Best Practice Guide for ICS Security
Industrial control system (ICS) security presents unique challenges for industrial and critical infrastructure operators
Why Is ICS Security Particularly Challenging?
The Use of AI, 5G and Other Emerging Technologies Creates Risk
Traditional ICS devices are difficult to secure without creating adverse disruptions to critical industrial processes. The widespread use of emerging technologies such as 5G cellular networks, artificial intelligence, and advanced data analytics introduces both advantages and uncertainties that significantly change the ICS security risk landscape.
Air-Gapping Is No Longer Viable
ICS networks were traditionally air-gapped from the rest of the enterprise network, making them virtually unassailable from outside the organization. Most cyber threats stemmed from human error, accidents, natural disasters, and acts of physical sabotage.
Today, digital transformation and process automation are forcing a tighter integration between traditional ICS devices and networks, business applications and external organizations such as supply chain partners, customers, and even federal regulators. As a result, air gapping is no longer a viable strategy.
Legacy Devices Were Designed For Reliability, Not Security
Traditional ICS devices usually have decades-long lifecycles. They were purpose-built, stand-alone systems designed for reliability rather than security. They often run stripped-down versions of operating systems, with security features and other complex services removed for greater cost-efficiency in large scale deployments. As a result, ICS devices are highly vulnerable assets commonly used by threat actors to penetrate the rest of a connected enterprise network.
Network Segmentation and Zero Trust Has Been Slow to Come to ICS
ICS network administrators have been reluctant to deploy traditional IT security techniques such as network segmentation or zero trust solutions. They’re concerned about the complexity and overhead that usage will introduce to managing physical processes and the rest of the critical infrastructure. The convergence of physical and ICS cybersecurity processes, along with increasing integration of ICS with business networks and internet-based applications, has vastly increased the prevalence and complexity of cyber threats to ICS networks.
The Convergence of IT and OT Exposes Security Gaps
ICS manage physical operational processes, so the increasing convergence of information technology (IT) and operational technology (OT) creates opportunities for exploitation. This could lead to catastrophic consequences, including loss of life, economic damage, and disruption of the critical infrastructure society relies on every day. Ultimately, ICS infrastructure is very attractive to malicious threat actors seeking to cause harm.
How To Improve ICS Security
Take A Multi-Pronged Approach
To defend your industrial control systems against a diverse set of cyber threats, you need a comprehensive platform that covers threat detection, risk management and mitigation.
The key to improving ICS security lies in choosing a solution that delivers:
- Insight into specific IoT devices and industrial processes. This level of detail is needed to identify anomalous patterns of activity that could indicate a threat or intrusion.
- Fast identification of vulnerabilities in specific IoT endpoints, and correlation of asset visibility with known vulnerability databases. This will significantly simplify the management of security issues and help prioritize remediation efforts.
- Asset management and threat detection capabilities that leverage Artificial Intelligence and Machine Learning (AI/ML). This will help prioritize issues against large traffic patterns, whether at the edge of the network or in the IT network, like the data center and cloud facilities.
Choosing the Best ICS Security Solution
Look for the following criteria when choosing a security solution to help manage your ICS assets and vulnerabilities, along with threats and remediation efforts:
A security and visibility platform that was designed with large industrial ICS environments in mind.
The ability to protect large industrial ICS environments containing thousands of industrial control devices across multiple sites and remote locations is critical.
An ICS security solution that offers a flexible, multi-tiered architecture is preferable so that you can scale as your devices grow.
A security platform that provides detailed insight into ICS devices and industrial processes.
Make sure you choose a solution that delivers cybersecurity and analytics for every connected device, including OT, IoT and IT assets.
Artificial Intelligence and Machine Learning (AI/ML)-based asset management and threat detection capabilities will help you prioritize issues against large traffic patterns, whether at the edge of the network (where “things” are), or towards the data center and cloud network.
How the Nozomi Networks Cybersecurity Platform Helps You Close ICS Security Gaps
ICS Asset Discovery
Identify all communicating assets on your networks.
Incorporate extensive asset information including name, IP and MAC address, type, serial number, firmware version and components.
ICS Vulnerability Assessment
Detect vulnerable assets to prioritize remediation.
See all vulnerable OT and IoT assets, utilizing the U.S. government’s National Vulnerability Database (NVD) for standardized naming, description and scoring.
ICS Threat and Anomaly Detection
Identify ICS cybersecurity and process reliability threats.
Integrate comprehensive threat and risk monitoring from behavior-based anomaly detection and signature-based threat detection.
Smart Polling
Deeper, more sophisticated asset tracking to identify IoT device vulnerabilities.
A powerful combination of active and passive asset discovery for enhanced asset tracking, vulnerability assessment and security monitoring. Its strategies cover typical IoT protocols as well as a wide range of OT devices.
Vantage Delivers Industrial Strength ICS Security
A scalable cloud-based platform ideal for IoT cybersecurity.
Nozomi Networks’ latest software as a service (SaaS) platform leverages the power and simplicity of the cloud to deliver unmatched security and visibility across your ICS and IT networks. Vantage allows for much larger scalability across multiple sites typical of global ICS cybersecurity operations.
The Devastating Impact of an ICS Security Breach
- Duke Energy Corp. was fined $10 million by the North American Electric Reliability Corporation (NERC) for cybersecurity violations that took place between 2015 and 2018. The 127 violations of safety rules included failure to protect sensitive information on its most critical cyber assets and allowing improper access to sensitive systems and physical locations. The lapses were considered to pose “a serious risk to the security and reliability” of the power system. Most were self-reported and attributed to lack of managerial oversight.
- The ransomware LockerGoga blocked the systems of Norsk Hydro, forcing a switch to manual operations and workarounds. The Extruded Solutions unit, which makes components for car manufacturing, construction and other industries, reduced its output by 50%. Administrative systems, such as reporting, billing and invoicing, suffered delays. It took Norsk Hydro several weeks to bring operations back to normal. Lost margins and low production volumes were estimated to cost up to $70 million.
It's Time to Act—ICS Security Risks Have Never Been Greater
In April 2021, the Biden Administration launched an ICS Cybersecurity Initiative to strengthen the cybersecurity of the critical infrastructure across the country.
The initiative kicked off with a 100-Day Action Plan for the U.S. electricity subsector led by the U.S. Department of Energy’s (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) in close coordination with the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and the Electricity Subsector Coordinating Council (ESCC). On July 28, 2021, President Biden further emphasized the importance of this initiative and broader ICS cybersecurity efforts through his National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems.
To learn how Nozomi Networks aligns with these initiatives, see our webpage on Addressing the US Department of Energy ICS Cybersecurity Considerations.
Request a Personalized Demo
See how easy it is to:
- Discover all OT, IoT, ICS, IT, edge, and cloud assets on your networks
- Gain immediate awareness of cybersecurity threats, risks and anomalies
- Detect security incidents and respond quickly
- Consolidate security, visibility, and management within a single platform
