Midway through October, news broke of a cyber attack that targeted over 700 French supermarkets, specifically their fridges. Cyber criminals accessed the connected fridges, increasing their temperatures and manipulating their defrost systems. Overnight, the fridges thawed, spoiling food stock worth hundreds of thousands of euros.
Attacks on operational technology (OT) systems are on the rise. Though the most infamous examples targeted large public infrastructure, this attack on French supermarkets reveals an uncomfortable risk for devices that interact with the physical world.
Why OT security is complicated
On the one side, companies genuinely benefit from the integration between OT devices, connectivity and digital monitoring. According to the National Institute of Standards and Technology (NIST), surveyed businesses that use predictive maintenance systems reported 52.7 % less unplanned downtime and 78.5% fewer defects.
On the other hand, this connectivity vastly increases cyber risks for OT systems. It's a long-standing problem, explains Doctor Mafuwafuwane, Executive Head of Cybersecurity at ICT and managed services provider Nexio.
"At the very least, you have two major sides to OT systems. IT focuses on their side of things, like enterprise architecture, networking, those kinds of things. And on the other side, engineering and operations look at site safety and reliability, and also production continuity. Neither of them can ever be ignored."
There are also other stakeholders, such as the CEO and their board, who look at continuity, investment and the organisation's risk appetite. Then there is security and cyber risk, which stop at the desks of the CISO and security teams.
One can compare these overlaps to a digital system such as a server, which also exposes a crucial difference. Downtime for a server is more manageable, especially since it's simpler to duplicate that system. But physical devices are different. You can't clone a fridge. You can't just patch a chemical plant's industrial controller. You can't simply shut down a mining lift because there is a security alert.
Operational continuity is the baseline
These choices have very direct consequences, which is why Mafuwafuwane prefers to look at something other than just cyber risks.
"We approach OT cyber security from a business resilience and operational continuity perspective. We're not saying something might not happen. We want to make sure nothing will be interrupted, nothing will be touched when it comes to operations."
This approach enables OT security to use a concept that has become vital to effective cyber security: take a top-down business risk view, develop a proactive monitoring and response capability, and make security decisions based on the options presented by risks.
"What risks are there? How serious are they? Is patching the best option? You weigh your options through an operational lens. Start with the business priorities, using visibility, monitoring and governance to take the most appropriate actions."
A framework for OT security
To execute this approach, Mafuwafuwane and his team at Nexio use a layered framework:
- Discovery: Conduct proactive and passive discovery of devices and their statuses.
- Monitoring: Implement OT-appropriate monitoring systems through dedicated expert partners.
- Control: Develop segmentation and access controls.
- Detection: Integrate Nexio's 24/7 national security operations centre (SOC) and security incident event management tools to monitor and correlate device information.
- Respond: Use security orchestration, automation and response (SOAR) and OT-specific playbooks that respond to alerts and incidents.
- Cyber GRC: Apply integrated governance, compliance and risk management to drive improvements and determine risk-appropriate options.
These steps will be familiar to cyber security experts. Mafuwafuwane notes, though, that the difference is in how they are implemented.
"At the end of the day, OT shares digital similarities to IT. There are networks, access controls, software updates, all those things. But the differences are very important. OT works at a different cadence with different priorities. It has different stakeholders and business considerations. Those things matter a lot, so instead of trying to bundle OT into an IT solution, we reshape IT and security to fit with OT requirements."
Operational visibility beats plugging every hole
This approach is very effective, because ultimately, cyber criminals don't see much of a difference. The French fridge attack resulted from familiar poor security hygiene mistakes, such as weak passwords and overexposure to networks. Proven cyber security methods can secure those systems, even if they are 30-year-old electric motors connected to new digital controllers.
Don't try to plug every hole. Create visibility, plan according to continuity, fix according to risk and operational pragmatism, and have plans ready in case a problem arises.
"OT security can't be an afterthought," says Mafuwafuwane. "But if cyber security becomes part of how we design, operate and modernise that infrastructure, we can keep OT safe."
Share
