More network connections equal more vulnerabilities to potential cyber-probes, -intrusions and -attacks. However, it helps to understand the historical context in which they emerged and multiplied because it guides more effective responses.
“COVID-19 accelerated remote access adoption at a speed nobody could have anticipated. This impacted cybersecurity, but this was compounded in recent years by geopolitical tensions and the more recent artificial intelligence (AI) evolution,” says Tadeu Batista, global cybersecurity business development manager at Emerson. “The days of security by obscurity in operations technology (OT) have ended, according to recent Cybersecurity and Infrastructure Security Agency reports. Instead of OT assets simply being collateral damage, they’re often the target of today’s cyber-attacks. Bad actors repeatedly and successfully exploit critical infrastructures with direct Internet connections, such as hydroelectric power generation. In many cases, attackers are state-funded and seek to destabilize critical operations. If industrial equipment is connected to the Internet, someone is trying to find it. In addition, AI tools are rapidly accelerating this arms race, helping intruders find, target and disrupt physical OT assets more quickly than they could just a couple of years ago.”
To counter these fast-moving and now AI-aided cyber-threats, Batista reports that users and their cybersecurity teams must quickly shift from traditional security-by-obscurity mentalities.
“AI no longer allows that freedom. It shines a light on all the assets that were obscured for decades, and opens them up to attack. It’s time to start assuming we’ll be compromised, rather than hoping we won’t, and adjusting to protect against that potentiality,” explains Batista. “Understanding the impact requires understanding consequences, and knowing what’s exposed. Continuous operations tend to have more engineering with more purpose-built networks that can be costly to restart. Discrete operations might handle disruptions more easily, restarting quickly for example, but they often lack proper segmentation and are frequently exposed.”
In either case, Batista adds that users must map all their OT assets, and properly define their criticality to production, safety, and/or the environment. They can then move on to the architecture itself, identifying zones, conduits and countermeasures in place. One effective way to do this, as promoted by the Idaho National Laboratory (INL), is to consider the impact of each asset that could be compromised and work backwards from there. Once that’s done, teams can determine if the tactics, techniques and procedures already in place are enough to defend their assets.
“When OT cybersecurity infrastructure is in place, teams need to set a plan to revisit it regularly because cybersecurity must constantly evolve. It’s never set-and-forget,” adds Batista. “In many cases, what’s worked in the past will not continue to work indefinitely, especially with the rise of AI.”
Data access essential despite exposure
At the same time that cyber-threats and solutions are evolving, users are seeking more data than ever, and that means more access and potentially vulnerable connections cybersecurity product and program leader at Emerson
“We still see users claiming their cybersecurity strategy is having air-gapped OT, but the reality is increased pressure to improve performance is driving their need for data to improve optimization, reliability and enterprise decision-making—leading plants to be more connected,” says Kane. “Instead of avoiding connectivity, it must be accomplished in a very intentional way, and it must be controlled and observable.”
Emerson’s strategy for securely accelerating connectivity across enterprise includes:
- Risk visibility and prioritization by performing cybersecurity and criticality assessments to allow prioritization and visibility into attack surfaces.
- Secure access and connectivity by implementing network segmentation and controlled remote-access technologies.
- Monitoring and threat detection by actively monitoring network traffic to detect unauthorized software and emerging threats.
- Compliance and resilience by continuously aligning with cybersecurity standards and best practices, such as IEC 62443, as well as performing regular patching, audits, and using proven, tested backup and recovery strategy and technologies.
To adopt these capabilities, Kane advises users to start with a defense-in-depth architecture. This consists of separating operations into functional zones, controlling conduits between them, removing unnecessary connections, securing remote access with strong authentication and least-practical-privilege, and monitoring communications for abnormal behavior.
“Enterprise systems shouldn’t be connected directly to the control system, even to read data. That data should come from a replicated source, such as Emerson’s DeltaV Edge Environment software or a historian in a network’s demilitarized zone (DMZ),” explains Kane. “In sensitive situations, unidirectional gateways (data diodes) can provide data flows without any routable pathway back to a control system. Where possible, data should move through controlled interfaces, like DeltaV Edge Environment, rather than creating direct paths into the control system.
“Foundational controls also still matter, including account management, elimination of default credentials, system hardening, tested backups, risk-based patching, endpoint protection and control of portable media are all critical, regardless of the specific elements of defense-in-depth architecture surrounding OT. None of these should be implemented in isolation from the availability, safety, and lifecycle requirements of the automation system.”
Standards enable security
Because common and agreed-upon cybersecurity practices let everyone present a united front against cyber-threats, standardizing those protections improves cybersecurity even more.
For instance, Batista reports that IEC 62443 standards are the most relevant for industrial automation and control systems because they details the responsibilities of asset owners, service providers, system integrators and product suppliers. Likewise, National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF) 2.0 provides a useful enterprise-level structure, especially by adding its Govern function, while NIST SP 800-82 remains a practical reference for applying cybersecurity to OT environments.
“Another important development is how standards, end user requirements and regulations are starting to work together,” says Batista. “We’re seeing end users move beyond asking whether a supplier is certified. In one recent qualification process, the end user requested detailed certification-assessment reports, not only for the product itself, but also focused on Emerson’s ability to deploy cybersecurity services in accordance with the requirements.
“Zero-trust cybersecurity is also increasingly becoming a de facto standard. A recent example of this is covered in CISA’s ‘Adapting zero-trust principles to operational technology’ (https://www.cisa.gov/resources-tools/resources/adapting-zero-trust-principles-operational-technology). In addition, the North American Electric Reliability Corp.’s Critical Infrastructure Protection (NERC CIP)-015 mandates internal network security, and this will likely start to drive behavior change, even outside CIP-regulated industries.”
Resolving patching and other OT-IT issues
To help navigate increasing cyber-threats, including those driven by AI, Kane reports that one of Emerson’s large, critical-infrastructure clients recently sought to adopt a diligent patching regimen. However, as its IT department moved to a more 48-hour patching model, its OT team found it needed to improve its posture, too. Similar to many plant-floor security efforts, the OT team struggled to align patching updates with their high-uptime requirements, and were further hindered by limited visibility into many process operations. In short, they needed an easier way to find and deploy patches, and they needed detailed information to schedule them without disturbing operations.
Ultimately, the organization determined that the best solution was a trusted-lifecycle cybersecurity approach using Emerson’s Guardian Cybersecurity software. It monitor system health, vulnerabilities and emerging threats, while examining the patching status of the user’s systems, and providing easier, centralized audit readiness.
“Many customers realize late in the game that OT security has become critical to their enterprise objectives, and they must create more secure environments. That realization can be overwhelming, so we call it a journey because it’s impossible to tackle it all at once,” adds Kane. “Because many teams don’t know what they don’t know, every cybersecurity effort starts with an assessment. Emerson’s experts help them evaluate their current OT environment-based security best practices, compare them to IEC 62443 requirements, develop a plan to improve their security posture, and maintain that momentum indefinitely because cybersecurity will always need to be updated.”
Assessment guides planning
Batista agrees the first task for any cybersecurity team is conducting an accurate assessment of its organization’s production assets and identifying their criticality.
“Until an organization knows what it has and why it’s important, it’s nearly impossible to build an effective cybersecurity strategy around a technology stack. Even teams that think they have a good accounting of their assets should be sure their current list is up to date,” says Batista. “Changes happen frequently over time, and those changes create new vectors for cyber-attacks. Just as homeowners don’t just check their door and window locks every six months, cybersecurity teams must routinely check the status of their plant-floor assets.”
Batista adds that a well-considered cybersecurity plan is also critical because just doing something in a non-structured way could be worse than doing nothing.
Along with their assessment, he recommends that users start their journey by identifying and understanding what security-assurance programs their organization already has in place. They should review existing IT policies and procedures to see if they’re a good fit for OT, or if they need to be adjusted to align with its environment. They should also determine if there any regulations the organization needs to follow, or decide if their objective is improving OT security to meet the overall organizational goals. Answering these questions will let teams start creating a framework for assessing their OT environment, and identify gaps that need to be addressed.
“Teams must also check their network paths. It’s important to ensure that every connection and device is making a legitimate connection, so there are no paths to the Internet that shouldn’t exist or other compromises in network segmentation,” adds Batista. “End users should check firewalls, and make sure temporary firewall rules haven’t become permanent fixtures that leave doors open. Antivirus and other endpoint protections are critical, but if network segmentation isn’t managed properly, those elements are far easier to circumvent.”
Securing low-level sensors and devices
To establish and maintain cybersecurity for sensors and other device-level components, Kane prescribes addressing their Ethernet connections and implementing encryption.
“Today’s powerful sensors aren’t just two-wire devices returning data. Modern, intelligent sensors are often Ethernet-connected devices that can be exploitedddition, Ethernet Advanced Physical Layer (Ethernet-APL) protocol is bringing Ethernet all the way to the sensor level. This means sensing does, indeed, need protection.”
Kane reports that encrypted protocols can help add a layer of protection to the sensors themselves. “Secure communications including encryption should be delivered all the way to the device,” he says. “Level 1 industrial firewalls are also a critical element of a secure device posture.”
Kane adds that OT teams often forget the importance of acquiring devices from a supplier that uses a secure lifecycle. Introducing a sensor from a poorly-known
“Teams should adopt devices with signed firmware and secure boot capability to help ensure manufacturer integrity,” adds Kane. “The best strategy to limit risks from growing cyber-threat surfaces due to increasingly networked sensors and other devices is to make certain they’re purchased from a reputable company with a secure supply chain, and then connection these sensors to a network and device management tools designed with a layered defense-in-depth strategy.”
Catching up with AI
While AI has arguably hurt cybersecurity efforts more than it’s helped, Kane argues this dynamic can easily change once users and developers figure out how to use AI defensively.
“The dichotomy makes sense—attackers can afford to use AI in a completely unbridled way, but to set up an AI-based defense with no guardrails can potentially cause as many problems as it solves,” explains Kane. “That challenge is why we can’t rely solely on AI. We need other protection mechanisms and a zero-trust approach to cybersecurity. In fact, this trend is currently being demonstrated in the marketplace, with model developers deliberately restricting models that excel at finding vulnerabilities.”
Nonetheless, AI is being used by cybersecurity professionals to build more secure development practices. Kane reports that vulnerability and risk assessment testing is stronger than ever, making it possible to release more secure products.
Another challenge is AI’s impact on existing technologies. “It can detect vulnerabilities in existing systems so quickly that patching has become a critical concern,” adds Kane. “AI can also identify problems with products that have already been released, so suppliers can develop patches, though patching more often in OT environments is a hurdle.”
However, Kane concludes that AI isn’t at the point where it can act on its own in an OT system for protection purposes. “It can alert a human to an issue, and suggest the best next step, but human interaction is still a critical element of the overall cybersecurity defense workflow,” he says. “For the foreseeable future, the most successful organizations will stick by a cardinal rule: AI can read and recommend but it shall not hold write access to the control system.”
Cooperation and coordination is the future
Finally, because cyber-threats will always keep on evolving, Batista reports regulations will continue to increase. This will require users and automation suppliers to work more closely to develop and implement stronger cybersecurity protections without destabilizing operating conditions.
“We expect to see more automation solutions that make cybersecurity easier to implement in OT environments. At Emerson, we focus on secure-by-design solutions that provide secure default settings out of the box,” says Batista. “This approach has been part of Emerson since the beginning, but the European Union’s Cyber Resilience Act (CRA) and other regulations and standards are increasingly starting to demand it.
“One of the best trends we’re seeing is these standards and regulations are starting to converge in their language, presentation and intentions. CRA, NIS2, NERC CIP, CISA and others are all increasingly referencing or aligning with IEC 62443. Today, end users in nearly every region won’t evaluate solutions if they don’t meet certain cybersecurity criteria. We’re going to see suppliers required to meet stricter cybersecurity requirements in the future.”
Despite these gains, Batista adds that OT teams will continue to be challenged to maintain security tools and processes. “All signs suggest OT-managed detection and response is where the industry is going,” he says. “This means partnering with enterprise IT or a third-party security operations center with an automation vendor that understands what normal cybersecurity looks like. OT teams should be free to focus on production, not on standing up a 24×7 security team. It will be increasingly important to improve coordination and cooperation as IT and OT converge, so users have the updated cybersecurity protections they’ll need.”
