OT security

Security of OT infrastructure and protection against advanced threats require automation and integration of all security solutions, as the consequences of a successful intrusion into critical infrastructure are severe. They must, therefore be minimised by providing the organisation with the right architecture and solutions.

Attacks

Factories, power plants, and other critical infrastructure are increasingly being attacked by hackers. It is, therefore, worth mentioning the most notorious ones carried out in recent years:

• Stuxnet attack on Iran’s nuclear programme
• Breach of a dam in New York
• Attack on a steel mill in Germany
• Power grid failure in Ukraine
• Production at Merck blocked by ransomware
• Attack and shutdown of the US Colonial Pipeline oil pipeline system

Regulations

• National Cyber Security System (KSC) Act aims to ensure cyber security at the national level, in particular, the uninterrupted provision of key and digital services. The achievement of a sufficiently high level of security of the ICT systems used to provide these services.
• NIS2 – Critical entities will need to put in place appropriate and proportionate technical, operational, and organisational measures to manage the security risks of networks and information systems.

Integration of OT and IT security

Securing IT and OT networks against advanced threats requires a complex approach. At the same time, all tools protecting OT and IT networks should be tightly integrated and able to share information in real time. When a threat is detected, this enables multiple security solutions in an organisation’s infrastructure to respond automatically.

In the context of OT infrastructure security, it is worth focusing on a few key aspects:

• Knowledge and visibility, i.e., passive device detection based on monitoring communications between control systems and OT/IoT devices. Full visibility of all events and alerts, originating from production networks, in the security management centre, Security Operation Centre (SOC)
• Threat detection – primarily detailed analysis of data transmitted over industrial networks and ICS protocols. In addition, threat and risk management through the correlation of multiple attack detection techniques: signatures, security breach indicators (IoC), machine learning
• Monitoring and access control, i.e., management of users, passwords, and access to industrial networks, logging of activity (configuration changes, updates, etc.) while managing production process control systems and equipment controllers, control and accounting of the activities of service companies and external users with access to the production network
• Security incident tracking and reporting – in short, the ability to trace the entire communication process based on accumulated historical data (attack path tracing)