The State of Ransomware in Manufacturing and Production 2021

Along with market research I have also been flooded with every security firms’ research especially on ransomware. This one just in from Sophos written by Sally Adam contains information more positive about our market sector than the usual scare tactics I see.

Our [Sophos] new report The State of Ransomware in Manufacturing and Production 2021 reveals that companies in this sector are the least likely to submit to a ransom demand and the most likely to restore encrypted data from backups of all industries surveyed. Just 19% of organizations whose data was encrypted paid attackers to decrypt their files, compared to a global average of 32%.

The report is based on the findings from an independent survey of 5,400 IT decision makers, including 438 in the manufacturing and production sector, conducted at the start of 2021.

Overall, 36% of the manufacturing and production organizations surveyed were hit by ransomware last year which is in line with the global average of 37%. Fortunately for this sector, 68% of those whose data was encrypted were able to restore it using backups, a rate considerably above the global average (57%). This high ability to restore data from backups enables many companies to refuse attacker demands, resulting in the low ransom payment rate.

Chester Wisniewski, principal research scientist at Sophos, advises that “backups are vital, but they cannot protect against this risk, so manufacturing and production businesses should not rely on them as an anti-extortion defense. Organizations need to extend their anti-ransomware defenses by combining technology with human-led threat hunting to neutralize today’s advanced human-led cyberattacks.”

OK, So There Is a Small Scare Tactic

While manufacturing and production companies show good resilience in the face of ransomware, the survey revealed that they have the highest expectation of a future attack of all sectors. Of the respondents not hit by ransomware last year, 77% expect to be hit in the future. The sophistication and prevalence of ransomware are the key factors driving this concern.

A sector heavily impacted by the pandemic

IT teams in manufacturing and production were severely affected by the challenges of 2020. This sector was the least likely to experience a decrease in cybersecurity workload over 2020: just 7% said their cyber workload had decreased, vs. a global average of 13%. It also had the fewest respondents who saw improved response time to IT cases (15% vs. a global average of 20%). The silver lining is that cyber skills also increased, with 71% of respondents saying their team’s ability to further develop cybersecurity knowledge and skills increased over 2020.

Learn more

Download the full report to explore the reality of ransomware in manufacturing and production. It also includes recommendations from Sophos experts to minimize the impact of ransomware in future.

Bedrock ICS Proxy Solution Helping Utility Transition to Cyber Secure Automation

Cybersecurity has been a frequent topic lately at The Manufacturing Connection. Bedrock Automation founders built on a secure chip set as a foundation for an Industrial Control System (ICS) that is secure in many ways. Founder and CEO Albert Rooyakkers has devoted hours explaining the details and nuances of the many ways the product is nearly invincible. (He would take issue with my qualifying word.) This case study offers a few details about a utility bolstering its defense with an upgrade to Bedrock control platform.

A Colorado utility is transitioning legacy PLCs and RTUs to the intrinsically secure Bedrock OSA (Open Secure Automation) platform. The transition is part of a multi-year automation upgrade plan, which utility management saw as an opportunity to deepen its cyber security protection while also modernizing its controls. 

“Like most other public utilities, we must adapt to an ever-changing world and that includes cyber security. We’ve always had robust physical security and required usernames and passwords for access to critical systems and controls, but we saw the world around us changing quickly. Many of today’s automation technologies are not as secure as they could be because they were developed long before security was a major issue in the industry. Most of the security added to them was an afterthought,” said Shay Geisler, I&C Administrator for Colorado’s East Cherry Creek Valley (ECCV) Water & Sanitation District.

ECCV’s legacy control architecture involved SCADA software that is housed on a dedicated Windows desktop or server along with a communications driver, in this case, an OPC Server that speaks to the PLCs via legacy protocols. Each ECCV upgrade target was using two PLCs to concentrate field data for use by the plant SCADA system, which had also been upgraded to a more secure version. 

“We knew security could not be limited to the SCADA software only. There were too many downstream systems and assets that, if left untouched, would present a huge vulnerability. We determined that the vast majority of these potential vulnerabilities could be solved by addressing the PLC and SCADA communications system,” said Geisler. 

Securing SCADA and control networks

Geisler and his team concluded that the most secure and cost-effective approach would be to connect the SCADA network and control networks with a secure communications channel. Fully implementing this, however, would have required ripping and replacing their entire system immediately, which would have been costly and required significant disruption. Instead, working with automation supplier Process Control Dynamics and system consultant RSI Company, they adopted a phased-in approach using secure Bedrock OSA Remote control units as proxy servers to enable transition ultimately to a full Bedrock platform.

“We are slowly upgrading the remote sites that have been serviced by legacy data concentrators, one-by-one as we convert each to use the secure Bedrock controller. The new controllers at the remote sites bypass the legacy concentrators and now report directly to the Bedrock proxy.  Once all sites are converted, we will remove the legacy concentrators,” said Russ Ropken, with RSI Company, the system integrator who developed the architecture that enabled the seamless transition.

The ultimate result is secure, certificated communications from the SCADA software down to the Remote PLCs/RTU. The Bedrock OSA Remote proxy units will switch over to a peer-to-peer network of infinitely scalable secure Bedrock control units connected by an encrypted radio network. 

ECCV already has field data running through 12 of its target sites, with some 74 left to go.  For more details, including the architecture of each phase, download the case history here.

 

ICS Cybersecurity Threats Continue to Rise—Severity Reaches All-Time High

This reminds me of other technologies I’ve seen transition from few users to industry standard seemingly overnight. This latest survey from Nozomi Networks and SANS Institute finds industrial organizations are leveraging the cloud as they mature cybersecurity defenses and prioritize control system reliability. However, threats remain high and are growing in severity. In response, a growing majority of organizations have significantly matured their security postures since the last SANS OT/ICS survey in 2019. From the report: In spite of the progress, almost half (48%) don’t know whether their organizations had been compromised. The Nozomi Networks-sponsored survey echoes Nozomi Networks’ own experiences with customers worldwide.

“It’s concerning to see that nearly half of this year’s survey respondents don’t know if they’ve been attacked when visibility and detection solutions are readily available to provide that awareness,” said Nozomi Networks Co-founder and CPO Andrea Carcano. “Threats may be increasing in severity, but new technologies and frameworks for defeating them are available and the survey found that more organizations are proactively using them. Still, there’s work to be done. We encourage others to adopt a post-breach mindset pre-breach and strengthen their security and operational resiliency before an attack.”

Cyber threats to OT environments continue to rise and threat severity is at an all-time high.

  • Most respondents (69.8%) rated the risk to their OT environment as high or severe (up from 51.2% in 2019).
  • Ransomware and financially motivated cybercrimes topped the list of threat vectors (54.2%) followed by nation-state sponsored cyberattacks (43.1%). Unprotected devices and things added to the network came in third (cited by 31.3% of survey respondents).
  • Of the 15% of survey respondents who indicated they had experienced a breach in the last 12 months, a concerning 18.4% said the engineering workstation was an initial infection vector.
  • Nearly half of all respondents (48%) did not know whether their organizations had been compromised and only 12% were confident that they hadn’t had an incident.
  • In general, external connections are the dominant access vector (49%) with remote access services identified as the most prevalent reported initial access vector for incidents (36.7%).

This year’s survey found most organizations are taking ICS threats seriously and making solid progress in maturing their security postures to address them. Over the last two years organizations have improved monitoring and threat intelligence capabilities. They are moving away from traditional indicator-based defense capabilities and moving toward threat hunting and hypothesis-based security models. They’re also focusing on data loss prevention.

  • 47% say their control system security budget increased over the past two years.
  • Almost 70% have a monitoring program in place for OT security.
  • 51% say they are now detecting compromises within the first 24 hours of an incident. The majority say they move from detection to containment within 6 to 24 hours.
  • 9% have conducted a security audit of their OT/control systems or networks in the past year and almost a third (29.5%) have now implemented a continual assessment program.
  • 50% say they have vendor-provided ICS-specific threat intelligence feeds and there is less reliance (36%) on IT threat intelligence providers.
  • OT SOC adoption is up by a sharp 11% from 2019 to 2021, re-emphasizing the focus away from traditional indicator-based defense capabilities and more toward a threat hunting and hypothesis-based security model.
  • Data loss prevention technologies also saw a sharp increase in deployment (11%).
  • As process reliability becomes a top concern, 34% say they’re implementing zero-trust principles and an additional 31% say they plan to.

ICS is Getting Cloudy

Adoption of cloud-native technologies and services transformed the IT industry. This year’s survey found similar impacts are also beginning to be felt in the OT environment.

  • 1% of all survey respondents indicate they are using some cloud-based services for OT/ICS systems.
  • Almost all (91%) are using cloud technologies to directly support ICS operations (combining remote monitoring configuration and analysis; cloud services supporting OT; and remote control/logic).
  • All respondents using cloud technologies are using cloud services for at least one type of cybersecurity function (company NOC/SOC, business continuity and MSSP support).
  • Respondents consider cloud assets relatively secure, with only 13% of responses classifying them as risky.

To learn more about the latest trends in OT/ICS cybersecurity:

• Download A SANS 2021 Survey: OT/ICS Cybersecurity

The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 50 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates employee qualifications via 30 hands-on, technical certifications in information security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master’s degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet’s early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (www.SANS.org)

• Here are a few responses to questions about the report:

1 What were the most surprising things you found in the report?

Chris Grove – Technology Evangelist – Nozomi Networks

Positive: It was a pleasant surprise to see that a large group of respondents (40.1%) have embraced cloud-base services. It’s a trend that Nozomi Networks has seen in the field and one that we have responded to with our own cloud-based security offerings. As Industrial and critical infrastructure organizations embrace IoT and converge their OT and IT efforts, they must be able to protect thousands of devices quickly and cost-effectively from threats in real-time and ensure ongoing operational resilience. Cloud-based technologies make that possible. It’s also encouraging to see the majority are confident in the security of their cloud assets. We believe ICS organizations will continue to adopt cloud technologies and the adoption of cloud-base security solutions will grow significantly over the next few years. 

Negative: It’s alarming to see that detection and response is still a significant issue for organizations. In fact, the problem seems to have grown since the previous survey (48% of survey participants did not know whether they’d had an incident vs. 42% in 2019). Solutions are available to address this problem and adopting them should be a top priority. 

Mark Bristow – Author – A SANS 2021 Survey: OT/ICS Cybersecurity

I found three things particularly striking in the report results.

●      The level of adoption of cloud technologies for operational outcomes was striking.  Two years ago, cloud adoption was not being seriously discussed and now 49% are using it.

●      Incident visibility and confidence is not high.  48% of respondents could not attest that they didn’t have an incident.  A further 90% of these incidents had some level of operational impact.

●      18% of incidents involved the engineering workstation.  This is a critical piece of equipment and having this involved in so many incidents is troubling.

2 What are three things you think ICS operators need to focus on moving forward to protect themselves?

Chris Grove, Nozomi Networks: Considering Ransomware is such a pervasive issue; it might be a first concern for many operators. Starting off with some tabletop exercises, operators would be able to identify areas where improvements can be made.  Typically, one area that gets highlighted is the need for a systematic risk assessment that details likely points of entry and identifies ways to harden the target. Sometimes this is in the form of patching, network segmentation, policies, procedures, etc.  In almost all cases, increased visibility makes everything easier to manage. From having a detailed asset inventory, to monitoring network traffic patterns, to inspecting traffic for attacks or operational anomalies…. visibility is a crucial component of successfully defending operations. Finally, the third and final thing that operators should consider is Consequence Reduction. As part of a post-Breach mindset, operators should consider the fact that eventually the attackers will breach the perimeter, and one should be prepared for that day.  How do we limit the blast radius of the attack? How do we hold them at bay, and subsequently eradicate them from the system? How do we carefully maintain, safely shutdown, or restore operations potentially affected by the breach? These are tough questions to be asked before that day comes.

Mark Bristow, SANS: 

·       It’s great that we now have monitoring programs in place, but we are still mostly looking at the IT aspects of our OT environments.  We need to be correlating our IT and OT security telemetry as well as process data to truly understand potential impacts to safety and operations.

·       Focus on fundamentals.  Too many respondents do not have a formal program for asset identification and inventory.  Without this foundational step, further security investments may be invalid or misplaced.

·       Ransomware is a huge risk, but it’s not one that is specifically targeting ICS.  A malicious actor who is specifically targeting your ICS environment will not be as blunt or noisy as ransomware is, and we are struggling to defend against ransomware. 

IIC Defines Trustworthiness for Cyber-Physical Systems Plus Adds IIoT Networking Framework

Before the Industrial Internet Consortium changed its name (Industry IoT Consortium) I had two news items from it. The first is a Networking Framework publication and the second a definition for trustworthiness in cyber-physical systems. They both appear to be worthwhile additions to the state of the art.

IIC Defines Trustworthiness for Cyber-Physical Systems

The IIC has published IIoT Trustworthiness Framework Foundations. This foundational document explains the key concepts and benefits of trustworthiness in context, relating it to the real-world supply chain and offering model approaches. Trustworthiness is essential to government and commercial organizations with cyber-physical systems impacting the safety and well-being of people and the environment. These systems include industrial control systems and almost all systems that use digital technology to sense or affect the environment. 

“Trustworthiness, and confidence in that trustworthiness, are an essential aspect of cyber-physical systems,” said Marcellus Buchheit, President & CEO, Wibu-Systems USA, a Co-Chair of the IIC Trustworthiness Task Group and one of the authors of the document. “Inattention to trustworthiness can lead to loss of human life, long-term environmental impacts, interruption of critical infrastructure, or other consequences such as disclosure of sensitive data, destruction of equipment, economic loss, and reputation damage,” continued Buchheit. 

The IIoT Trustworthiness Framework Foundations document defines trustworthiness as a combination of security, safety, reliability, resilience, and privacy and the tradeoffs made among them in the face of environmental disturbances, human errors, system faults, and attacks. Ultimately, trustworthiness depends on the strategic intent and motivation of an organization, particularly its top management, to create and operate systems that inspire trust by partners, customers, and other stakeholders, including the community. 

“Trustworthiness is the degree of confidence one has that a system performs as expected. It requires an understanding of the system, including interactions and emergent properties,” said Frederick Hirsch, Strategy Consultant, Upham Security, Co-Chair of the IIC Trustworthiness Task Group, and one of the authors of the foundational document. “In the digital world, trust and trustworthiness are achieved by understanding and addressing concerns related to the trustworthiness characteristics appropriately for the context of the entire system. Providing evidence of this can give others confidence.”

IIoT stakeholders will make different decisions and tradeoffs depending on the nature and or industry of the system. “Concerns in a factory are not the same as those for a hospital operating room,” said Bob Martin, Senior Principal Engineer, Cyber Solutions Innovation Center, The MITRE Corporation, Co-Chair of the IIC Trustworthiness Task Group, one of the authors of the document. “Designers must understand the many considerations involved in defining the appropriate trustworthiness implementation, including the supply chain, assembly, operation, and maintenance of a system.”

The IIoT Trustworthiness Framework Foundations document builds on the Industrial Internet of Things Security Framework (IISF). It is part of the IIC’s Industrial Internet Reference Architecture (IIRA), which provides an architectural framework of Industrial IoT Systems. 

You can find IIoT Trustworthiness Framework Foundations and a list of IIC members who contributed to it here. Watch a short overview video. Register for the webinar, Ensuring Trustworthy Industrial Systems on September 1, 2021 at noon PST or 7:00 pm PST.

IIC Publishes IIoT Networking Framework

The IIC announced the Industrial Internet of Things Networking Framework (IINF) publication. The framework guides IIoT stakeholders on designing and developing the appropriate networking solutions to enable industrial IoT (IIoT) applications and stimulate industrial digital transformation. It details the requirements, technologies, standards, and solutions for networking that support diverse applications and deployments across a broad range of IIoT sectors and vertical industries. 

“An underlying network is the foundation of any IIoT solution. It includes technologies at the network layer and below as well as related capabilities for management and security,” said David Lou, Co-chair, IIC Networking Task Group, Chief Researcher, Huawei Technologies, and one of the primary authors of the framework. “An underlying network enables the exchange of data and control and forms the basis of digital transformation across industries.”

The framework serves as a guideline and toolbox for IIoT networking solution stakeholders who design, develop, deploy, or operate the solutions and end-users in many industries trying to network their assets or products.

“IIoT applications span a range of industrial sectors as well as business, usage, deployment, and performance perspectives,” said Jan Holler, Co-chair IIC Networking Task Group, Research Fellow, Ericsson, and one of the primary authors of the framework. “The IINF helps organizations sort through numerous networking technologies to ensure interoperability across industry sectors. It answers the fundamental question, ‘How do I design, deploy, and operate a successful networking solution for my industrial IoT applications?'” 

The IINF includes use cases from several industrial sectors, including smart factories, mining, oil & gas, and smart grid, to illustrate the diversity of networking considerations. Networking technologies and standards are covered in-depth to help organizations address their concerns and technical requirements. Finally, the IINF includes best practices for IT architectural blueprints. 

Biden Memo and Research Highlight Recent Security Updates

A number of security-related news items came my way during the past couple of weeks. The Biden administration memo brought a surge of comments. I’ve included one from Marty Edwards. Several companies research vulnerabilities and discover interesting and useful threats and vulnerabilities.

  • MITRE Engenuity ATT&CK Evaluations
  • Google on Measuring Risk in Open Source
  • Open Source Security Foundation Adds Members
  • Claroty Research Team82 Finds ICS Vulnerabilities
  • Industry Veteran Marty Edwards Shares Thoughts on Biden’s Security Memo

Engenuity ATT&CK Evaluations

MITRE Engenuity released results from its first round of independent ATT&CK Evaluations for Industrial Control Systems (ICS). The evaluations examined how cybersecurity products from five ICS vendors detected the threat of Russian-linked Triton malware.

The malware targets safety systems, preventing officials from responding to failures, hazards and other unsafe conditions, potentially causing physical destruction. 

The evaluations use ATT&CK for ICS, a MITRE-curated knowledge base of adversary tactics, techniques, and procedures based on known threats to industrial control systems.

The evaluations, which were paid for by the participating vendors, included products from Armis; Claroty; Microsoft (via CyberX acquisition); Dragos; and the Institute for Information Industry

“MITRE Engenuity’s ATT&CK Evaluations program is built on the backbone of MITRE’s integrity and commitment to making the world a safer, more secure place,” said Frank Duff, general manager of the ATT&CK Evaluations program. “Vendors trust us to improve their offerings, and the community trusts that we’ll provide transparency into the technology that is necessary to make the best decisions for their unique environment. Unlike closed door assessments, we use a purple teaming approach with the vendor to optimize the evaluation process. MITRE experts provide the red team while the vendor provides the blue team to ensure complete visibility, while allowing the vendor to learn directly from ATT&CK experts.” 

Google Measuring Risk in Open Source

by Kim Lewandowski, Azeem Shaikh, Laurent Simon, Google Open Source Security Team

Contributors to the Scorecards project, an automated security tool that produces a “risk score” for open source projects, have accomplished a lot since our launch last fall. Today, in collaboration  with the Open Source Security Foundation community, we are announcing Scorecards v2. We have added new security checks, scaled up the number of projects being scored, and made this data easily accessible for analysis.

Since last fall, Scorecards’ coverage has grown; we’ve added several new checks, following the Know, Prevent, Fix framework proposed by Google earlier this year, to prioritize our additions.

Contributors with malicious intent or compromised accounts can introduce potential backdoors into code. Code reviews help mitigate against such attacks. With the new Branch-Protection check, developers can verify that the project enforces mandatory code review from another developer before code is committed.

Despite best efforts by developers and peer reviews, vulnerable code can enter source control and remain undetected. We have added checks to detect if a project uses Fuzzing and SAST tools as part of their CI/CD system.

A common CI/CD solution used by GitHub projects is GitHub Actions. A danger with these action workflows is that they may handle untrusted user input. Meaning, an attacker can craft a malicious pull request to gain access to the privileged GitHub token, and with it the ability to push malicious code to the repo without review. To mitigate this risk, Scorecard’s Token-Permissions prevention check now verifies that the GitHub workflows follow the principle of least privilege by making GitHub tokens read-only by default.

To date, the Scorecards project has scaled up to evaluate security criteria for over 50,000 open source projects. In order to scale this project, we undertook a massive redesign of our architecture and used a PubSub model which achieved horizontal scalability and higher throughput. This fully automated tool periodically evaluates critical open source projects and exposes the Scorecards check information through a public BigQuery dataset which is refreshed weekly.  

This data can be retrieved using the bq command line tool.

Scorecards data for available projects is now included in the recently announced Google Open Source Insights project and also showcased in OpenSSF Security Metrics project. The data on these sites shows that there are still important security gaps to fill, even in widely used packages like Kubernetes.

There are a couple of big enhancements we’re especially excited about:

Scorecards Badges – GitHub badges to show off compliance

Integration with CI/CD and GitHub Code Scanning Results

Integration with Allstar project – GitHub App for enforcing security policies

Open Source Security Foundation Adds 10 Members

OpenSSF, a cross-industry collaboration to secure the open source ecosystem, announced new membership commitments to advance open source security education and best practices. New members include Accurics, Anchore, Bloomberg Finance, Cisco Systems, Codethink, Cybertrust Japan, OpenUK, ShiftLeft, Sonatype and Tidelift. 

The new Scorecard 2.0 is also available now and includes new security checks, scaled up the number of projects being scored, and made this data easily accessible for analysis. The Scorecard is gaining adoption for automating analysis and trust decisions on the security posture of open source projects.

Its working groups include Securing Critical Projects, Security Tooling, Identifying Security Threats, Vulnerability Disclosures, Digital Identity Attestation, and Best Practices.  

Claroty Finds Critical Vulnerabilities

Claroty, the industrial cybersecurity company, launched Team82, its new research arm that provides indispensable vulnerability and threat research to Claroty customers and defenders of industrial networks worldwide. Additionally, Team82 released a new report on critical vulnerabilities found in cloud-based management platforms for industrial control systems (ICS), highlighting the rise of ICS in the cloud and the growing need to secure cloud implementations in industrial environments. 

In its latest report, “Top-Down and Bottom-Up: Exploiting Vulnerabilities in the OT Cloud Era,” Team82 researched the exploitability of cloud-based management platforms responsible for monitoring ICS, and developed techniques to exploit vulnerabilities in automation vendor CODESYS’ Automation Server and vulnerabilities in the WAGO PLC platform. Team82’s research mimics the top-down and bottom-up paths an attacker would take to either control a Level 1 device in order to eventually compromise the cloud-based management console, or the reverse, commandeer the cloud in order to manipulate all networked field devices. 

The new Team82 Research Hub includes the team’s latest research reports, a vulnerability dashboard for tracking the latest disclosures, its coordinated disclosure policy for working with affected vendors, its public PGP Key for securely and safely exchanging vulnerability and research information, and other resources. 

To access the Team82 Research Hub, visit claroty.com/team82

Read the report, “Top-Down and Bottom-Up: Exploiting Vulnerabilities In the OT Cloud Era.”

Marty Edwards, Tenable, on Biden Memo

You can find Edwards’ thoughts at this blog site. Below are some excerpts.

Recent activity from the Biden Administration represents a watershed moment in the establishment of baseline standards for preparing, mitigating and responding to attacks that impact the critical infrastructure we all rely on.

The most substantive thrust of these government actions is recognizing and acting on the accelerated trend of reconnaissance and attack by establishing the Industrial Control Systems (ICS) Cybersecurity Initiative. The ICS Initiative is a voluntary, collaborative effort between the federal government and the critical infrastructure community to protect U.S. critical infrastructure “by encouraging and facilitating deployment of technologies and systems that provide threat visibility, indications, detection, and warnings, and that facilitate response capabilities for cybersecurity in essential control system and operational technology networks,” with a primary goal of “greatly expand[ing] deployment of these technologies across priority critical infrastructure.”

Tenable encourages CISA and the U.S. government to take an open, technology-neutral, standards-based approach in the development of these goals. Core elements for consideration as the most appropriate and successful methods of disrupting attack paths and securing critical infrastructure and OT environments revolve around three key pillars:

Visibility: Gain full visibility and deep situational awareness across your converged IT/OT environment.

Security: Protect your industrial infrastructure from advanced cyberthreats and risks posed by hackers and malicious insiders.

Control: Take full control of your operations network by continuously tracking ALL changes to any ICS device.

Zero Day Vulnerabilities in Industrial Control Systems Highlight the Challenges of Securing Critical Infrastructure

Security and industrial control system vulnerabilities spurred many news releases and PR inquiries offering quotes given the wide publicity of the latest ransomware attacks hitting industrial infrastructure. A zero day disclosure of multiple vulnerabilities in Schneider Electric’s industrial control systems (ICS) exemplifies the real-world struggles facing the critical infrastructure ecosystem. 

I first met Marty Edwards when he was with Idaho National Labs. He’s now with Tenable and wrote this blog post regarding the Schneider Electric vulnerabilities. At the end of the post is a statement from Schneider Electric about its situation.

Quoting from the post:

The vulnerabilities — which affect the company’s EcoStruxure Control Expert, EcoStruxure Process Expert, SCADAPack REmoteConnect x70 and Modicon M580 and M340 control products — pose several risks, including the possibility of complete authentication bypass, arbitrary code execution and loss of confidentiality and integrity. 

Tenable’s Zero Day Research is one of several vendors to have disclosed vulnerabilities to Schneider via standard disclosure practices and you can view our technical report here. Although we are strong proponents of full disclosure, in this case we have chosen to withhold certain specific technical details from our public disclosure documents. Operational Technology (OT) systems have yet to advance their security posture to be on par with their IT counterparts, and as such this is a rare situation where full disclosure shouldn’t be followed. In our view, the risk of successful in-the-wild exploitation was too great and the critical infrastructure at risk was too sensitive for us to proceed with full disclosure with patches months away from being released by the vendor.

The factors surrounding the Schneider disclosure highlight the many challenges involved in securing critical infrastructure. Industrial control systems and other technologies used in the operational technology environment are notoriously difficult to develop patches for and deploy. Why? Because systems have to be taken down and thoroughly tested each time an update is made. Yet, the existing operating models for most OT environments, such as power plants, gas pipelines, manufacturing plants, leave little margin for downtime. It’s clear that more discussion industry wide is needed to determine whether the vendor parameters used for zero day disclosures in IT environments are appropriate for critical infrastructure.

Addressing potential solutions, Edwards continues:

We believe it’s incumbent on the broad range of international stakeholders — including government bodies, law enforcement agencies, researchers, vendors and the owners and operators of critical infrastructure facilities — to prioritize global collaboration with an eye toward developing best practices for securing OT systems that can be applied regardless of geography. 

We believe these discussions need to recognize that OT vendors and operators have much to learn from their IT counterparts and need to become more adept at developing and managing the software underpinning crucial systems. Make no mistake — the onus does not fall solely on the owners and operators of critical infrastructure environments. Vendors need to be held responsible for continually bug hunting and doing quality assurance on their own software, dedicating resources to effectively managing vulnerability disclosures and speeding up update release times. 

Further:

In the U.S., we’ve already seen positive movement in the form of the May 12 Executive Order on Improving the Nation’s Cybersecurity from the Biden administration, which calls for software supply chain security guidance to incorporate vulnerability disclosure programs, and the May 18 White House fact sheet, which states “[c]ybersecurity is a core part of resilience and building infrastructure of the future.”

He offers these immediate actions we can take:

Three action items for securing critical infrastructure environments

There is no magic bullet for securing OT environments. Just as with IT security, it comes down to nailing the basics. And we’re well aware that the simplicity of the guidance belies the complexity of actually implementing the recommendations. Nonetheless, we believe these action items bear repeating, as they are foundational to any sound cybersecurity strategy, particularly when systems cannot be updated:

  1. Implement a defense-in-depth posture. Critical infrastructure environments cannot rely on the security of any given device. Organizations need to implement a robust security architecture with compensating controls to protect the devices that are most at risk.
  2. Develop strong governance and disaster recovery policies. These are essential for dealing with ransomware and other forms of cyberattack, and must take into account not just the technologies but also the people and processes in place in any given organization. Exercise and test your backup plans before you need them. Because the cyber skills shortage is particularly acute in OT environments, achieving this level of governance remains challenging for many organizations.
  3. Choose technologies wisely. Without the right people and policies in place, it’s impossible to get the full value out of any technology you purchase. At the same time, there are certain capabilities to seek out in your technology choices. For example, the OT environment requires the same level of real-time, continuous analysis as can be found in the IT world. OT operators need to implement technologies that give them the kind of detection and recovery capabilities necessary to circumvent sophisticated threat actors. 

Schneider Electric has also provided the below statement about the disclosure. If you have any questions for their team, please reach out to [email protected] and Thomas Eck [email protected].

“Recently, multiple cybersecurity research firms made available to Schneider Electric the research they had performed on the cybersecurity of industrial PLC engineering software EcoStruxure Control Expert. The research intended to demonstrate the theoretical possibility of compromising industrial controllers under certain conditions, such as when an attacker has already compromised the engineering workstation or has unauthorized access to the targeted controller network.

Schneider Electric is committed to collaborating openly and transparently. In this case, we have collaborated with these researchers to validate the research and to assess its true impact. Our mutual findings demonstrate that while the discovered vulnerabilities affect Schneider Electric offers, it is possible to mitigate the potential impacts by following standard guidance, specific instructions; and in some cases, the fixes provided by Schneider Electric to remove the vulnerability.

As always, we appreciate and applaud independent cybersecurity research because, as in this case, it helps the global manufacturing industry strengthen our collective ability to prevent and respond to cyber-attacks. Working together has allowed us to improve our understanding of potential weaknesses in EcoStruxure Control Expert. It enabled us to disclose this vulnerability in a timely, responsible manner so that our customers and end-users can better protect their operations, assets, and people. Together, we continue to encourage the ecosystem of automation suppliers, cybersecurity solution providers, and end-users to collaborate to reduce cybersecurity risks; and support our customers to ensure they have implemented cybersecurity best practices across their operations and supply chains.