The Toggle between Risks and Threats

An industrial control system (ICS) is a generic term usually used to automate and control systems such as distributed control systems, industrial processes, manufacturing, product handling, supervisory control, and programmable logic controllers. These legacy devices were originally only accessed remotely through a single access account for users to manage them from other networks. This vulnerability expanded the attack surface, leaving the system vulnerable to new emerging threats and risks with absolutely zero ability to manage user access. ICS being the base controller for all tiers in an infrastructure layered architecture, it is imperative to secure it to maintain a sane functionality. This document introduces some security risks and threats to ICS and the security considerations to implement and protect them unconditionally.

Top Risks to ICS

If an organization’s industrial control system is compromised, the following are a few risks that can transpire:

• An infected industrial control system can lead to a plausible scenario where the damage can move laterally into an organization’s network if not controlled.
• An impact on the business operations can cause collateral damage to a company’s PII/data or blemish its public reputation (Which can also be a monetary loss due to the downfall of company stocks).
• Unauthorized access to industrial control systems can lead to unauthorized changes to commands, instructions, source codes or even damage proprietary equipment.
• Delay in data flow can lead to service disruption. i.e; impact on revenue.
• Wireless technology has gained widespread support in controlling the majority of the processes.
• The use of mobile devices has skyrocketed.
• Teaming up with third-party service providers to manage and maintain control systems has bolstered in the recent past.

However, not all risks are due to technological development; some gaps are at organizational levels too; such as talent, process, and organization management. Although information technology and industrial control systems surprisingly complement each other to a large extent, the experts behind them need to contemplate each other’s operations too. This gap can lead to multiple change management, policy management, and asset management issues considered a prerequisite at the time of integration.

Top Threats to ICS

Cybercriminals use targeted attacks to bring down a complete organization down to its knees directly. As a primary source of revenue for ICS-oriented companies, ICS brings high value to attackers by compromising their ICS that can cause real-world rage and annoyance to threaten permanent damage.

Following are some of the striking threats extensively used by attackers:

• Ransomware: An attacker targets a vulnerable sweet spot into a company’s infrastructure by finding a loophole through a phishing attack, insecure internet-facing ports, or targeting an insider to position malware from within the network itself. The attacker intends to hold back compromised systems, functions, or data by encrypting them until the desired ransom is paid (mostly in cryptocurrency like Bitcoin).
• Denial of service (DOS) attacks: A threat actor targets outdated equipment, unpatched software, or misconfigured system functions to overwhelm them with unusual traffic requests only to bring them down or take control themselves, resulting in the systems being inaccessible for genuine users
• Insider threat: An insider threat relates to any individual who can harm the organizational data, functions, or equipment either intentionally to overcome personal vendetta against anyone in the organization or unintentionally by handling the proprietary resources in an immature or insecure fashion.

Industrial Control Systems (ICS) are at high risk if the above threats are not addressed right from their crux. Additionally, if your ICS can be accessed remotely, areas of the ICS that are unpatched or misconfigured can invite further security vulnerabilities.

How to secure ICS?

While the world is moving towards a zero-trust architecture, so should ICS. To commence building a zero-trust model around ICS, here are some security measures and guiding principles that every organization should initiate:

• Identifying critical risk exposure: A risk management framework must be produced and approved at an organizational level regardless of the company’s targeted ICS attacks. In addition, mechanisms to address malware scans and vulnerabilities should be in place.
   
• Adopt a highly defined access control policy framework: It is an industry best practice to design a well-defined access control framework from an auditing perspective and shield a company’s ICS landscape as a whole.
   
• Invest in software and hardware that are rich in artificial intelligence: Artificial intelligence is a well-known technology that the world is betting on. Not only because of how it works in terms of technology but also how effective it is in the real world to protect against emerging threats.
   
• Use machine learning techniques to log and monitor: Ideally, machine learning techniques work juxtaposed with artificial intelligence technology. It is the mere behavior of the system that needs to be learned by another system automatically; an innovation of the millennium because how else can you learn new emerging threats from the dark web with just a click of a button?
   
• Integrate and automate vulnerability management: Systems must be carefully designed and well integrated with all ICS components to identify Vulnerabilities and mitigate them effectively, But, of course, you can also not fix something that you cannot see.
   
• Encrypt backups periodically: Backing up all organizational data is not the key to a good night’s sleep. Instead, “encrypt the backups” to secure them using the latest hashing methods, be it on the cloud or on-premise.
   
• Isolate ICS environment from the regular network: When a CISO tells you to invest in a good security architect - he means it. A good security architect isolates an ICS component from the rest of the infrastructure to build a resilient architecture that withstands doomsday.
   
• Motivate and train employees to build skillsets to manage an ICS type of volatile infrastructure: Training your staff to keep them updated with the skills required to manage your business is an investment with a lifetime of continuous ROI. Therefore, always train and educate your team of experts to maintain the level of expertise to be able to handle complex ICS environments and at the same time understand the security implications it requires for balanced business continuity.
   

As the world focuses on non-traditional IT security, security perimeters have practically begun to disappear in thin air. With the emergence of new technologies, business and operational control systems integrate well, and organizations have accepted that the surge in evolving cyber threats will only continue from here on. It is evident that cyber incidents and risks are transforming at a speed at which no company can react faster. To keep with the sophisticated attacks, growth, and innovation, business executives must take a futuristic approach in terms of cyber risk management. Businesses of companies around the globe that heavily rely on industrial control systems (ICS) must take integral steps to polish their cyber risks capability considering that vulnerabilities exist, threats are real, and the risk is high. By establishing a comprehensive ICS security program with continuous improvement, an organization can mutate its security posture and amplify its ability to protect against sophisticated attacks on its control base while gaining complete confidence in reaping the benefits of a world-class ICS integrated business.