IT in Manufacturing


Industrial control system cybersecurity

March 2018 IT in Manufacturing

In Part 1 in the series of cybersecurity articles for 2018 (http://www.instrumentation.co.za/58931n), we looked at risk assessments within industrial control systems (ICS), including creating an ICS cybersecurity policy. In Part 2, we look at asset discovery (and continuing to do so), and vulnerability management on an ICS.

Vulnerabilities in the ICS environment represent a significant risk to organisations that run control systems, be that a manufacturing, mining or critical infrastructure organisation. These vulnerabilities are becoming more widely exploited by cyber criminals as was evident with the recent Triton and Crashoverride malware variants.

Asset discovery

The best way of understanding your assets is by keeping a comprehensive asset (PLC, HMI, engineering workstations, etc.) register. Without a comprehensive asset register, it will be difficult to protect your systems effectively, as the asset register will assist you in understanding your network by defining the assets (i.e. vendor, model number) and defining how the assets communicate.

In Part 1, we discussed conducting a risk assessment (RA) and if the RA is conducted correctly, you should have a great base to work from. There are various tools that can assist you with identifying assets, such as Grass Marlin (discussed in Part 1), Wireshark and if you are really brave, there is arp-scan that will allow you to identify live hosts. As a cautionary note, please make sure that you are familiar with the tools mentioned above, or that you have tested the tools in an offline environment, as incorrect use could result in unwanted results and failures on the ICS systems. ICS asset scanning can fill a whole book on its own, but the use of these aforementioned tools is well documented and there are plenty of in-depth articles available to assist. There are also some great commercial-off-the-shelf (COTS) solutions available, and most of these solutions tend to offer more than just asset identification and tagging, some going so far as to map out the entire ICS network. The asset register will also help with effective network segmentation (which we will cover in Part 6), network security monitoring (which we will discuss in Part 4), and vulnerability management, which we will discuss next.

Vulnerability management

Vulnerability management, or should I say effective vulnerability management, which includes scanning for vulnerabilities and patching them, is a critical component in protecting both hardware and software systems. In OT/ICS systems however, this gets a little trickier, which I will elaborate on now. The first problem is that of finding the vulnerabilities, as most control assets are not designed to be ‘interrogated’, as is the case for IT assets. The second problem is that if you have managed to identify vulnerability, you are not able to patch it as most control networks operate 24/7/365.

So, if we are unable to scan our assets and cannot patch the vulnerabilities, what do we do? An effective cybersecurity strategy for applying patches combined with specifically developed ICS vulnerability scanning solutions can help. First, one needs to identify the different components of the ICS network(s), and as discussed above, an in-depth asset register will help in this regard. Each set of components will require a different strategy, and then these need to be documented and implemented in the overall cybersecurity program.

Putting things into perspective

Scenario 1

The engineering workstations are only utilised daily between the working hours from 07h00 to 17h00. This would potentially allow us to scan for vulnerabilities, identify which patches need to be applied and then patch the engineering workstations during off peak hours. (As a cautionary note, and in line with industry best practice, it is strongly recommended that patches are tested before applying them.)

Scenario 2

The control room workstations and the PLCs are used 24/7. We are therefore unable to scan these machines for vulnerabilities, and also unable to patch them. For this, we need to look towards non-intrusive passive scanners such as OpenVAS, or my personal recommendation of the Bandolier Project, which is a joint initiative between Digital Bond and Nessus from Tenable. In a nutshell, a passive scanner monitors network traffic at the packet layer to determine services and to identify and assess vulnerabilities, without affecting asset or network performance.

Patching is bit more difficult as the only real time slots we would have to apply these is during a shutdown. Generally, these occur between 1 and 5 times per year, and this period provides an ideal opportunity to patch the effected systems. The problem is that these times are normally reserved for engineers and vendors to make their changes, and to slot in new assets. This is where you need to fight for your piece of the pie and get board-level management buy in, so that you are allocated a time frame to apply your fixes.

Conclusion

To effectively manage vulnerabilities, you need to understand your assets and continuously monitor them for any changes, along with understanding your network(s). Vulnerabilities are not just classified as hardware or software flaws, they could also arise through incorrectly configured devices such as PLCs, industrial switches or control systems and other engineering workstations. This means that it is no longer just the ICS networks that are at risk, safety systems just became vulnerable as well.

Tommy Thompson is a passionate cybersecurity professional with some 15 years’ experience. Starting as a firewall engineer in 2001, Thompson has assisted a variety of companies in numerous roles with their cybersecurity problems. He holds a BComm degree in Information Management from Oxford Brookes University (UK) and he is certified by PECB (Canada), as a Scada Security Professional (CSSP).

For further information contact Tommy Thompson, +27 (0)11 463 0096, [email protected]





Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Revolutionising mining operations with MineOptimize
IT in Manufacturing
Now more than ever, mining and mineral processing companies need to boost productivity, ensure safety, and protect the environment. ABB’s comprehensive electrification, automation and digital solutions portfolio is ideally positioned to meet these challenges across all mining processes, from mine to port, transforming performance in a digital world.

Read more...
Buildings in Africa’s urban evolution
Schneider Electric South Africa IT in Manufacturing
Africa is now an urban continent. How does the continent mobilise to accommodate urban dwellers and maintain and implement critical infrastructure that allows for this expansion? Building management systems provide a tangible solution to optimise resource use, lower operations costs and ultimately contribute to a growing continent that also employs green practices.

Read more...
TwinCAT Vision functionality extended
Beckhoff Automation IT in Manufacturing
The image processing and camera integration capabilities of Beckhoff’s TwinCAT 3 Vision software have been expanded.

Read more...
Automation software to future-proof your operations
Adroit Technologies IT in Manufacturing
As the official partner of Mitsubishi Electric Factory Automation, Adroit Technologies empowers businesses with cutting-edge solutions that reduce costs, improve quality and increase productivity.

Read more...
Siemens automation portfolio, your bridge to the industrial metaverse
Siemens South Africa IT in Manufacturing
Step into the future with Siemens’ automation portfolio, your bridge to the industrial metaverse. Our cutting-edge solutions integrate AI, digital twins and real-time simulation, driving smarter, more efficient production.

Read more...
Transform your manufacturing efficiency
TransLution Software IT in Manufacturing
MÄDLER offers a wide range of gears in various materials, modules and designs, available directly from stock.

Read more...
Optimise the cutting of metal materials
IT in Manufacturing
KRON Cutting is a comprehensive web-based system designed to optimise the cutting of metal materials, including rebar, pipes and profiles.

Read more...
Black Rock Mining centralises mining operations with AVEVA
IT in Manufacturing
Black Rock Mine Operations replaced and upgraded its existing infrastructure, and installed additional capacity to expand production from 3 to 4,6 million tons in three years. The new system is powered by a suite of AVEVA solutions.

Read more...
The strategic role of technology in today’s economy
IT in Manufacturing
In an era of economic uncertainty and persistent market volatility, businesses are under immense pressure to manage costs while maintaining operational effectiveness. The role of chief information officers and chief technology officers has never been more critical, as they are tasked with leveraging technology not just as a tool for efficiency but as a strategic asset in navigating these turbulent times.

Read more...
Minutes to meltdown: surviving a cyber attack
IT in Manufacturing
Commvault recently hosted its Minutes to Meltdown event. Led by the company’s security experts, this was an interactive and detailed ransomware attack simulation designed to help companies understand how to respond in the event of a cyber attack.

Read more...