Protect critical infrastructure and manufacturing plants with Indegy and NU Africa

As manufacturers around the world analyse and embrace the importance of being more connected to the Industrial Internet of Things (IIOT), cyber security experts caution that the benefits of being interconnected come with a warning, and companies need to protect their industrial plants from being hacked.

This is according to Stefan van de Giessen, general manager: cyber security at value-added distributor Networks Unlimited Africa, who says, “The IIOT allows tools and machinery of all types to be connected to the Internet, bringing major benefits but also risks to the business that, by and large, simply did not exist a decade or so ago. In South Africa, manufacturing is the fourth-largest contributor to the economy, according to Statistics South Africa[1]. This makes the importance of protecting manufacturing plants – as well as critical infrastructure of course – even clearer.

“When hackers attempt to penetrate a manufacturing/supply chain network, they know that the organisation is working according to a set schedule, and that the number of working hours available in any 24-hour period is valuable, with a slim margin for downtime. This is why it is potentially so lucrative to try to hack into the system in order to, for example, cause damage, loss of data or downtime until a sizeable ransom is paid.”

A recent study by the IBM Institute for Business Value (IBM IBV) showed that industrial companies are not doing enough to protect their plants from being hacked[2]. The institute clarified that "Deploying technologies at a faster pace than securing them can open up an internet of threats"[3] and also that "For industrial manufacturing, chemical, oil and gas, and utilities, security breaches can lead to large-spread contamination, environmental disasters, and even personal harm[4]."

“Another IBM IBV research document found that almost 90 percent of the automotive companies surveyed were using these technologies without fully evaluating the risks or preparing effective responses, thereby leaving themselves vulnerable to cyber attacks[5],” continues Van de Giessen. 

“I believe we could take this as a proxy for other manufacturing industries, and even if the numbers don’t play out exactly the same, this points to the new reality of the threat of cyber hacking in the manufacturing industry, and the critical need for organisations to protect themselves.”

Van de Giessen says cyber attacks like the ones that caused power outages in the Ukraine in 2015 – believed to have been orchestrated by Russian agents – have shown that cyber criminals are ready to strike critical infrastructure.

“Organisations in control of critical infrastructure, which is of national significance, as well as the national governments to which they are answerable, simply cannot be complacent,” he warns. “It is clear that the chances of a cyber-related operational breakdown, in areas such as energy and power facilities, transport systems, water treatment facilities and defence systems, as well as for any manufacturing plant that makes use of industrial control systems and operational technology,  are higher than ever before.”

To this end, Networks Unlimited Africa has recently partnered with Indegy, a leader in industrial cyber security that protects industrial control system networks from cyber threats, human error and malicious insiders. Networks Unlimited Africa now brings Indegy solutions to South Africa and throughout the continent. Van de Giessen clarifies, “Indegy undertakes to protect industrial control systems from external cyber threats, malicious insiders and human error. Exernal threats bring the most risk potential – a well-planned cyber attack will usually cause significant damage, which can include physical damages, financial costs and reputational threats for the business.”

In the manufacturing sector, Indegy was recently involved in securing the Supervisory Control and Data Acquisition (SCADA) network of the largest cement producer in Israel, which has two large-scale production sites in two different places. Together, these sites produce about 60 percent of the cement used by Israel’s construction industry. With the introduction of connected technologies, Nesher realised that its SCADA network could potentially be exposed to cyber threats that could jeopardise the safety and productivity of its factories. Therefore, determined to reduce risk and also minimise production downtime, the management team chose Indegy after deciding to invest in a dedicated industrial cyber security solution.

The company’s Web site features a video on its client where Nesher CISO Roy Shalev notes: ‘With cement furnaces operating round-the-clock at 1 200 degrees Celsius, Nesher’s most important operational concern is safety. Nesher’s furnace and other critical equipment are managed by industrial controllers, which, if compromised by a cyber attack, could lead to a major explosion and even loss of life. From a business standpoint, a cyber security event in Nesher’s SCADA environment could bring cement production to a halt. Such an incident could cause major shortages of cement in Israel’s construction market, as well as revenue losses of millions of dollars and reputational damage to Nesher."

Van de Giessen notes: “We can see quite clearly that protecting manufacturing plants and critical infrastructure sites is a high-stakes game. There are issues that must be considered including potential loss of life, enormous costs of repair or replacement, loss of income caused by down time, and reputational damage. Additionally, and depending on the scenario, for example, environmental waste could also be spilled out into a water system and cause widespread environmental damage.”

Nesher required full visibility of its complex SCADA/ICS network, together with real-time 24/7 alerts on any changes to its controllers. This level of visibility is crucial for enabling early detection and mitigation of security risks before they impacted on productivity or endangered employee safety. The system implemented by Indegy offers maximum visibility using proprietary technology that actively queries devices in Nesher’s industrial environment, ensuring that its SCADA engineers are aware of all changes to all assets in the environment. Additionally, the Indegy user interface design makes it easy for Nesher’s engineers to control traffic and operations in the SCADA network, while the accuracy of the alerts means that the security analysts can focus their efforts on investing real threats, with a minimum of false positives.

“With the boundaries between IT and OT blurring, industrial infrastructure operations are now part of the connected, online world, and are no longer stand-alone entities. However, the rapid pace of change means that many industrial operations are still running on old control systems and, as such, are more vulnerable to today’s cyber criminals. A solution like Indegy allows security operators and engineers alike the comfort of knowing that their plant is protected from cyber security threats according to the highest standards available,” concludes Van de Giessen.

To read more on the Indegy solution, please click here.

[1] http://www.statssa.gov.za/?p=11890

[2] https://www.ibm.com/downloads/cas/ZJRRVRKW

[3] https://www.ibm.com/thought-leadership/institute-business-value/report/iotthreats

[4] https://www.ibm.com/thought-leadership/institute-business-value/report/iotthreats

[5] https://www.ibm.com/thought-leadership/institute-business-value/report/automotiveiiot