third Cyber Security Assessment Netherlands - NCSC

9.6 The resilience of ICS
Security of ICS has not had the same attention in recent years as
security in standard IT and is therefore still in its infancy. The ICS
world has its own culture with an often conservative technical set up,
where attention on security is not self-evident. [227] This also includes
human and organisational factors such as insufficient awareness, the
lack of ownership and insufficient direction in terms of security
requirements being given to parties that may be brought in.
However the problem of resilience does not just concern existing
systems. Security risks as an integrated element of lifecycle
management also need to be considered when developing new
ICSs. When designing, implementing and managing ICSs, no direct
account is taken of security risks because there is a lack of security
by design. For example, the user’s identity (authentication) and
what this user has access to (authorisation) are not always checked,
because these are not standard functions in ICSs. It is therefore easy
to manipulate controls.
Because ICSs have a long lifecycle (approximately 10-30 years),
legacy system components and operating systems are often still in
use. The problem with this is that at a certain point support from
the manufacturer will be withdrawn. While specific ICS elements
have long-term support, this is often not the case for generic IT
tools. Take for example Windows XP, which is still often used in
ICSs. On 8 April 2014, Microsoft will end support for this operating
system, which means new security leaks will no longer be plugged.
Not always harmful
Cyber incidents can happen at various places in ICSs. This also
influences the type and scope of the impact. Manipulating one
element will have consequences beyond manipulating the
various functions of a system. In addition, ‘supporting
measures’ are often put in place to discover manipulation (at
an early stage) and limit its effects. If only the control of a
machine is manipulated, this will not necessarily result in harm.
If the alert function works properly, the operator will be
informed in good time and can intervene. However in addition
to the control, the alarm and visualisation functions may be
tampered with. Imagine a chemical factory where tanks with a
capacity of 100 litres are filled with chemical substances. Filling
normally stops when they are three quarters full. The system is
now manipulated in such a way that filling does not stop, no
alarm is triggered and neither can this be seen on the visualisation
screen. Filling of the tank continues but on the monitor in
the control room there is nothing wrong. The tank overflows
and the room becomes filled with chemical vapours. If
unsuspecting personnel now enter the room, there could be
serious consequences for their health.
ICS providers sometimes give no guarantee that the system will
work correctly following migration to a new operating system, asset
owners are reticent to roll our patches under the motto ‘if it ain’t
broke don’t fix it’. In addition, it is not always possible and/or is very
costly to halt processes to patch the control computers. Finally,
providers do not always see the need to bring out patches for older
components which means vulnerabilities are not resolved.
9.7 In conclusion
CSAN-2 has established that the threats for ICSs have become more
real compared with the period before then. Although no high-profile
incidents came to light during the current reporting period, we
cannot claim that the security status of ICSs has improved. Although
there are certainly some organisations and providers that are
heading in the right direction, the overall picture remains gloomy,
particularly among the end-users and providers of smaller applications.
The situation has remained the same or even worsened, this is
just not immediately apparent. Vulnerabilities continue to increase,
actors are becoming more interested but awareness appears not to
growing in line with this. Measures need to be taken because digital
incidents in vital sectors can have a major impact. «
227 The NCSC has published the factsheet ‘Check list security of ICS/SCADA systems’ with
15 points for securing ICSs and preventing incidents: https://www.ncsc.nl/dienstverlening/
expertise-advies/kennisdeling/factsheets/checklist-beveiliging-van-ics-scada-systemen.html
98