CS1907

industrial cyber security
supply chain, as it is a more general problem
about our outdated security mindset. "For
years, we've thought that, if we only build
perimeter walls that are strong enough, we'll
be safe. Then again, 12-foot concrete barriers
don't count for much, if they come with an
unlocked door. Considering the herculean
task of trying to police every device, let
alone components within that device,
organisations are thinking about defence in
new ways. Zero Trust architecture is just one
of them."
Knocking down the tired inside/outside
dichotomy of traditional network security,
Zero Trust does not automatically trust any
device, system or user, states Gordon. "Any
that want to gain access must be verified
according to the resource they want to use
or communicate with, leveraging factors like
user and location to authenticate.
Instead of one wall around the city, Zero
Trust builds walls - and, perhaps more
importantly, watchtowers - around each
Nigel Stanley, TUV Rheinland: to build
cybersecurity into the supply chain, it needs
to be written into contracts with suppliers.
constituent building, further complicating
an attacker's job, providing visibility and
preventing the lateral movement that is so
critical in the cyber kill chain."
This matters more when we realise how the
perimeter is changing, he continues. "New
ways of working, such as BYoD [Bring Your
own Device] are making the perimeter line
on which older generations of security
depended less and less clear. We can no
longer say that a network perimeter ends at
the office door, so it makes sense to employ
strategies which accommodate these new
realities."
Moreover, he points out, we are just now
getting regulations that will force security
into the design stage for many of these
devices. "The UK government, for example,
will finally make its 2018 IoT guidelines
mandatory. While commendable, they won't
necessarily secure those supply chains
entirely and the insecure components that
are already floating around the IIoT will
continue to pose threats. It will never be
good enough to have insecure components
within a device; but it's almost impossible to
make sure of. Trying to wish away that reality
is another version of the security wall fallacy:
'If I can stop it from getting into my
environment, I'll be safe'."
For the moment, IIoT users simply have to
accept that there will always be a risk with
these devices and start thinking about how
they're going to respond, once that insecure
component is already in their environment.
"Until IoT users can rely on these complex
supply chains, "enterprises can look to
concepts like Zero Trust to tackle these
unfortunate realities within the supply
chain, " Gordon concludes.
SECURITY MYTH
The number of cybersecurity- related
incidents in industrial control networks has
risen in every region in recent years, and
there have been well publicised reports of
sophisticated malware and threat actors
disrupting safety instrumented control
systems. On the back of this, says Nigel
Stanley, CTO - Global OT and Industrial Cyber
Security CoE at TÜV Rheinland Group,
organisations operating industrial facilities
have a responsibility to "monitor, detect and
mitigate cybersecurity attacks in order to
maintain the safety, integrity and availability
of their site which, if compromised, may
have a severe and detrimental impact on
society".
HOW SAFE IS ‘SAFE’?
But this is no straightforward task, he
concedes, given that safety-critical systems
can contain thousands of hardware
components and millions of lines of software
code. "When it comes to securing individual
components, there is no such thing as
absolute security. In terms of cybersecurity,
products cannot be proven to be secure, or
measured against an industry accepted
Safety Integrity Level (SIL). Therefore, if
a manufacturer claims their product is
'cybersecure', this should be taken with
a large pinch of salt.
"To satisfy cybersecurity concerns, the most
astute manufacturers or operators tend to
seek security assurance - for example, three
levels down their supply chain. While a good
idea on paper, in reality this is a complex and
time-consuming process for all parties. A
detailed questionnaire can confirm whether
suppliers are compliant with cybersecurity
guidelines, but this is never the full picture."
To really build cybersecurity into the supply
chain, it needs to be written into contracts
with suppliers, states Stanley. "Obliging
software code or a piece of hardware to
undergo official certification against an
accepted standard - such as IEC 62443 - can
be helpful. However, this still doesn't
guarantee that a product is secure; just that
it has met the requirements of a particular
standard at a particular time."
32
computing security July/August 2019 @CSMagAndAwards www.computingsecurity.co.uk