OT security

Produkty

OT security

Security of OT infrastructure and protection against advanced threats require automation and integration of all security solutions, as the consequences of a successful intrusion into critical infrastructure are severe. They must, therefore be minimised by providing the organisation with the right architecture and solutions.

Attacks

Factories, power plants, and other critical infrastructure are increasingly being attacked by hackers. It is, therefore, worth mentioning the most notorious ones carried out in recent years:

Stuxnet attack on Iran’s nuclear programme
Breach of a dam in New York
Attack on a steel mill in Germany
Power grid failure in Ukraine
Production at Merck blocked by ransomware
Attack and shutdown of the US Colonial Pipeline oil pipeline system

Regulations

National Cyber Security System (KSC) Act aims to ensure cyber security at the national level, in particular, the uninterrupted provision of key and digital services. The achievement of a sufficiently high level of security of the ICT systems used to provide these services.
NIS2 – Critical entities will need to put in place appropriate and proportionate technical, operational, and organisational measures to manage the security risks of networks and information systems.

Integration of OT and IT security

Securing IT and OT networks against advanced threats requires a complex approach. At the same time, all tools protecting OT and IT networks should be tightly integrated and able to share information in real time. When a threat is detected, this enables multiple security solutions in an organisation’s infrastructure to respond automatically.

In the context of OT infrastructure security, it is worth focusing on a few key aspects:

Knowledge and visibility, i.e., passive device detection based on monitoring communications between control systems and OT/IoT devices. Full visibility of all events and alerts, originating from production networks, in the security management centre, Security Operation Centre (SOC)
Threat detection – primarily detailed analysis of data transmitted over industrial networks and ICS protocols. In addition, threat and risk management through the correlation of multiple attack detection techniques: signatures, security breach indicators (IoC), machine learning
Monitoring and access control, i.e., management of users, passwords, and access to industrial networks, logging of activity (configuration changes, updates, etc.) while managing production process control systems and equipment controllers, control and accounting of the activities of service companies and external users with access to the production network
Security incident tracking and reporting – in short, the ability to trace the entire communication process based on accumulated historical data (attack path tracing)

Response to the challenge

Protecting industrial infrastructure from cyber attacks, e.g., maintaining the business continuity of production processes.

5 steps to a secure industrial network

A good practice in this context is to start with the implementation of non-intrusive solutions, passively scanning and monitoring the industrial network, and end with the implementation of solutions that manage communication and access and actively block attacks.

Knowledge

Passive device detection based on monitoring communication between control systems and OT/IoT devices. Building and visualising connection networks, defining points of contact between industrial and IT networks.

Threat detection

Detailed analysis of data transmitted in industrial networks and ICS protocols by the Network Detection and Response (NDR) class system. Threat and risk management through the correlation of multiple attack detection techniques: signatures, security breach indicators (IoC), machine learning.

Monitoring and access control

Managing users, passwords and access to industrial networks in Privileged Access Management (PAM) solutions. Accurate logging of activity (configuration changes, updates, etc.) when managing production process control systems and device controllers.

Threat blocking and access management

Use of Next Generation Firewall (NGFW) solutions to block malware and unauthorised communications within industrial networks. Segmentation - minimising the attack surface. Separation of critical resources and definition of access rules between them.

Full visibility

Full visibility of all events and alerts, originating from production networks, in the security management centre, the Security Operation Centre (SOC). Tracking and reporting of security incidents.