It\u2019s difficult to write about cybersecurity without sounding like Chicken Little. I know that the more I flap my wings, the more you might ignore me altogether. Doomsday messages don\u2019t strike fear; our overhyped message receptors have become too immune to the noise. You\u2019ll either roll your eyes at the hysteria or throw up your arms in hopeless exasperation.<\/p>\n
And yet\u2026 Not only is the threat very real, but it really shouldn\u2019t be that difficult to build your defenses. So before I do a little more wing flapping, let\u2019s all take a deep breath and look at the situation.<\/p>\n
There was a time not so long ago when the people in charge of control systems\u2014on both the vendor and the user side\u2014didn\u2019t have to worry about cybersecurity. They were focused on throughput and safety. Then along came Stuxnet, and the myth that the industrial control system (ICS) was protected because it was air gapped or simply too complex flew out the window.<\/p>\n
But the best practices that were put in place years ago for safety\u2014where there were too many shared or copied keys floating around and alarms would be suppressed late on a Friday night and forgotten over the weekend\u2014are well suited to security as well. \u201cWe developed technology to deal with those proprietary systems in that environment,\u201d says Eddie Habibi, CEO of PAS, which has been providing process safety and reliability for energy, power and other process industries for 20+ years. \u201cThis all ties to cybersecurity today. Many of the best practices today are exactly the same measures we put in place 20 years ago to protect proprietary systems from internal mishaps.\u201d<\/p>\n Habibi describes a typical situation in which there\u2019s no technician around on a Friday night, so a shelved\/disabled alarm waits until Monday morning to be dealt with. \u201cThat disabled alarm, for example, could lead to an accident if the equipment it is protecting is over-pressurized. The threat of cyber is not too dissimilar to that,\u201d he says. \u201cA bad guy comes in, disables a critical alarm, then leaves it alone. That kind of sabotage is like a time bomb. At the right time, when you need the safety system, that safety system is not there for support.\u201d<\/p>\n Though Stuxnet certainly created awareness, with leading companies since then taking measures to deal with cybersecurity issues, it continues to be proven over and over that:<\/p>\n \u201cWhen you lose power and water for two or three weeks, things don\u2019t look good,\u201d Habibi says. \u201cAnd then if you have an enemy that\u2019s fighting to keep those systems down, it can be very bad.\u201d<\/p>\n We\u2019ve talked repeatedly about how being a small guy in a non-critical industry doesn\u2019t really make you less vulnerable. It\u2019s easy enough to get swept up in broad attacks, an internal attack or mishap, or any number of dangers. But let\u2019s set that aside for a moment and actually focus on those major operations and critical infrastructures.<\/p>\n Indeed, there is hype and there are scare tactics being used by companies that want to sell you security products. But still, there simply is not enough awareness about the damage that could be done with a few focused attacks on critical assets, Habibi says.<\/p>\n \u201cIf four refineries in the U.S. were shut down at once; if the electric grid were shut down intentionally so it would take days or weeks to come back up\u2026 If you think through the consequences, you would understand the critical role and the severity of the outcome of a compromise of control systems,\u201d he explains. \u201cAll it takes is shutting down the water utilities and power utilities in a couple cities for an extended period, and you have a very, very disastrous situation.\u201d<\/p>\n Habibi describes a scenario that begins as a period of inconvenience. The air conditioning goes out. You might even have to buy drinking water and fill the bathtub for facilities. Then it goes from inconvenience to shortage\u2014you run out of gas and food starts to rot. Dogs are out on the street because they\u2019re not being fed. It starts looking like a post-war environment, with sanitation problems and disease.<\/p>\n \u201cDo we have an example where that\u2019s actually happened? No. But we have seen where nation states have tested these systems,\u201d pointing to cybersecurity attacks on power systems in the Ukraine and nuclear facilities in the U.S. \u201cThe ability is there to make it happen.\u201d<\/p>\n Habibi believes that nation states are looking at cyber attacks on the industrial sector as the next generation of stealth weapons. \u201cThese are nations that are at odds with us. These are not pranksters,\u201d he says. \u201cThese are guys who are testing their weapons.\u201d<\/p>\n The threat is real, and people know it, Habibi says, adding that many customers have begun looking to PAS for help in cybersecurity. \u201cPAS from the beginning was a company that made industrial facilities safe and optimized their processes,\u201d he says. \u201cThe same technologies used to improve plant safety and reliability are the foundational platform for securing industrial control systems.\u201d<\/p>\n In fact, it was a major electric utility in the Southeast U.S. that first approached PAS six or seven years ago, concerned about the cybersecurity requirements it faced as part of NERC CIP (North American Electric Reliability Corp. critical infrastructure protection). The utility had been using PAS\u2019s software to improve reliability and integrity of its control systems, and they believed PAS had the underlying ability to get to the NERC CIP requirements, Habibi says.<\/p>\n So PAS has built on its previous experience to create a foundational platform related to cybersecurity. It includes:<\/p>\n Though PAS did not previously offer vulnerability assessment or patch management, visibility to the inventory has been a critical part of its safety and reliability offerings. That visibility becomes even more critical where security is concerned. \u201cAnomaly detection is not enough,\u201d Habibi stresses. \u201cTo have anomaly detection without the foundation is like hiring an alarm company to install a system on your house, but missing about 80 percent of the windows and doors because they don\u2019t have visibility to the inventory.\u201d<\/p>\n Cybersecurity has long been an issue in the IT space, and that market is mostly saturated. Traditional IT security companies are now rushing into the ICS market. But coming from an IT point of view, they tend to overlook levels 0 and 1 because they don\u2019t have visibility there. \u201cThe solutions that address cybersecurity for IT are necessary, but inadequate or incomplete for addressing operational technology,\u201d Habibi says. \u201cI\u2019ve got to have the moat to protect the castle, but that\u2019s not enough.\u201d<\/p>\n As a supplier focused on the operations environment, PAS first emphasizes securing the foundation\u2014developing and implementing policies, understanding what the system should look like, what processes are used to make changes, and automating those processes into work flows, Habibi says. \u201cWe address the plant operational performance in terms of monitoring and safety. That works hand in hand with security,\u201d he says. \u201cThe same human behaviors and mistakes that lead to plant shutdowns are the same behaviors that a bad actor would have in bringing down the plant. We\u2019ve been addressing the human aspect in automation systems for 23 years.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":" It\u2019s difficult to write about cybersecurity without sounding like Chicken […]<\/p>\n","protected":false},"author":1,"featured_media":657,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"yoast_head":"\n\n
\n