Today’s operational technology has become increasingly connected and with new emerging technologies opening the door to a wide range of new possibilities and benefits for industrial companies. However, as digitalization continues to grow so does the attack-surface—introducing new points of vulnerability to industrial control systems.
This evolving threat landscape has brought to light the importance for industrial companies to re-evaluate their security posture, to minimize the threat of a devastating cyber-attack on their business. By implementing the appropriate security measures, digitalization can be enabled without the fear of causing harm or risk to your organization.
Last week, ABB shared how our consultants help customers assess their security risk and plan the appropriate improvements to remediate risk and increase their cyber resiliency. This blog will recap ABB Cyber Security Consulting, while guiding you through the necessary first steps industrial companies must take to reduce cyber security risk within their industrial control systems.
Click here to see the journey toward risk reduction.
Digital transformation requires end-to-end security
For industrial companies, their industrial control system networks are the lifeblood of their business, and a breach could become damaging to business continuity. As the threats of malicious cyber activity both criminal and state actors continue to grow, it’s no longer ‘if’ you will be targeted but rather ‘when’ will you be targeted. Organizations looking to avoid the devastating and costly impacts of a cyber related incident must begin to prioritize security defenses to better fortify their critical assets.
When security becomes secondary or in some cases an afterthought, you leave room for vulnerabilities to be exploited. The role of security is not to become a blocker but rather “meet the needs of the business.” If the organization’s culture does not support cyber security as a business driver, teams are left in a constant state of preventive mode which can inhibit business goals and initiatives. Switching to a security first mindset acts as an enabler for innovation and digitalization. When security is integrated at the beginning it serves as the foundation for future initiatives allowing companies to embrace new technologies to further their business objectives.
In my previous blog, I stressed the importance of embedding cyber security within operational technology. However, at ABB we understand that this must be a journey, not a destination, and industrial companies must look to implement safeguards and continuously assess their effectiveness. By embracing end-to-end security technology and methods, industrial companies can increase their cyber resiliency and make it more difficult for threat actors to impede their operations.
Laying the foundation for OT security
The journey begins with your OT/ICS network security reference architecture, which serves as a blueprint or template for an industrial company to implement with a common set of standard vocabulary to refer to for designing, building, and implementing either a greenfield (new) or a brownfield (existing) network environment.
To mitigate cyber security risk, industrial companies require a solid architecture or ‘blueprint’ for their OT systems. That’s because your reference architecture becomes the foundation of OT security and your go-to-document for future innovation. For those who have not developed a reference architecture, ABB has simplified this effort for industrial companies by developing the ABB ICS Reference Architecture. With over 100+ years of industrial experience and 30+ years of securing industrial control systems, our reference architecture is a proven and consistent approach to planning, implementing, and deploying industrial control system networks using industry best practices and IEC standards.
The ABB ICS Reference Architecture provides secure access to production data to enable better decisions while enabling IIoT, digitalization, and maintaining a robust security. While the architecture significantly improves your security posture, it’s not a guarantee to protect from all cyber threats. The reality is there is no ‘silver bullet’ when it comes to security or security technologies. However, OT security is like locking your house or car—it doesn’t stop the bad guys, but if it’s good enough it could slow them down enough to be detected so proper countermeasures can be taken to minimize the impact to your business. It’s industrial companies’ duty to implement the necessary safeguards to deter malicious threat actors from causing harm not only to their employees and business but to the communities they serve.
Assessing system risk in an evolving threat landscape
Now that you’ve successfully designed and built your industrial control system on a proper foundation, what’s next? Although proper measures have been taken, security is an evolving threat with new and more sophisticated attacks emerging every day. If the security posture is not maintained or the complexity has grown with new equipment and devices coming online the protection of that system begins to deteriorate over time.
Organizations are only as secure as their least protected asset and as a best practice it is important to regularly review the security posture to gain a better understanding of the system's strengths, weaknesses, gaps, and risk. This process is commonly referred to as a cyber security risk assessment. By taking an in-depth look into the overall security posture industrial companies can uncover, prioritize, and remediate any risk found from the assessment.
At ABB, we provide a holistic approach to risk assessments that uncovers, rates, prioritizes, and remediates control system security risk with a detailed in-depth analysis of your control system’s security posture and risk mitigation strategy. ABB has long been a contributing member of the IEC 62443 standard with members on the committee ranging from reviewers to contributors to co-editors.
Our security experts work closely with you to conduct a high-level risk assessment in accordance with the best practices outlined in ISA / IEC 62443 standards to determine system-wide and system-specific risk. Below we can see the typical process of what an ABB Risk Assessment would look like:
Phased plan to remediate vulnerabilities
The result of the risk assessment helps to strike a balance between addressing the high-risk gaps while being mindful of the financial and personnel resources available. Only with this visibility can organizations be assured they are taking the strategic steps necessary toward a better security posture.
To accomplish this, our ABB industrial cyber engineers and experts leverage the findings, of the assessment, to facilitate partitioning of the control system and groupings of assets into zones and conduits. By grouping weaknesses and vulnerabilities by solution, our security experts will provide you with the tools and resources to remediate risk with an actionable plan for short and long-term remediation steps to reach your desired security posture.
Start your security journey today!
Don’t wait to become a victim, stay ahead of bad actors with ABB Cyber Security Consulting. Together, we can collaborate on identifying potential threats to your systems and provide the necessary steps to ensure cyber security readiness to better protect your people, assets, and data.
If you’re ready to start your cyber security journey, contact an ABB security expert today!
Watch the Video Series 1 | 2 | 3 or download the brochure to learn more on ABB ICS Reference Architecture
Register for IIoT World ICS Cyber Security Day 2024 and hear from ABB and other security experts.
Author
Ruben Ramirez graduated from the University of Texas at Austin with a bachelor’s in economics and business administration. He has over 12 years of B2B experience productizing, marketing, and launching SaaS solutions to better support and benefit organizations around the world.
He has worked on information technology (IT) and operational technology (OT), covering portfolios in supply chain, petroleum refining, cyber security, virtualization, artificial intelligence (AI), machine learning (ML), and more. Currently he serves as the Global Product Marketing Manager in Operational Excellence and Cyber Security for the Process Automation Process Industries (PAPI) Digital Business Line based in Houston, Texas.
