructure (PKI) is a time-tested security solution that has long served as the foundation of identity-based and internet security. By ensuring identities, authentication, and encryption, PKI is rising to the unique security challenges of OT environments without degrading their performance.
Here’s how PKI can help safeguard OT assets:
- Authentication for secure network access
Providing secure access to network assets is pivotal to securing interconnected IT-OT environments. PKI helps meet this requirement by providing the framework to establish unique identities (in the form of digital certificates) for every user, machine, device, and application and authenticating them every time they request network access. Verifying identities builds trust and ensures only authorized entities are provided network access, protecting high-risk OT environments.
Providing the right access to the right people also reduces the possibilities of misconfigurations and errors that can cause unexpected system downtime, disrupting OT operations. As OT systems are required to be up and running round-the-clock, any operational disruption can have serious consequences, such as cutting off essential services or significant financial losses. Research suggests that organizations have experienced disruption of ICS/OT system operations more than once every two months, causing an average financial damage of US$2.8 million per incident in the last 12 months.
When it comes to IoT device security, PKI certificates can be provisioned to IoT devices in manufacturing units right off the assembly line to verify their identities and prevent them from tampering throughout their lifecycle.
PKI is also a reliable alternative to password-based authentication as it requires no manual intervention and helps resist brute force attacks. It can be used as multi-factor authentication in addition to passwords for more layered security.
- Secure machine-to-machine communications
Given the highly sensitive nature of data that manufacturing companies and critical infrastructures deal with, data integrity is non-negotiable. PKI helps safeguard data by providing end-to-end data encryption, both at rest and in transit. This helps ensure the data stored in OT systems and the communication between IT and OT systems remain insulated from attacks.
Further, encrypting communications also helps meet compliance requirements. Regulatory bodies, such as the NERC, FERC, NIST, and U.S. President Biden’s recent executive order on cybersecurity, continue to mount pressure to improve the standard of OT security in critical infrastructures and industrial settings.
Global standards like IEC 62443 and IEC 62351 are becoming mandatory for OT devices, providing guidelines to adapt PKI for data protection and software/firmware integrity. By maintaining an up-to-date inventory, and enforcing strict security policies and granular RBAC, PKI helps organizations meet evolving audit and compliance requirements.
- Visibility into OT environments
When it comes to threat detection and incident response, visibility is crucial. Visibility into where the assets are, their relationship with other assets, and the information they store and exchange enables quicker and effective threat mitigation. Even so, many organizations do not have the visibility required to detect or respond to threats in their OT environments.
PKI helps overcome this challenge by providing visibility of OT systems through unique identities. By tracking the certificates installed on OT systems, organizations can closely monitor and control OT systems, mitigating threats. A mature PKI management solution can provide centralized visibility into certificates distributed across hybrid multi-cloud infrastructures, inventory them, and provide an efficient way to manage the certificates and their associated systems. The ability to centrally manage distributed OT systems also accelerates incident response.
- Software/ firmware integrity
Ensuring the firmware in OT systems is safe and free of corruption is crucial to avoid software supply chain attacks. PKI provides an effective means of verifying firmware authenticity and integrity through code signing. OT firmware suppliers can use PKI to digitally sign the firmware they are releasing to help organizations verify the identity of the supplier and confirm that the received firmware hasn’t been altered since its signing. This enables secure boot and protects OT systems from attacks.
It’s Time to Move the Needle on OT Security
Digital transformation is a necessity, and so is the convergence of IT and OT networks. This would inevitably result in more interconnected devices, applications, and machines, expanding the attack surface. As trust and verification become central to cybersecurity in the coming year, authentication and encryption enabled by PKI will play a key role in protecting OT environments.
If you would like to know more about how AppViewX PKI as a Service and certificate lifecycle automation can help transform your PKI and improve your security posture, check out AppViewX PKI+ and AppViewx CERT+.
Tags
About the Author
Krupa Patil
Product Marketing Manager
A content creator focused on providing readers and prospective buyers with accurate, useful, and latest product information to help them make better informed decisions.
