The real-world impact of cyberattacks

Gartner paints a sobering picture of the digital-first future, having forecasted that the current attacks on operational technology (OT) will evolve to more severe attacks by 2025. These predictions don’t seem far-fetched at all, with the 2021 ransomware attack on Colonial Pipeline demonstrating how the impact of a cyberattack could easily cross over into the real world.

OT security is highly relevant to South-east Asia, especially the Asean nations. The region is home to some of the world’s largest digital economies, with digitalisation representing a significant growth engine.

However, South-east Asia’s rapid digital transformation has also made it a highly attractive target for cybercriminals. Recognising the implications, countries such as Singapore have embedded OT security into its cybersecurity masterplan. Most recently, the Cyber Security Agency of Singapore launched scholarships aimed at bridging the talent gap, strengthening the country’s OT cybersecurity workforce and overall capabilities. 

While OT and information technology (IT) were initially designed to function independent of each other, it is becoming commonplace to see a confluence of these networks as organisations pursue higher operating efficiencies through the interconnectivity of systems.

However, this also opens the door to a whole new area of security risks. If not managed properly, threat actors can leverage IT networks to access and exploit vulnerabilities of previously isolated OT systems.

The Current State of OT Security 

A NEWSLETTER FOR YOU

Friday, 8.30 am

Asean Business

Business insights centering on South-east Asia's fast-growing economies.

Sign Up

The IT-OT convergence has seen the rise of attack methods aimed at shutting down critical OT networks, appropriately termed disruptionware. Typically originating in IT networks, the key objective of disruptionware is to suspend essential operations or undermine safety by disrupting key processes governed by OT.

While cybersecurity is increasingly becoming an essential business requirement, the focus remains overwhelmingly placed on the protection of IT networks. The end result is that many organisations today are still operating with inadequate OT security frameworks, impacting their ability to properly protect critical functions governed by these systems.

Further complicating risk management efforts is a tendency to downplay vulnerabilities within OT systems.

Showcasing the scale of the issue, Forescout recently uncovered a set of 56 vulnerabilities affecting devices from 10 major OT vendors, all of which stem from insecurely designed functionality. These identified vulnerabilities could serve as attack vectors for threat actors in the age of IT-OT convergence, allowing for credential theft, remote code execution and firmware manipulation.

Ensuring Safety in the Next Generation of OT Networks

As IT-OT convergence becomes prevalent, holistic cybersecurity strategies will need to be adapted to this newly connected environment for organisations to securely realise the benefits of interconnectivity. 

Network segmentation, which is a core component of Zero Trust, helps split a network into multiple smaller networks to compartmentalize the sub-networks based on their security requirements and to contain potential cyberattacks from spreading.

The foundation for effective and dynamic network segmentation lies in strong visibility. Having an accurate, detailed, and up-to-date inventory of devices connected to the network allows security teams to fully understand what devices sit within their network environment and how they are interacting with each other. Some basic principles include:

Knowing the state of your network environment:

• How are devices interacting with each other? What protocols are being used? 

• Does every device need to be on the same network?

• What is the current software version compared to what you have deployed? 

• If there are changes to be made, how will this impact any of the above?

Disabling access to services or software not needed. This could be local to the endpoint or upstream by using network segmentation.

These principles provide the context necessary for accurate segmentation of devices, allowing security teams to assign appropriate security policies that prevent intruders from moving laterally to other networks or devices.

The management of OT infrastructures often involves thousands of interconnected devices to monitor and control operations that were once manual. The complexity involved in monitoring OT networks can be greatly reduced by automating and orchestrating security operations across all assets on a single platform, which can:

• Ensure existing security products are installed, running and up to date.

• Provide insight on device, user and network context between different IT and security products and enable operational team to identify process operations issues early on to avoid downtime.

• Automate system-wide policy enforcement across disparate solutions.

• Accelerate response actions to inform operators and contain identified threats, mitigating risks in a timely manner.

It is also essential to note that IT-OT convergence is not merely an integration of technologies, but also teams and processes. IT security teams must incorporate the nuances of industrial environments as a key consideration. For instance, the scale, complexity, and mission critical nature of OT such as energy grids often means that it is not possible to take them offline to address vulnerabilities in the event of an attack.

The Road towards a Secure Digital-first Economy

To secure OT and ICS, organisations need to maximise visibility into their OT environments, tightening security across the entire enterprise. With proper visibility, segmentation, and orchestration of point solutions across the entire threat landscape, organisations can effectively identify and rebuff cyberattacks on their networks, and carry on operations with confidence.

The writer VP of Asia Pacific & Japan at Forescout.