The Industrial Cybersecurity Imperative

 

Make Industrial Cyber Resilience Your Goal

By Sid Snitkin (originally published Oct. 12, 2017)  

Overview

Operational continuity is critical for industrial and infrastructure organizations.  Disruptions to normal operations are costly and jeopardize safety, compliance, and company reputation.  Reliable equipment and control systems are necessary, but not sufficient.  Organizations also need to address cyber resilience to limit the impact of unanticipated failures on key performance indicators for operations. 

Reliability has long been a key goal in the design of industrial plants and infrastructure systems. These efforts eliminate many potential problems but are not foolproof.  Some failure scenarios will be overlooked, and protective measures limited, particularly when facilities include legacy equipment.  Cyber attackers will likewise find ways to overcome even the best defensive measures. 

Smart organizations recognize these residual risks and invest equally in measures to ensure that operations are resilient.  This includes management practices and technology that enables early detection of unexpected failures and rapid recovery.         

Industrial organizations employ a variety of practices that minimize the impact of unexpected mechanical equipment failures.  Periodic inspections are used to detect failing components.  Vibration sensors are used for early detection of problems in rotating equipment, like turbines and generators.  Early detection enables staff to coordinate repair outages with customers and prepare parts and resources to minimize the downtime.        

Such techniques do not work for digital systems.  Digital systems’ failures are random and lack advance indicators.  This situation frustrates engineers and plant managers, as digital technology is increasingly being employed in control and other plant systems.  As a result, it’s becoming increasingly important to have visibility into the health of digital assets.  Companies also need a way to promptly detect latent malware and sophisticated cyberattacks that evade detection by firewalls and anti-virus software.   

Cybersecurity technology for anomalous network message detection can provide an answer to this dilemma and thus enhance industrial cyber resilience.  These solutions monitor network traffic within control systems to quickly detect and identify abnormal activity, whether a cyber-attack or digital system failure, to speed remediation.

What Is Industrial Cyber Resilience?

Resilience is the capability to quickly identify and recover from problems. Techniques like network segmentation, functional isolation, and redundancy are used to build basic resilience into control systems.  But these measures only protect networks and operations from certain failure scenarios.  Other problems, like misconfigurations, programming mistakes, and poor operations and management practices, can still undermine the operation and security of control systems. 

Anomalous network message detection solutions help companies address these gaps. They alert operators and maintenance personnel to erroneous and undesired system behavior, thereby increasing the control system cyber resilience. In addition, they provide needed context to help operators diagnose and resolve problems. 

ARC research indicates that anomalous network message detection solutions with enhanced capabilities for industrial cyber resilience are already helping plant staffs detect a wide range of control system problems before they can impact operational performance.  These include: 

• Failures of non-operating, backup processors
• Failures of intermittently used controllers
• Error states and malfunctions of key controllers
• Inadvertent configuration and programming errors
• Inappropriate operational requests (invalid setpoints, etc.)
• Latent malware communicating with command and control sites and other control system elements

Anomalous message detection solutions are also valuable in situations where control system problems immediately disrupt operations.  They provide information to minimize the time needed to identify the cause of the failure, whether it is a mistake or malicious cyberattack, and quickly restore operations.  

Industrial Cyber Resilience Benefits Many Stakeholders

The benefits of industrial cyber resilience are broad-based and address key concerns of stakeholders across industrial organizations, including plant managers, plant engineers, chief information officers (CIOs) and information technology (IT) managers, and chief information security officers (CISOs).        

Plant managers are directly responsible for the safety, costs, and revenues of their facilities.  They understand how deviations in normal operations increase the likelihood of safety incidents.  They are also keenly aware of the costs and customer issues that arise when operations are not immediately restored.  While they appreciate that control system failures will occur, they are rightfully frustrated when restoration is delayed by complications in understanding the source of problems.  The benefits they receive from reduced outages and outage durations are clear and significant.  Industrial cyber resilience provides this through its ability to anticipate cyber failures, reduce downtime risks, enable predictive maintenance, increase productivity, and reduce the costs for problem mitigation.   

Plant engineers are responsible for control system reliability.  They work with vendors to ensure that as many system failures as possible are anticipated, appropriate protections are incorporated, and adequate spares and support are readily on hand to keep systems operating.  They have a vested interest in ensuring that unanticipated failures are promptly addressed before they cause accidents or disrupt operations, and that repair time and effort are minimized.  Industrial cyber resilience directly supports these goals through early indicators of problems and threats, minimized troubleshooting effort and resolution time, enhanced reliability and availability of control systems, etc.

CIOs/IT managers are often responsible for control system servers, workstations, and networking equipment.  Their interests in system reliability align with the plant engineers.  Likewise, they are concerned about operational disruptions being caused by networking failures and misconfiguration.  These managers receive significant benefit through identification of misconfigured equipment and network services, validation of network changes and maintenance operations, quick identification of net-work failures, etc.  

CISOs are responsible for cybersecurity across the organization.  They also have primary responsibility for managing the organization’s risks and compliance.  However, their typically limited understanding of control systems frustrates efforts to assess overall security posture.  Constraints on control system defenses and updates is also a major concern.  The additional layer of defense provided by industrial cyber resilience helps reduce these risks and alleviate many associated concerns.   Industrial cyber resilience provides CISOs with visibility into what is happening behind OT firewalls, support for compliance, reduced exposure to cyber threats, detection of cyber-compromises, etc.          

What Makes an Effective Industrial Cyber Resilience Solution?

Effective anomalous network message detection is fundamental for an effective industrial cyber resilience program. But many solutions in this category lack the essential features that companies need to rapidly detect, identify, and recover from unanticipated control system failures. 

Advanced, next-generation firewalls may have the capability for deep packet inspection of messages, but they operate in-line and only look for malware based upon signatures and other indicators.  Also, their goal is to block malware, not advise users of anomalous messages.  These solutions are valuable for use at facility perimeters, but rarely used within control systems to monitor internal messages.  The risks of disrupting control system timing or blocking critical control messages far outweigh the potential benefits of detecting malware that may originate within control system devices.     

The features of anomalous network message detection solutions for industrial facilities are distinctly different than those of next-generation firewalls.  These solutions are specifically designed for use within industrial control systems.  While they can detect malicious software that evades perimeter firewalls, they more importantly monitor all messages that flow between internal control system devices and alert on any anomalous behavior.  They connect passively to control networks through span or mirror ports and collect information without active device pinging. These industrial solutions are also different than solutions that look for anomalous messages in conventional IT systems. In fact, they are mostly built from the ground up with industrial control system threats and requirements in mind.

While industrial anomalous message detection solutions share a common focus, they vary in features and capabilities.  To maximize the industrial cyber resilience benefits from an investment in this kind of technology, users should look for a solution that provides the following kinds of support:

• Ability to parse the specific industrial control system protocols used within the organization’s facilities
• Automatic development of control system cyber asset inventories and network maps
• Automatic learning of baselines of “normal” communication patterns and message content 
• Libraries of known ICS-cyber threats and anomalous system activities and behaviors for a responsive, reliable detection with a low rate of false positives  
• Context-rich alerts that enable people to quickly identify the source of problems and appropriate remediation actions 
• A user-friendly dashboard with visual analysis of network flows and commands, both real-time and historical, and capability for users to track and monitor communications
• Ability to proactively search the network for emerging threats and to prevent the spread of existing ones (threat hunting).
• Capability to continuously record and store network traffic and support efficient analysis of this data in threat hunting and problem analysis
• Ability to specify custom controls and company policies regarding device interactions, user actions, etc.

Recommendations

The financial, safety, and compliance risks of disruptions in industrial operations are too large to ignore.  While control systems are designed to be reliable, unanticipated failures will still occur.  Given today’s challenging cyber environment the likelihood of such events is increasing.  Every industrial organization needs to ensure that they are doing all they can to minimize the potential impact of these kinds of events.  Technologies and practices that facilitate rapid detection and repair are essential to ensure that systems are resilient to problems.  

ARC research shows that anomalous message detection solutions that support industrial cyber resilience are already helping many companies mitigate their risks of operational disruptions. The benefits that these solutions provide generally outweigh the cost, especially when all affected stakeholders are considered.  Implementing such a solution should be on the radar of every industrial organization.

 

 

Meeting the Need for Industrial Cybersecurity Expertise

By Eric C. Cosman (originally published Nov. 9, 2017)

Overview

Much has been written on the current imbalance between supply and demand for skilled and experienced cybersecurity professionals.  While many related reports often focus on general-purpose IT cybersecurity, the situation is even more acute for industrial cybersecurity.  Proficiency in that field requires more than expertise in IT security and network design.  It also requires detailed knowledge and experience with various aspects of process design and control strategy development.

Public and private sector initiatives to better understand the specific needs and make plans for expanding the available pool of cybersecurity expertise have produced competency models and similar tools, leading to more detailed curricula and certification programs.  Although these tools are necessary, skills development cannot be achieved through education alone.  Practical experience is required, particularly in industrial cybersecurity, where the most effective response requires a thorough understanding of potential consequences for the physical equipment and processes.

We Live in a Risky World

Several widely reported attacks were either directed at or had indirect impact on industrial automation systems.  Direct attacks have ranged from the Stuxnet attack of several years ago to more recent attacks on steel mills and other facilities.

Directed attacks are not the only threat.  Most industrial systems use common, commercial-off-the-shelf (COTS) computers, networks, and software.  This puts them at risk for collateral damage from malicious software designed to exploit known or recently discovered vulnerabilities in a wide variety of COTS technology.

The number of vulnerabilities identified continues to increase as more researchers focus on industrial control systems and applications.  According to SCADAhacker, “Data obtained from the former Open-Source Vulnerability Database shows that through the end of 2014, more than 85% of all ICS vulnerabilities have been disclosed since 2011…”

The increased number of vulnerabilities has in turn led to an increased number of disclosures of ICS-related security incidents.

Perhaps the most important component of risk is potential consequence, which can only be fully understood with knowledge and experience in the specific area or domain in question.  Just examining and assessing the computer and network elements of the automation system is not sufficient to understand these consequences.  It is also essential to have a detailed understanding of the process and equipment under control.  Process engineers use hazard identification methods to study consequences such as physical damage, release of hazardous material, or other business or safety risks to be able to avoid or mitigate these when designing the process.

How Asset Owners Are Responding

Asset owners are responding to changing risk in a variety of ways.  These range from evaluating new tools and solutions to developing sophisticated cybersecurity management processes.  Typically, the imperative originates in governance and management functions and is then channeled through the IT security function.  However, the response must take the form of a comprehensive program that involves IT, OT, and other stakeholders.  Regardless of the specifics, it is generally accepted that these programs can only be successful over the long term if they address each of the three essential elements of people, process, and technology.  The people and process elements are commonly combined in proposed organizational changes.

Technology

Technology is often the first element addressed.  There is typically a desire to achieve quick results by applying new products and solutions, but no amount of technology will fully address the problem.  On the contrary, complex or incompatible products and technology can complicate the problem. 

People and Processes

Addressing the process element almost always involves a critical review of the organizations responsible for managing cybersecurity and how they work together.  Those responsible for IT infrastructure security often challenge engineering and operations to demonstrate that their systems have been adequately protected.  This can exacerbate the friction that may already exist between the IT and operations functions in a company, often due to a lack of understanding of their respective drivers and constraints.  Much more must be done to identify common concerns, imperatives, and objectives, which are essential prerequisites for effective partnerships.

People and Expertise Are Key

The development of appropriate skills and experience is a key element in addressing this challenge.  These skills must reflect the content of available standards and practices that have been developed for both general information cybersecurity and industrial cybersecurity.

There have been many discussions and debates about the best approach for achieving such expertise.  Is it more effective for security experts to develop knowledge of and appreciation for the nature of the manufacturing operations environment, or should operations engineers strive to develop expertise in security? While an argument could be made for either approach, the unfortunate truth is that neither is guaranteed to work in all situations.

Success in an ICS cybersecurity role is determined less by previous background than by the individual acknowledging the gaps in their skills and experience and willingness to learn.  There are several examples of recognized experts who have come from both the IT and OT worlds.

Understanding the Process Under Control

To fully understand and appreciate what is required to secure an industrial control system and associated networks, it is first necessary to understand the physical process and system under control, as well as the logic developed to automate it.

The process and equipment may be described in documents with names like “process description” or “process overview.” Although these may take the form of narrative descriptions, it is more common for them to include some combination of diagrams and tables giving design conditions.  The logic used to control the equipment may be available in a variety of forms, ranging from narrative documents to logic diagrams or even computer source code.  Such documents may have names such as “control system design” or “automation strategy.” The information in these documents helps in the design of more resilient networks and segmentation of the controllers.  It also defines what normal network traffic should look like.

Even with access to such documents it may not be possible to fully understand the physical process without assistance from a production or control engineer or operations staff responsible for its operation.  It is quite common – especially with older facilities – for the above documents to be out of date, or simply not available.

Although gaining the necessary understanding of the production processes may take considerable time and effort, it is critical for developing an effective cybersecurity response.

Available Tools

While defining and developing roles with the necessary expertise can be challenging, some helpful tools are available.

Competency Models

A competency model describes the knowledge, skills, and abilities a person needs to perform well in a particular occupation.  The US National Institute of Standards and Technology (NIST) provides a general framework that can be used to develop competency models for use in specific areas.

The Automation Federation worked with industry experts and representatives from the US Department of Labor to develop a competency model for automation that serves as a pathway for building the next generation of automation and engineering professionals.  The content of the model is based on a variety of sources, including the Guide to the Automation Body of Knowledge from ISA, licensing requirements for professional engineers, and various professional certificates.

While the automation competency model contains some elements that pertain to this subject, there is also a separate competency model devoted entirely to cybersecurity.  The Automation Federation has also contributed enhancements to this model to help differentiate between the needs for operations and business systems.

Unfortunately, competency models are insufficient in themselves to completely define the roles and expertise required.

NIST NICE Framework

Since the practice of industrial cybersecurity crosses the disciplines of security, engineering, and operations, it is necessary to define a common set of concepts and terminology that bridges these disciplines.

The National Initiative for Cybersecurity Education (NICE) at NIST has produced a Framework that serves as a reference resource for describing and sharing information about cybersecurity work and the knowledge, skills, and abilities needed to complete tasks that can strengthen an organization’s cybersecurity posture.

This framework provides a taxonomy and common lexicon that addresses all cybersecurity work and workers, irrespective of where or for whom the work is performed.  The intent of the framework is to allow employers to use focused, consistent language in professional development programs when using industry certifications and academic credential and selecting relevant training opportunities for their workforce. 

Much of its content is in the form of a series of appendices that describe the following elements:

• categories of common cybersecurity functions
• specialty areas of cybersecurity work
• roles, comprised of specific knowledge, skills, and abilities required to perform tasks in a work role
• knowledge, skills, and abilities required to perform tasks, generally demonstrated through relevant experience or performance-based education and training

• tasks or specific work activities that could be assigned to a professional working in one of the work roles.

Certifications

Having defined the competencies and responsibilities required to address industrial cybersecurity, organizations need an effective way to assess the level of achievement of individuals.  This is commonly addressed using exams and associated certifications.  Industrial cybersecurity certifications are available from several sources and typically complement those used for information security.

Certifications do not obviate the need for individual interviews and skills assessment, but they do provide a valuable starting point and establish a common baseline.

Conclusions

Success in industrial cybersecurity requires a combination of aptitude, skills, and experience in both information security and industrial applications.  Asset owners and others who seek to develop or acquire this expertise should employ available tools in the context of a comprehensive cybersecurity program that describes the organizational models and roles required to meet well-defined requirements.

Recommendations

Based on ARC research and analysis, we recommend the following actions for asset owners and others wishing to develop industrial cybersecurity expertise:

• Establish the "Shared Vision" – Take the time to clearly describe the characteristics of a future state that can be turned into goals that are shared across organizations.
• Risk Assessment – Understand the nature of the physical process, associated equipment and the supporting network.  Perform a risk assessment to define, identify, and classify the security vulnerabilities in your industrial control system.
• People and Processes before Organization – In planning for the cybersecurity response, common practice is to focus on organizational details.  A better approach is to identify the processes and procedures required, and the skills necessary to execute them.  These skills are then described in the form of roles.
• RACI Analysis – Conduct a detailed analysis of the specific roles and individuals that must be responsible, accountable, consulted or informed (RACI) with respect to the various tasks required.
• Role and Skill Definition – Consider the use of formal competency models as tools in the development of careers in automation and cybersecurity.
• Share Case Studies – If you have examples of successful responses to the challenges in obtaining or developing the necessary expertise, consider sharing them in the form of case studies.  The ARC Industry Forum provides an excellent opportunity for industry participants to both present and learn from these.

 

 

New Versions of NIST Framework Addresses Risk Management

By Larry O’Brien (originally published July 19, 2018)

Overview

Managing risk and adopting a risk-based approach to cybersecurity are increasingly necessary in the age of convergence. We’re already seeing a proliferation of risk-based services and approaches to cyber insurance, engineering, and design throughout the industrial and critical infrastructure segments. While many companies have their own methodologies for assessing risk, very few seem to focus specifically on manufacturing, infrastructure, or smart cities. So, how do we use risk assessments to craft cybersecurity policy for the operational technology (OT) domain?

The National Institute of Standards and Technology (NIST) has received considerable recognition over the past few years for developing the Cybersecurity Framework (CSF), which is now widely used as the basis for establishing effective security management systems.  NIST recently released version 1.1 of its Framework for Improving Critical Infrastructure Cybersecurity.  While this falls short of being a fully constructed risk management model for cybersecurity, the new framework does contain much expanded guidance on the element of risk in cybersecurity. 

Version 1.1 of NIST Cybersecurity Framework

The US Commerce Department’s National Institute of Standards and Technology (NIST) recently released version 1.1 of its Framework for Improving Critical Infrastructure Cybersecurity, widely known as the Cybersecurity Framework.  US Secretary of Commerce, Wilbur Ross, made an appeal to C-level management at all companies in the US to use the framework as the first line in their overall cyber-defense strategy.  The framework was originally developed to address industries deemed vital to US national and economic security, including energy, banking, communications and the defense industrial base. It has since proven flexible enough to be adopted voluntarily by large and small companies and organizations across all industry sectors, as well as by federal, state, and local governments.

Increased Focus on Risk Management

Risk management is at the forefront of this new release. NIST hinted at this at the recent ARC Industry Forum in Orlando, where NIST Project Manager of Cybersecurity for Smart Manufacturing Systems, Keith Stouffer, hinted at methods, metrics, and tools to enable manufacturers to assess the cyber risk to their systems quantitatively. ARC is already seeing increased use of risk-based approaches to cybersecurity that borrow heavily from the HAZOP and risk matrix concepts in process safety. This NIST Framework stops short of being an actual model for cybersecurity risk management, but other available resources do that well, including the IEC 62443-3-2 cybersecurity standard.

Key Updates

Version 1.1 of the NIST Framework includes updates on authentication and identity, self-assessing cybersecurity risk, managing cybersecurity within the supply chain, and vulnerability disclosure. NIST based the changes to the framework on feedback collected through public calls for comments, questions received by team members, and workshops held in 2016 and 2017. Two drafts of Version 1.1 were circulated for public comment to help NIST address stakeholder inputs comprehensively. A new section 4.0, called Self-Assessing Cybersecurity Risk, explains how the framework can be used by organizations to understand and assess their cybersecurity risk, including the use of measurements.

An expanded Section 3.3, Communicating Cybersecurity Requirements with Stakeholders, helps users better understand Cyber Supply Chain Risk Management (SCRM).  A new Section 3.4, Buying Decisions, highlights use of the framework to understand risk associated with commercial off-the-shelf products and services. Additional SCRM criteria were added to the implementation tiers. Finally, a Supply Chain Risk Management Category, including multiple subcategories, has been added to the framework core.

Later in 2018, NIST plans to release an updated companion document, the Roadmap for Improving Critical Infrastructure Cybersecurity, which describes key areas of development, alignment, and collaboration. 

Recommendations

NIST provides a lot of good resources beyond the framework document.  A NIST guide to managing risk in information security, for example, outlines some of the fundamentals and NIST’s overall approach to risk management.  NIST’s Guide For Conducting Risk Assessments provides guidance on various types of risk models and approaches to doing risk assessments.  However, none of these documents provide a risk model that encompasses both IT and OT for critical infrastructure or manufacturing industries. 

Managing risk and adopting a risk-based approach to cybersecurity is increasingly necessary in the age of convergence. There is already a proliferation of risk-based services and risk-based approaches to cyber insurance, engineering, and design through the industrial and critical infrastructure segments. While many companies have their own methodologies for assessing risk, very few seem to focus specifically on manufacturing, infrastructure, or smart cities.

A wide range of companies and organizations are converging on this space.  These include engineering service providers, process safety lifecycle management suppliers, cyber insurance companies, consulting companies, Big Data and analytics software suppliers, standards bodies, and government regulators. No single standard or model exists for measuring risk as it relates to cybersecurity in industrial organizations. Cyber insurance companies are either developing their own methodologies or using partners that have their own models, scoring systems, and evaluation capabilities.

ARC will continue to monitor and analyze the many developments in the cybersecurity risk-related space. 

 

 

Industrial IoT Cybersecurity Trends and Developments

By Sid Snitkin (originally published August 1, 2019)

Overview  

It’s reasonable for companies to be concerned about the security of IoT device deployments in industrial environments.  Each device has an associated risk to data and operational integrity.  A compromised internet-connected device could create a pathway for attacks on connected systems, including critical control systems.

While essential, secure-by-design IoT devices are not enough to manage all the risks.  Threats to device security exist throughout the complex industrial IoT device supply chains.  This includes compromised software from technology developers, poor security practices by OEMs, weaknesses in distributor security practices, poor security enablement by implementers, and insecure connections of devices to IoT platforms and cloud systems.  Maintaining security throughout a device’s lifetime requires careful coordination with external suppliers and support groups.  Companies need to understand these challenges and develop appropriate risk management strategies before widespread deployment of industrial IoT devices.

ARC Advisory Group held a workshop on this critical issue at the 2019 ARC Industry Forum in Orlando, Florida.  Experts in various aspects of industrial IoT cybersecurity shared their insights and addressed attendee questions. 

The Industrial IoT Cybersecurity Challenge

Demand for information about industrial operations has never been higher.  Companies want data to understand and improve costs and productivity.  Unlimited cloud storage, high-speed connectivity, and powerful analysis tools have created an explosion in improvement projects.  Leaders of these initiatives want new sensors installed to monitor people, processes, and products and increased access to plant data stores.           

Industrial product suppliers recognize the growing demand for information.   Connectivity and ease of data sharing have become mandatory requirements for new applications and controllers.  Networks are being upgraded with powerful new edge devices that support local data collection, analysis, and control.  Smart assets, like robots and autonomous vehicles, are being designed for remote monitoring and support.  All system elements are becoming industrial IoT devices that must be protected.   

While the benefits are clear, the explosion in connected devices under-mines the effectiveness of conventional industrial cybersecurity strategies.  Perimeter defenses and isolation techniques are ineffective when every device can communicate with external services.  Constraining open connectivity may be prudent, but it frustrates business leaders who need to reduce costs and address competitive challenges.  Companies need strategies (other than avoidance) to deal with the cyber risks of industrial IoT devices. 

Secure-by-Design IoT Devices   

IoT device technologies and capabilities vary widely.  Some are simple sensors, while others are complex control systems.  Security concerns differ, but users expect reliable and predictable performance from all IoT devices.  This requires confidence in the initial and ongoing integrity of the device’s hardware, software, and critical information it may contain. 

Ensuring that devices are secure-by-design is essential.  Designers need to follow secure development lifecycle practices (SLDC) and devices need capabilities that protect against local tampering and compromising communications with external systems.  Organizations like ISASecure and UL offer device certification services that help industrial IoT device suppliers demonstrate design security.  Unfortunately, most devices still don’t have such certifications.  

Secure Industrial IoT Supply Chains

Industrial IoT cybersecurity strategy needs to cover more than secure-by-design devices.   SDLC practices and designs alone can’t guarantee that a specific unit is free of malware, security features properly enabled during installation, certificates have been protected, connections with external systems are secure, and security is sustained during operation.  

Industrial IoT supply chains are complex, with innumerable opportunities for security compromises.  Enforcing security across every participant and handoff is often impractical, but managers can be made aware of the risks they are accepting before they deploy devices in an industrial environment.  This can increase appreciation of security team concerns and garner support for basic cybersecurity controls like vendor qualification and pre-deployment testing of industrial IoT devices. 

Supply chain participants are well aware of the importance of addressing end user security concerns.  Without appropriate security, suppliers of industrial IoT devices and manufacturers of smart industrial equipment lose revenues and opportunities to sell new services, like remote support.  Many are supporting industry efforts, like the Industrial Internet Consortium (IIC) and The Open Group, to develop common security frameworks.  The US government shares this concern and supports resolution through NIST programs and funding of special projects, like FACT, to reduce the risks of compromised software throughout the supply chain.  

Efforts to Address Industrial IoT Challenges

A diverse group of five industrial IoT experts participated in the Industrial IoT Cybersecurity workshop at this year’s ARC Industry Forum in Orlando. They shared their observations on the state of industrial IoT cybersecurity and various efforts to address this challenging issue.  

Security of IoT Devices

Marcellus Bucheit, President and CEO of Wibu-Systems is a member of the IIC trustworthiness task group.  This group explores aspects of trustworthiness relevant to the IIoT and IIC's vision of an IIoT ecosystem.

Mr. Bucheit explained why trustworthiness should be the goal for users of industrial IoT devices.  Trustworthiness is the degree of confidence one has that a device will perform as expected with respect to safety, security, privacy, reliability and resilience while facing environmental disruptions, human errors, system faults and attacks.  In his experiences, IT and OT groups have restricted efforts to addressing only subsets of these requirements.  Industrial IoT expands their perspectives and drives a shared understanding of the need for complete trustworthiness.  

Security for Open Process Automation Systems

Camilo Gomez is Global Cybersecurity Strategist at Yokogawa and a member of the Open Process Automation Forum (a forum of The Open Group), which developed the standards-based, open, secure, interoperable process control architecture O-PAS.  This platform reflects the growing demand for control systems with openness, connectivity, and upgradability.    

Mr. Gomez is co-chair of the security working group charged with developing requirements for security across the O-PAS Framework.  Goals of openness, interoperability, and agnosticism mean that systems require security controls similar to industrial IoT devices. 

Use of standards, a fundamental tenet of O-PAS, is reflected in how the security framework leverages various parts of the ISA/IEC 62443 standards set.  This provides Design, Build, and Maintain security guidelines for technology providers and IoT device OEMs.  The framework’s standards for secure connectivity have also been validated against the capabilities of OPC-UA and Redfish.   

Managing the Risks of Compromised Software

Eric Byres, CEO of aDolus, is well known in the ICS cybersecurity community for developing the Tofino firewall.  He focused his comments on his current efforts to address the problems occurring in IoT software and firmware supply chains.  Beyond malicious code and counterfeit software, companies don’t know what subcomponents are hidden in their products. Likewise, they have no easy way to determine if firmware upgrades are valid, free of vulnerabilities, and current.

Mr. Byres noted that information to solve this problem is available, but technicians need a quick way to access and use it to assess the trustworthiness of update files.   Using a grant from the US Department of Homeland Security (DHS), aDolus created FACT, a community platform that aggregates information and provides a measure of trustworthiness similar to a FICO credit score.  This platform supports the needs of vendors, asset owners, integrators, consultants, and security partners.  He encouraged attendees to download complimentary versions of the solution to test its effectiveness and engage their organizations in the effort.  

Intel

Richard Kerslake is Intel’s IoT Program Director.  Improving the efficiency and security of IoT device provisioning is a key focus for the company.  Intel’s research shows that the costs and complexity of manual cybersecurity provisioning constrain IoT deployments and result in security gaps.  A collaborative effort with ARM has produced a solution to this problem that Intel terms Secure Device Onboard.  

Mr. Kerslake likened the new device onboarding process to familiar plug-and-play methods used to connect a new printer to a personal PC.  According to Mr. Kerslake, device onboarding to any cloud platform normally takes less than one minute, without exposing critical device security information.  Intel’s goal is to share this intellectual property with standards bodies and open source groups in 2019.   

Revolutionary Security

Jon Taylor, Senior Manager and Principal Consultant, OT/IIoT Services at Revolutionary Security, has fifteen years of experience in security of smart remote systems spanning various companies like Caterpillar.  His roles have included communications engineer, telematics engineer, CISO, product line manager and consultant. 

Mr. Taylor’s experience gives him a unique perspective on the cybersecurity challenges across the industrial IoT supply chain.  While he believes that individual products are improving, the smart systems industry is still slow in advancing security.  Core to this problem is where they are focusing educational efforts.  Engineers are trained to achieve product feature requirements, not security.    Today they are being asked to enable connectivity with no real training in what this entails.  His advice to smart asset manufacturers is to recognize this serious gap and solve the problems at the source, rather than waiting for flaws to show up in finished designs.  It’s less costly and will help companies avoid embarrassing situations and product recalls.   

Recommendations

Industrial IoT cybersecurity is a serious concern.  Delays in rolling out digital transformation programs hurt everyone involved in the industrial IoT supply chain.  Companies proceeding without appropriate security programs may be planting the seeds for costly cyber incidents.     

While the challenges are large, panelist comments in the 2019 ARC Forum industrial IoT cybersecurity workshop show that there are things that companies can do to reduce the risks.  Based on this, we recommend the following actions for end users and suppliers of industrial IoT devices:

• Recognize all IoT device risks – Make a list of all the steps involved in your IoT device supply chain and develop security requirements for each product/service.  Educate procurement and operations groups about the importance of requiring compliance from all parties.      
• Leverage standards to ensure IoT lifecycle security – Learn about available standards and include compliance to relevant ones in all product and service procurement specifications.         
• Support industrial IoT cybersecurity initiatives – Encourage suppliers to learn about and participate in the various security efforts discussed in this report.   This will simplify user efforts to manage security. 
• Address deployment and update risks – Establish procedures to ensure that all devices are properly configured and provisioned during installation.  Ensure that safe, secure procedures and pathways are provided to sustain the security of all industrial IoT devices and systems.
• Train key personnel in security – Ensure that all design engineers understand security requirements and embrace security as an important design goal.