Cybersecurity checklists require continual updating - Putman Media
The era of security by obscurity in operations technology has ended, with AI accelerating cyber-attacks against critical infrastructure, according to Emerson cybersecurity experts.
More network connections equal more vulnerabilities to potential cyber-probes, intrusions and attacks. The COVID-19 pandemic accelerated remote access adoption at an unprecedented speed, which compounded cybersecurity challenges. This was further intensified by geopolitical tensions and the recent evolution of artificial intelligence (AI).
AI Changes Security Landscape
AI tools are rapidly accelerating the cyber arms race, helping intruders find, target and disrupt physical OT assets more quickly than just a couple of years ago. This forces users and their cybersecurity teams to abandon traditional security-by-obscurity mentalities.
Batista explains that organizations must now assume they'll be compromised rather than hoping they won't be. This requires understanding the potential consequences of attacks and knowing what systems are exposed. Continuous operations with complex engineering networks face different challenges than discrete operations, but both require proper asset mapping and criticality assessment.
Secure Connectivity Strategy
While cyber-threats evolve, users seek more data to improve performance, reliability and decision-making, leading to increased connectivity. Emerson recommends intentional, controlled connectivity rather than avoiding it altogether.
The company's strategy includes risk visibility through assessments, secure access via network segmentation, active monitoring for threats, and compliance with standards like IEC 62443. Kane advises implementing a defense-in-depth architecture with functional zones, controlled conduits, secured remote access, and monitoring for abnormal behavior.
Enterprise systems shouldn't be connected directly to the control system, even to read data. That data should come from a replicated source, such as Emerson's DeltaV Edge Environment software or a historian in a network's demilitarized zone (DMZ).
Standards Drive Security
Standardizing cybersecurity practices presents a united front against threats. IEC 62443 standards are particularly relevant for industrial automation systems, defining responsibilities for asset owners and suppliers. NIST's Cybersecurity Framework 2.0 and SP 800-82 provide enterprise-level and OT-specific structures respectively.
Zero-trust cybersecurity is becoming a de facto standard, with CISA's guidelines adapting these principles to operational technology. NERC CIP-015's internal network security mandates may drive behavior changes beyond regulated industries. End users now request detailed certification assessments for both products and deployment services.
Patching Challenges
One critical infrastructure client adopting a 48-hour patching model discovered their OT team needed improved posture to align with IT updates. The OT team struggled to reconcile patching with high-uptime requirements and limited visibility into operations.
The organization implemented Emerson's Guardian Cybersecurity software to monitor system health, vulnerabilities, and patching status while providing centralized audit readiness. Many customers realize OT security is critical to enterprise objectives but find the process overwhelming, necessitating a gradual approach starting with assessments.
Related
