In recent years, Cyber-Physical Systems (CPS) have become the new “hot target” for cybercriminals. Attacks on critical infrastructure, particularly in the oil, gas, and water industries, are escalating. Most recently, a group of hackers were found tampering with Operational Technology (OT) controls in multiple countries, including U.S. critical infrastructure.
Even the government is taking notice as CISA recently released a fact sheet, Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems, warning of increased cyber risks to water system interfaces, and sharing best practices for operators to protect critical infrastructure. Historically, OT leaders and organizations with CPS focused on productivity, uptime, and quality control, often relegating security to the IT department. However, recent events have shifted this perspective.
An Urgent Call For Robust Security Measures
As commercial attacks on OT systems become increasingly prevalent, organizations are recognizing the critical need for stronger and more comprehensive security measures. With the advent of Industry 4.0, the integration of digital and physical systems means that security breaches can lead to significant real-world consequences.
For example, exploited vulnerabilities can affect the delivery, access, or even quality of essential services such as water. As a result, organizations are starting to face the consequences of vulnerabilities introduced by the growing connectivity between OT and Information Technology (IT) networks, prompting an urgent shift in priorities from productivity and efficiency to robust security measures.
Despite the push for enhanced security, there remains a significant amount of fear, uncertainty, and doubt surrounding the implementation of Zero Trust principles in OT environments. Many organizations worry that strengthening their defenses could introduce obstacles that hinder operational productivity and up-time.
Interestingly, many recent cyberattacks causing physical disruptions were not due to direct manipulation of OT systems, but instead stemmed from IT-based attacks such as ransomware. CPS were consequentially shut down to prevent malware spreading from IT to OT.
According to the CISA Cross-Sector Cybersecurity Performance Goals Update, March 2023, it recommends reducing the likelihood of breached OT systems by denying access by default and implementing the Zero Trust model. However, OT leaders continue to express concerns about production slowdowns and operational hindrances.
To address this, IT/OT leaders should consider incrementally implementing Zero Trust traffic policies. This approach minimizes the risk of breaking applications, causing downtime, and losing production. Visibility of all assets in both IT and OT environments is crucial to identify and prioritize critical vulnerabilities so they can be remediated. Progressive traffic policies can then prevent the lateral spread of breaches before they become crises, regardless of whether the entry point is in the IT or OT network.
The importance of securing OT and CPS cannot be overstated. As cyber threats continue to evolve, organizations must prioritize robust security measures to protect critical infrastructure. Incremental implementation of Zero Trust principles offers a balanced approach, enhancing security without compromising productivity. By understanding and addressing the vulnerabilities in CPS, organizations can safeguard their operations against the ever-present threat of cyberattacks.
