Cyberattacks on the electrical sector are becoming part of everyday life. The tools the attackers use are increasingly becoming more sophisticated. Industrial systems are now as much affected by cyber threats as traditional IT enterprise systems. The attackers often aim to disrupt operations by stealing intellectual property and blocking access to data for ransom.
Many of the devices used today were designed in an era where the idea of an attacker persistently trying to penetrate a system was not a primary concern or design criteria. Hackers exploit weak points in the design and implementation of systems. The number of attacks on Operational Technology (OT) is increasing every year.
Rapid technological advancement and low-cost computing devices have brought widespread networking to our daily activities. The same technologies are making a new generation of automation systems based on Internet Protocol (IP) enabled devices and advanced standards possible. These new implementations also provide an access path to devices that were traditionally isolated.
Integrating IT systems with OT networks and the increasing use of cloud-based technologies are diminishing the traditional layers of OT networks (trusted vs. untrusted). The security perimeter no longer exists, as vendors, consultants, and other entities have a legitimate reason to be “inside” the network. As a result, traditional OT security defenses are becoming less effective, and systems that were regarded as highly secure are now exposed to the same vulnerabilities as IT systems.
It’s clear that a holistic cybersecurity framework is not just a good idea, but a necessity in today’s digital landscape. This framework is required to develop networks and systems where defensibility, reliability, and resiliency are the core design characteristics. It will integrate people, processes, and technology to mitigate the risk in a layered approach. The framework will address the following:
- Policies, procedures, standards, and guidelines should be reviewed and updated regularly. This includes cybersecurity, risk management, incident response, business continuity policies, and appropriate training. A good cybersecurity program will also help an organization comply with applicable regulations.
- Assessments should be performed periodically by a qualified resource. The scope of the assessment should include physical security, people and processes, network security, host security, and device security. Ongoing cybersecurity assessments are crucial in identifying new vulnerabilities and evaluating the effectiveness of existing defensive controls.
- Physical Security addresses threats, such as unauthorized access, theft, vandalism, and natural disasters. It often employs controls, such as fences, barriers, locks, cameras, various sensors (e.g., that detect tampering with the control cabinet), and uninterrupted power supplies. Physical security is a major concern for assets like controls, meters, and transformers. Distribution systems equipment, including substations and pole-top devices at remote locations, should have strong physical security. A risk assessment can determine the necessary mitigation controls.
- Network Security protects the network and data’s confidentiality, availability, and integrity. It prevents unauthorized access and modification of the network and assets attached to the network. Network security can start simply by using a firewall defining the electronic security perimeter and continue further with multifactor authentication using complex hardware and software technologies, as well as Software Defined Network (SDN) and Zero Trust Network Architecture (ZTNA). This depends on the risk level the organization is willing to accept based on the risk assessment results.
- End point/Host Security protects and defends the host from malicious attacks. A host can be, for example, an IED, a PLC, a workstation, SCADA servers, and controllers. Host security addresses all aspects of the hosts, including hardware, software, data at rest, and data in motion. Often, assessment and remediations focus on hardening the host by eliminating unnecessary or insecure services and applications, implementing intrusion detection and prevention systems, and audit logging; the application and SCADA protocol security is often overlooked. The application running on an IED controls that interface to the outside becomes a prime target to attackers. Evaluating and finding vulnerabilities in the application requires a specialized skill set as applications often include vendors’ intellectual property and are governed by international laws, making it illegal to reverse engineer the application.
With the emergence of advanced technologies and interconnected systems, traditional IT enterprise systems are no longer sufficient to protect sensitive data and valuable assets against sophisticated cyber threats. Safeguarding these critical elements demands a comprehensive and integrated approach to cybersecurity, incorporating proactive risk management, advanced threat detection, robust defense mechanisms, and resilient response strategies.
