Story image

Why operational technology environments need to be secured

24 Oct 18

Article by Honeywell digital operations, ICT and cybersecurity leader Mirel Sehic

Buildings are rapidly embracing digitisation.

Whilst the convergence of smart technologies and physical environments has greatly improved business operations and overall capabilities, this has led to increased vulnerabilities and attack vectors not previously encountered.

For years, this challenge has brought about a heightened focus and awareness around securing corporate and more traditional Information Technology (IT) systems.

However, Operational Technology (OT) environments, which house sensitive control systems, are often overlooked, leaving them vulnerable and liable to be the weak link in the organisation.

With the proliferation of IoT technology and the evolving digitisation of industrial environments, organisations in control of critical infrastructure, smart buildings and smart cities can no longer afford to ignore the growing cyber threat risks.

Now more than ever, increasing cybersecurity assurance in OT environments is front of mind for organisations.

Why OT may be a target

In recent years, the focus on cybersecurity has been on protecting traditional IT systems and tighter controls on information security, aimed at safeguarding personal and corporate data.

But with the rise of smart digitisation technologies and the ability to extract value out of previously disconnected or air-gapped OT systems, these systems start to enter a world they perhaps weren’t originally designed for and can become a new desirable target for cyber criminals.

The advent of IoT and the increasing demand for smart technology in a more-than-ever connected world is a major contributor to the increasing threat footprint in the OT space.

These systems have traditionally been out of sight for IT departments and have often not had the same level of monitoring, protections or oversight put in place.

As such, the OT environment may be plagued by misconfiguration, vulnerable hardware and software, poor cybersecurity practices, outdated network components, and lack of general cybersecurity awareness.

It may be a big mistake to believe that your organisation is not at risk of an attack.

The reality is that many OT systems are experiencing cyber attacks similar to IT networks.

IBM managed security services (MSS) data indicates there has been an 110% increase in attacks on industrial control systems since 2016 - a threat landscape that is predicted to grow at a phenomenal rate to 2020 and beyond.

Understanding the threat landscape

The threat landscape is continuously evolving, with new attack techniques discovered on an almost daily basis.

A first step to building a strong cybersecurity ecosystem is to have an understanding and awareness of attacker motives and common cyber risk scenarios.

Attacks are being carried out by various attackers including nation-states, industrial spies, cyber criminals and curious tinkerers, as well as incidents inadvertently deployed by negligent or untrained staff.

While attacker motives shift and change almost as fast as technology evolves, the top three motivations remain - financial gain, disruption of service and theft of personally identifiable information or intellectual property.

Within the smart building environment, control systems often present easy targets, with common cyber threat scenarios including:

  • Accessing building control systems
  • Disrupting power management functions causing business interruptions as shutdowns
  • Tampering with temperature settings on HVAC systems
  • Accessing internet-connected physical security systems
  • Improper network segregation using OT systems to potentially gain access to other, more secure, environments

By understanding the cybersecurity risks in OT, decision-makers are better placed to make smart buying decisions, implement targeted OT security controls, educate personnel in effective procedural measures and maintain enhanced cyber resilience across their environments.

Creating a cyber-smart strategy

Maintaining a more secure and resilient OT environment requires a wide-ranging strategy that includes employee training, implementation of security governance and process, as well as investment in the right technology.

There is no quick fix when it comes to cybersecurity.

However, as a first step, organisations need to establish an understanding of their internal threat landscape, mapped maturity level and assessed risk appetite.

A great place to start is by conducting a cybersecurity threat and risk assessment.

This process aims to detect vulnerabilities, determine quick wins and establish the cybersecurity maturity of an OT environment.

This assessment will serve as the foundation for an overall cybersecurity strategy, underpinning the processes and procedures for more holistic risk mitigation.

These strategies will often need support from C-level executives and will require clear communication from top-down to all stakeholders and staff.

A lack of understanding internally can often lead to a breakdown in cooperation and process, which can result in an incomplete execution of strategy and contribute to successful breaches.

Developing a cyber smart strategy is a journey – one that typically involves ongoing assessment of internal processes and procedures, staff awareness programs and adoption of suitable applications – all of which are specific to a set of defined organisational requirements.

While climbing the cybersecurity maturity ladder will take time, the key is to be informed and take the first step.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
How SMBs can use data to drive business outcomes
With the right technology, companies can capture consumer, sales, and expense data, and use it to evaluate and construct future plans.
Survey shows that IoT is RoI across Asia Pacific
A recent Frost & Sullivan survey across Australia, Hong Kong and Singapore shows that IoT deployment improves business metrics by around 12%.
IDC: Aussie spending on IT Services to hit $23.5B by 2023
the project-oriented market which is predicted to achieve the highest CAGR through to 2023; though no market is expected to decline
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.