Secure your plant

Cyber attackers display detailed knowledge of IC and production processes. PHOTO: THINKSTOCK

With the arrival of the Industrial Internet of Things (IIoT) in modern manufacturing, the threat of sabotage comes from distant hackers who can infiltrate a plant’s network and severely damage processes with a mouse click.

Increasingly, industrial control (IC) systems are relied upon to ensure the smooth operation of plants. Historically, they operated separately from the corporate IT network, but with the evolution of the internet and network connectivity, manufacturers see the advantages of an interconnected network model.

While IC systems were built for sustainability, they weren’t necessarily designed with cybersecurity in mind. A GE New Technology Magazine article notes in 2014, the US Department of Homeland Security’s Industrial Control Systems Computer Emergency Response Team responded to 256 specific cyber incidents related to critical infrastructure (including certain key industrial facilities).

A Honeywell whitepaper warns a cybersecurity breach to an IIoT-enabled industrial facility can result in: communication and connection failure; unauthorized access, theft, or misuse of information; equipment damage; environmental damage; lengthy periods of downtime; violations of legal and regulatory requirements; financial loss; and threats to public safety.

Cyber threats to manufacturers are not hypothetical. A The Security Ledger article describes a German steel factory that fell victim to a targeted attack that caused severe physical damage to the facility. Attackers gained unauthorized access into the factory’s computerized operational controls and production networks, and disrupted the control system components of a blast furnace. They increased the pressure of the crude oil inside the factory’s pipeline, which caused an explosion and massive damage to the system. They also erased more than 60 hours of surveillance video in an effort to cover their tracks. Operators didn’t learn of the explosion until 40 minutes after the incident.

Managing cyber risk

Although there is no “one size fits all” to secure manufacturing processes and assets, businesses can take steps to effectively manage IIoT cybersecurity issues by incorporating a risk-based plan into every phase of industrial development, infrastructure, manufacturing and design. The following steps provide a starting point:

• Protect the network. Ensure there are no unprotected or unsecured points of entry. Install critical software patches as quickly as possible and use commercial grade anti-virus/malware services. Ensure remote connections and outbound traffic are filtered through firewalls and use them to separate different layers of the IC systems network, which can be further segregated into security zones.
• Strengthen passwords. Change passwords frequently and ensure they’re sufficiently complex. Where appropriate, consider implementing multi-level authentication (including passwords generated by third-party authenticators).

• Protect the Crown Jewels. Identify the most critical and sensitive information and ensure the most vital assets and systems storing it have appropriate security. Consider encrypting any critical data when in transit and/or storage.

• War gaming. Assume the worst-case scenario. Conduct risk analyses, vulnerability assessments, drills, equipment maintenance and testing. Consider retaining a third party to conduct a security audit.

• Prepare the front line. Ongoing employee training and awareness is critical. It will reduce exposure to cyber threats, such as spear phishing and social engineering. Focus training on fostering a culture of procedural compliance, a questioning attitude and having the knowledge needed to identify potential threats.

• Think mobile. Assess the security level of remote devices such as tablets and smartphones and how they are allowed to connect to networks. Remote access through a virtual private network should only be granted to the minimum set of hosts and users, and to parts of the networks necessary for the users to complete their tasks.

• Look critically at your IC systems. Consider redesigning them to use the fewest communication channels. Restrict physical access and user privileges. Consider implementing a network typology that has multiple layers with the most critical communications occurring in the most secure and reliable layer.

• Have a cyber monitoring team. Communication and coordination between different departments is critical. The team should consist of knowledgeable managers and professionals (internal and external) who will meet regularly to assess threat levels, discuss how to address gaps and make recommendations to management on how to protect digital assets.

As cyber threats continue to evolve at a rapid rate, security countermeasures must adapt and take the lead. Constant re-evaluation and re-thinking of traditional approaches will help manage incidents before they become operational crises.

Imran Ahmad, a lawyer at the Toronto law firm Cassels Brock & Blackwell LLP, develops strategies related to cyber threats and data breaches.