Industrial control systems (ICS) are not only complex, they are also critical to the operation of industrial infrastructure. They form a link between digital and physical components, and interpret the commands which control your installation. And such a key role carries with it a strong need for risk management. Drawing on our clients' and our own experience, here is a list of the 9 most commonly-encountered issues. And – most importantly – how we deal with them!
"I need to ensure the availability of my industrial installation"
There is a simple rule governing industrial installations: they need to be in a constant state of operational readiness. An overloaded network, a loss of connectivity or even a distributed denial of service (DDoS) attack can cause a breakdown in the control chain, and consequently a brief or extended unexpected outage.
And such a stoppage can compromise the installation, destroy productivity and even cause more serious problems (environmental impacts or human risks). For example, in a foundry, imagine a vat filled with molten metal falling below the required temperature, causing its contents to solidify; the entire unit would then have to be destroyed and the installation replaced in full. Or in a transportation context, imagine a train passing a defective signal which sends it in the wrong direction.
Ensuring network availability with Stormshield Network Security
To address these needs, the Stormshield Network Security range offers high-availability functionality to ensure continuity of service in the event of a failure. Our industrial firewall, the SNi40, also offers a failsafe mode which guarantees connectivity even in the event of equipment failure.
"I need to be sure of the integrity of my data."
In the industrial world, data changes can be just as serious as data theft. This was one of the key lessons learned following the Stuxnet virus; the industrial world needs genuine assurance of the integrity of the commands issued and information received by various devices.
In 2010, this computer worm – the most notorious ever to hit the industrial world – corrupted the information sent to supervision and control devices, giving the impression that centrifuges were still operating at the correct speed. The results are now history.
Protecting industrial protocols with Stormshield Network Security
With our Stormshield Network Security products, we have the ability to protect and filter different types of industrial protocols (e.g.: Modbus, OPC, etc.) using a genuine DPI (deep packet inspection) approach, VPN IPSec and VPN SSL functionalities, and an advanced event and alarm management system.
"I need a reliable incoming internet connection"
If you have a remotely maintained or supervised industrial installation, an incoming internet connection is a necessity – whether in the field of surveillance or robots. Wherever external connections are employed, you need to ensure that the machine connecting remotely to the industrial infrastructure is not corrupted – to avoid issues such as smurf attacks.
In addition to providing a reliable incoming connection, there is also a need in some cases to be able to cut off all connections. Imagine a failure at an industrial press that is detected remotely, but requires on-site human intervention. By cutting off the external connection, it is possible to avoid human risk.
Filtering information flows with Stormshield Network Security and Stormshield Endpoint Security
Our Stormshield Network Security range enables the configuration of a number of flow rules which authorise connections based on the time of day, the person involved (e.g. identification by captive portal) and DPI for analysing commands. In addition, our Stormshield Endpoint Security product can restrict communications solely to the tunnel used, thus preventing smurf attacks.
"I need controlled communication between my OT and my IT"
There is a need for safe, secure communication between the Operational Technology (OT) system and the more "traditional" IT system. This is particularly true when dealing with IT-side information to be entered into ERP.
For example, an effective, secure gateway between the two environments can reduce storage costs and unavailability in the production chain. At a bottling plant, for example, it would be possible to arrange for a lorry to arrive at exactly the right moment upon completion of production.
Restricting information flows with Stormshield Network Security
Thanks to the flow and DPI rules for our Stormshield Network Security range, connections can be restricted only to the safe, intended exchanges between IT and OT.
"I want my OT and IT department to work together"
Cybersecurity is not exclusive to either the IT or the OT world. So both need to be able to speak the same language to ensure they understand one another, and provide rules that are consistent across both areas.
The IS department on the IT side is generally more mature in terms of cybersecurity risks and best practices. So it needs to be able to share with the OT-side IS department in order to provide the most efficient security solutions. But when the tools are different, exchanges can quickly become very complex.
Speaking the same security language with Stormshield Management Center
Our Stormshield Management Center solution lets you configure our Stormshield Network Security firewalls both in the IT and OT areas. This administration tool provides the same information base to both parties, enabling them to communicate using the same language components.
"I need to update my workstation protection products"
In industry, just as elsewhere, workstations constitute sensitive components of operational systems. Supervisory workstations are disconnected from the Internet, and in cases where they have antivirus software installed, this software is not automatically updated. And in addition, there is a danger that these updates may introduce faults into business applications, which impedes their rollout.
Protecting non-connected workstations with Stormshield Endpoint Security
Without the use of a signatures database, using its behavioural analysis engine, Stormshield Endpoint Security maintains optimal security conditions for disconnected environments.
"I need to update operating systems"
The same situation as above is found in the case of workstations which are not connected to the Internet and run using old or non-updated operating systems. In addition to the obvious financial cost of updating such IT infrastructure, instabilities may be introduced. As a result, all workstations may need to be recertified.
For example, in early 2018, an industrial solutions provider found that its internal system had become unstable following an update… which was supposed to protect against Meltdown malware!
Protecting obsolete operating systems with Stormshield Endpoint Security
When handling obsolete operating systems, Stormshield Endpoint Security maintains optimal security. Requiring neither updates nor connections to an external system, this solution is therefore suited to end-of-life systems (e.g.: Windows XP™).
"I want to keep ahead of IoT risks"
Over the last few years, the IIoT and France's 'Industry of the future' project have been generating various technological developments, and continue to promise other new ones. But how are these new technical developments to be integrated without putting existing installations at risk?
Whether by adding sensors to predict failures or optimising production with the power of Cloud calculation, the new technologies involve feeding back information flows between the installation and the outside world. And these information flows can become a gateway for cyberattacks.
Controlling information flows with Stormshield Network Security
Whenever information flows need to be exchanged from/to industrial infrastructure, our Stormshield Network Security range is able to limit their volumes and monitor the messages they carry by means of flow and DPI rules.
"I want to be sure of the integrity of my digital twin"
Preventive and predictive maintenance, change simulation, energy consumption levels monitoring: the possibilities offered by digital twins are already numerous. However, the sent and received data are worthless unless they are integrated.
The issue here is the same as with Stuxnet: if the digital twin is corrupted and returns faulty information, the consequences at production time could prove to be dramatic.
Ensuring the integrity of digital twins with Stormshield Network Security
The goal in this case is to successfully duplicate the security of the production environment in the digital twin. To do this, our Stormshield Network Security range consists of virtual machines which offer the same efficiency as physical boxes.
