Protecting Your Industrial Control Systems

The air-gapped system of the past is long gone and connectivity is now commonplace. Engineers require remote access away from the traditional console, third party vendors need to view operational data, and suppliers want access to ensure cost-effective maintenance and monitoring. Even if you don’t have any of the above, internal managers and staff will always require connected access to real-time production data and statistics.

These connectivity requirements continue to increase and have led to the growth of internal industrial networks. That’s not to mention the challenges thrown up by the Industrial Internet of Things (IIoT), whereby most businesses employ a wider network of devices and digital assets than ever before.

This rapid expansion has led to many organisations losing sight of their networks and, according to CyberX, 44% have at least one unauthorised or unknown device that may pose a legitimate threat to operations.

Network expansion is only one of the reasons behind this oversight, and poor network management alongside changing personnel also play a part. Companies may also put themselves at risk following organisational growth, or through a merger with another company. All it takes is one rogue device that isn’t accounted for or fully protected to constitute the source of major security issues.

Having an accurate and up-to-date network map is the first step towards protecting your system. It will provide you with a clear picture of how your systems are connected and what devices are present, so you can start to uncover who has access and where the major vulnerabilities lie.

Additionally, a network map offers a more tangible view of your organisation and by being able to visualise all connections you can start to build a case for a wider security review.

Step 2: Get your security priorities in order

Once a network map is in place, you can begin to analyse the security of your organisation’s connections and devices in more depth. However, many businesses do not have the luxury of testing their whole system at once, which means they must prioritise their actions effectively.

Prioritising your efforts could take two potential routes: focusing on vulnerabilities first or by concentrating on your critical assets.

All it takes is one vulnerability, one unsecure device, and attackers can use this to pivot into your wider industrial network. If you choose to prioritise by vulnerability, you’ll identify the parts of your ICS that are most susceptible to attack and this will allow you to rectify the most pressing concerns first.

Common vulnerabilities could include lack of privileged access, default passwords on IIoT devices, or even unpatched software. These simple vulnerabilities should act as a red flag and in many cases the issues can be addressed quickly, providing you with an instantly improved security posture.

Alternatively, you may wish to focus your security efforts on your critical assets. For some companies this may be the operations themselves, for others it could be their intellectual property or product designs. For some it could be their production data. Whatever it is, your company depends on this and therefore it needs to be protected first.

Step 3: Educate the Board