Preparing for Cyber Attacks on Utilities, Gas / Oil, and Water:
2 Sides of Network Visibility
In the past 20 years, our state, national, and local utilities have matured, and remote connectivity has only increased opportunities for disruptions, creating power outages and disruptions to electric, water, gas/oil, and other critical infrastructure.
As a result, companies are investing in cyber security solutions to keep the latest malware outside of their infrastructure. As shown by the recent Solarwinds breach, cyber security monitoring solutions can become an attack vector. As experienced by the 18,000 customers affected, cleaning up after the breach is highly stressful.
The goal of eliminating all cyber threats is futile since organizations will continue to depend on cyber systems, and attackers will keep targeting them. To succeed in overcoming this arms race requires investing in cyber resiliency. This means the ability to recover from and adjust rapidly to cyber risks. Like the immune system that has developed protection, detection, and evolution capabilities over hundreds of thousands of generations to keep organisms alive despite the constant assault from viruses and diseases, organizations have to embrace the principles of cyber resiliency to keep operating despite cyber threats.
These cybersecurity threats are rapidly increasing in both scope and severity. Keeping your critical infrastructure completely secure is unrealistic; being proactive & ready to assess, respond and recover is not.
New Cybersecurity Regulations Introduced
The US government is pushing new cybersecurity regulations to improve reporting and transparency surrounding cyber attacks.
The new requirements offer a strong opportunity for companies to not only review and update their cybersecurity incident response plan but also to proactively invest in cyber resiliency principles, such as continuous visibility and verification of their network access policies.
Preparedness and the ability to understand the impact of a breach in a timely manner will be key foundations to comply with the new reporting requirements and to keep operating despite being under threat.
Cybersecurity requires a robust compliance program, redundancy to ensure business continuity, and diversity of tools. For this to work harmoniously, teams across many departments are imperative.
While cybersecurity is becoming more complex, simplicity and usability still matter. Balancing them with visibility, resiliency, and compliance is the goal of any cybersecurity framework.
The Solution: Establishing Comprehensive IT / OT Network Visibility
The first objective of cyber resiliency is visibility and understanding. It is defined in the NIST publication, NIST,SP.800-160v2r1 as maintaining useful representations of mission and business dependencies and the status of resources with respect to possible adversity.
These complex ecosystems are growing every day and, if not understood from all access points, are left vulnerable to persistent access. To respond to critical emergencies faster, companies need to put in place the right incident response capabilities, so we can understand, isolate, contain, and mitigate threats when they occur.
Utilities today need:
With critical dependencies on connected cyber systems, industrial control systems need cyber resiliency to protect their mission-critical assets.
It requires an understanding of dependencies among cyber systems and critical operations:
Gaining accurate visibility of OT networks is fundamental to protecting critical assets and ensuring that networks are correctly segmented. A comprehensive network visibility solution combines traffic monitoring (what is connecting to what) with network architecture analysis (what can connect to what).
The 2 Sides of Network Visibility: The First Step Towards Cyber Resiliency
Network visibility is covered by the following two building blocks under visibility & understanding. These two sides of network visibility are both crucial and complementary to each other:
Want to learn more? Download our Guide https://network-perception.com/resource/ebook-invest-in-2-sides-of-network-visibility
Complementary Approaches:
Each approach enables answering a different set of questions. On the one hand, network traffic monitoring is extremely useful for identifying compromised assets and exploited vulnerabilities. It's also useful to detect if sensitive information is being exfiltrated or if a connected service is misconfigured.
On the other hand, network access modeling enables the proactive verification of network segmentation, as well as understanding if critical vulnerabilities are exposed on the network. It's also important to measure risks related to remote access and to simulate possible network attack paths.
There is no doubt that to become cyber resilient, organizations have to invest in both techniques so they eliminate all blind spots through a comprehensive network visibility program.
Once you understand and visualize what is on your network map and how this might be changing every day - then you can apply additional cyber resiliency principles to develop your cyber resiliency roadmap like:
1) Establishing the Principle of Least Privilege (Network Segmentation)
To understand the criticality of assets and separate dependencies to avoid catastrophic failure.
2) Ensuring Redundancy
To enable multiple ways to achieve the mission during a critical attack period
3) Implementing System Diversity
Diversity in your organization’s network with a heterogenous approach so you can resist attack
4) Monitoring & Documenting
Extract detailed info to understand existing capabilities and develop, document, and measure your progress on your roadmap.
Our dependence on cyber systems is increasing every day, and the frequency, severity, and sophistication of cyber-attacks have been rising along with it. The size and complexity of networks have also grown exponentially, continuously exposing organizations to larger attack surfaces. As a result, companies are investing in cyber security solutions to keep the latest malware outside of their infrastructure.
Cyber resiliency starts with understanding the entire OT / IT network so we can protect and make it as difficult as possible for an attack to take place. Then, make sure you can still operate when attacked, respond, and, most importantly - recover.
It’s never too early – or too late, to protect our vulnerable utilities and infrastructure systems. Contact us [LINK] and let us help you with your cyber resiliency strategy.
Watch this short video of our product and see what you can do to become cyber resilient.
If you have questions or would like to know more about NP-View, please contact the Network Perception team at:
+1 (872) 245-4100 | info@network-perception.com | https://www.network-perception.com
