Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

7/17/2018
10:30 AM
Peter Newton
Peter Newton
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

SCADA/ICS Dangers & Cybersecurity Strategies

Nearly 60% of surveyed organizations using SCADA or ICS reported they experienced a breach in those systems in the last year. Here are four tips for making these systems safer.

A large number of government agencies and private organizations have SCADA (supervisory control and data acquisition) or industrial control systems (ICS). The benefits of these technologies come with significant security challenges. In a recent survey by Forrester commissioned by Fortinet, nearly six in 10 surveyed organizations using SCADA or ICS indicate that they experienced a breach in those systems in the past year.

Part of the challenge is that these systems are being used to manage not only their traditional OT (operational technology) infrastructures but also a host of new Industrial Internet of Things (IIoT) devices. What's more, many of those organizations are adding to their risk by providing new technologies and partners with a high level of access into their systems. In addition, most organizations now report developing connections between their traditional IT systems and their SCADA/ICS, introducing the potential for outside hackers to penetrate into these control systems.

Rapid Adoption, Access, and Security
Though SCADA/ICS systems were once primarily used by electric and water utilities, many organizations in recent years have begun using these technologies to automate data collection and related equipment. Transparency Market Research predicts the global ICS market alone will grow from $58 billion in 2014 to $81 billion in 2021. Industrial control systems, for example, have become widely used in manufacturing, at seaports, in water treatment plans, in oil pipelines, in energy companies, and in building environmental control systems. At the same time, SCADA systems, which serve as the graphical user interface into ICS, are growing at an annual growth rate of 6.6%.

Consequently, SCADA/ICS technologies and related IIoT devices have become high-value targets for hackers looking to disrupt business operations, collect ransom, or compromise a rival nation's critical infrastructure. Per the Forrester study, while a staggering 56% of organizations using SCADA/ICS reported a breach in the past year, even more astonishing is that only 11% indicate that they have never been breached.

Easy access to SCADA/ICS by third parties is a major part of the problem. Many organizations place a lot of trust in the security of their technology vendors and other outside organizations by giving them wide access to their internal systems. More than six in 10 organizations surveyed by Forrester give either complete or high-level access to partner or government organizations. Thus, SCADA/ICS operators face serious risks, many of their own design.

Threats and Breaches
The Forrester survey asked organizations operating SCADA/ICS about their most serious security threats. More than three-quarters of organizations acknowledge being very or extremely concerned about outside malware. Seven in 10 are very or extremely concerned about internal hackers, the leakage of sensitive data and external hackers.

Not only are SCADA/ICS breaches common, but they also have serious repercussions. Unlike traditional IT networks, OT networks often manage and control systems where a compromise can have potentially devastating consequences. A compromised IoT device that monitors inventory represents a very different threat than an IIoT device monitoring or managing a temperature control system on a 50,000-gallon boiler at a chemical plant.

As a result, 63% of organizations say the safety of their employees was highly or critically affected by a SCADA/ICS security breach. Another 58% report major impacts to their organization's financial stability, and 63% note a serious drag on their ability to operate at a sufficient level.

Addressing Security and Compliance
There are a variety of responses to these security issues. Nearly half of surveyed organizations see a full business or operational risk assessment as the top way to improve their risk posture as OT and IT systems converge. Other common approaches for mitigating risk include implementing common standards, increasing the centralization of device management, and consulting government bodies such as the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Compliance with industry and security standards is another top concern.

Steps Toward Greater Security
SCADA/ICS operators can take several steps to protect their assets, even as they consider what security measures to spend their budget on. These include:

  • Securing the network infrastructure, including switches, routers, wireless networks, and IoT/IIoT devices, as well as appropriately hardening devices by turning off or disabling unused ports and/or features.
  • Segmenting networks by, where possible, separating connected wireless and IoT/IIoT technologies from the SCADA/ICS deployment.
  • Applying identity and access management policies to control and monitor outsiders who may need to access the network, to prevent employees from accessing parts of the network they don't need to access, and to control and manage IoT/IIoT devices being connected to the network.
  • Deploying endpoint protections to IoT and other devices to establish visibility into threats.

Security considerations for SCADA/ICS take on a higher priority than those for traditional IT systems due to the potential impact of an attack on the physical safety of employees, customers, or communities. Because the repercussions of a breach are so potentially serious, the need to remain in compliance is also high. Fortunately, organizations can significantly improve their security posture and thereby reduce their risks by taking a multilayered approach to SCADA/ICS security.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Peter Newton is the Senior Director of Product Marketing for Fortinet. He has more than 15 years of experience in high-tech product management and product marketing. Newton is the product marketing lead for Fortinet's Operational Technology (OT) solution, including ICS & SCADA. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...