Page 40 - Security Today, January/February 2022

Countermeasure
Considerations
Exploring how to build resilient industrial networks By Alvis Chen
Nowadays, more businesses understand that digitalization is necessary for them to survive and thrive. A 2019 Deloitte Smart Factory study found that 86% of manufacturers felt their smart factory initiatives would be the main driver of competitiveness over the next five years. In 2020, these initiatives have accelerated due to the global pandemic.
In a recent report by the World Economic Forum, Building Resilience in Manufacturing and Supply Systems in the COVID-19 Context and Beyond suggests that manufacturers adopt new working models and governing to increase manufacturing resilience. However, as we face the current crisis, accelerating digitalization alone is no longer sufficient. The best plan is to explore how to build resilient industrial networks and deploy cybersecurity defenses, in order to sustain continuous industrial operations.
THE INDUSTRIAL CYBERSECURITY JOURNEY
As the number of cybersecurity incidents happening in industrial control systems (ICS) continues to increase, many organizations have started to develop their own cybersecurity strategies in order to protect assets they regard as critical to successful operations.
“Is there a silver bullet that can address all vulnerabilities in the ICS?” Unfortunately, there is no such thing. Consider cybersecurity from different perspectives. The start of a cybersecurity journey often begins with a risk assessment. After this, companies can establish security policies accordingly. In order to implement the security policies, it is worthwhile to create a security architecture to help achieve secure network infrastructure.
For instance, regulating who can access the network by utilizing access control lists. Finally, companies can proactively monitor and respond to cybersecurity incidents by implementing industrial cybersecurity countermeasures on OT networks.
CYBERSECURITY NEEDS TO BE HOLISTIC
As mentioned in the previous paragraph, every industrial cyber- security journey includes different phases with relevant counter- measures. There is no single solution that can cover all aspects, so a recommendation includes that cybersecurity be viewed from a holistic perspective. Traditional countermeasures such as fire- walls strengthen the perimeter defense of industrial networks.
These provide effective vertical protection to prevent people who do not have permission to access the network. However, when someone manages to get through that defense, or engineers accidentally dispatch a wrong command inside the network, there are no measures to mitigate the risks.
Therefore, deploying horizontal protection such as virtual
patching and an IDS or IPS is also important. In the following sections, we will consider how vertical and horizontal protection both play a significant role on securing industrial networks.
VERTICAL PROTECTION: BUILD SECURE
NETWORK INFRASTRUCTURE TO IMPLEMENT SECURITY POLICIES
Network management. Industrial networks are often pieced together over years or even decades. Therefore, gaining visibility of the network and its various components and architecture can be a challenging first step. From our experience, we have discovered that an industrial network management tool that can scan a network and automatically draw out the topology will give OT engineers a lot of useful information, which in turn allows them to develop an action plan.
Network protection. Network segmentation is a fundamental precaution that can ensure only certain traffic can flow within designated areas. There are several methods to achieve network segmentation. For instance, stateful firewalls can help create the first line of defense without needing to change the network topology; the perception is friendly for OT environments, as they need to operate continuously.
Creating virtual LANs (VLANs) within a larger network can also help segment networks. Another rule of thumb is to implement authentication via 802.1x (AAA/Radius TACACS) and access control via an ACL. Remote control, monitoring and maintenance have become more and more prevalent during an OT engineers’ daily operations. You should always remember that ensuring secure remote access reduces the chance of breaches.
Device security. As organizations start to take cybersecurity more seriously, the two biggest challenges include developing and implementing practical and appropriate security policies around authentication and network segmentation. Standards such as IEC 62443 can be very helpful in identifying policies that will make sense for their industrial networks.
HORIZONTAL PROTECTION: DEPLOY INDUSTRIAL CYBERSECURITY TO PROACTIVELY MONITOR AND RESPOND
As organizations start implementing cybersecurity measures into their industrial networks, the first step is to protect network traffic that travels vertically is a defense mechanism such as network segmentation.
Is this measure enough? The answer, unfortunately, is no. Although north- and south-bound traffic is managed and the defense is well built, employees, vendors, and contractors still have direct access to the networks. If there are no protection measures, this inadvertently allows them to bypass traditional protections
40
JANUARY/FEBRUARY 2022 | SECURITY TODAY
CYBER SECURITY