{"id":93534,"date":"2021-05-18T09:00:19","date_gmt":"2021-05-18T16:00:19","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=93534"},"modified":"2023-05-15T23:06:37","modified_gmt":"2023-05-16T06:06:37","slug":"mitigate-ot-security-threats-with-these-best-practices","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/05\/18\/mitigate-ot-security-threats-with-these-best-practices\/","title":{"rendered":"Mitigate OT security threats with these best practices"},"content":{"rendered":"
The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager\u00a0Natalia Godyla<\/a> talks with Chris Sistrunk<\/em><\/a>, Technical Manager in Mandiant\u2019s ICS\/OT Consulting practice and former engineer at Entergy, where he was a subject matter expert on transmission and distribution of <\/em>supervisory control and data acquisition (SCADA) systems. In this blog, Chris shares best practices to help mitigate the security threats to operational technology (OT) environments.<\/em><\/em><\/p>\n Natalia: What tools do you use to monitor and govern your OT environment?<\/strong><\/p>\n Chris:<\/strong> First, you can use the control system itself, which already offers some level of visibility into what’s happening. It looks like NASA control. Operators sit and watch the process all day. You can see what looks normal and what doesn’t look normal.<\/p>\n What\u2019s new is not just looking at the system itself but at OT network security. Especially in the last five or six years, the focus has been on getting network visibility sensors into the control network. There are several vendors out there that understand the protocols, like MODBUS, Siemens S7, and DNP3, and have developed sensors that are purpose-built to analyze OT network traffic rather than IT traffic.<\/p>\n With a newer control system, it’s much easier. Many times, they’ll use virtual machines to manage OT, so you can put agents in those areas. If it’s a Windows 10<\/a> or Windows 7 environment, you can even use Microsoft Defender Antivirus<\/a> and collect the Windows event logs and switch logs. If you don’t look at the logs, you’re not going to know what’s there, so you need to monitor behavior at the network layer using technologies like deep packet inspection (DPI) to identify compromised devices.<\/p>\n Natalia: What are some best practices for securing remote access to the OT network?<\/strong><\/p>\n Chris:<\/strong> Number one, if you don’t need it at all, don’t have it. That\u2019s the most secure option.<\/p>\n Number two, if you have to have it, make sure it’s engineered for why it’s needed and tightly control who can use it. It\u2019s also important to make sure it\u2019s monitored and protected with multifactor authentication<\/a> (MFA) unless it\u2019s just for read-only access to the control network, in which case it\u2019s less of a risk. A lot of times, these OT equipment vendors require in their warranty contracts that they have remote access with full control and the ability to change configurations, which means you\u2019ve given someone a high level of privileged access to your control systems.<\/p>\n Number three, have a process and procedure for when that remote access is used and when it’s turned off. You should at least know who was there and for how long, and who did what, using audit logs, for example.<\/p>\n I want to highlight that the Water ISAC, the international security network created for the water and wastewater sector, published a free document called 15 Cybersecurity Fundamentals for Water and Wastewater Utilities<\/a>. It\u2019s a reminder to consider where remote access is coming from.<\/p>\n Natalia: What percentage of organizations are continuously monitoring their OT networks?<\/strong><\/p>\n Chris:<\/strong> Today, it’s the exception, not the rule. The only ones monitoring are the ones that have to do it, such as nuclear companies, and the 3,000 or so largest electric utilities that are under North American Electric Reliability Corporation Critical Infrastructure Protection Standards (NERC CIP) regulation, as well as any companies that might have been attacked in the past. But even NERC CIP doesn\u2019t require continuous network security monitoring, just monitoring event logs in a SIEM, for example, which means you can still miss stuff.<\/p>\n So percentage-wise, it\u2019s not very many, especially in non-regulated sectors like manufacturing, pharmaceuticals, chemicals, oil and gas, mining, and warehousing and logistics.<\/p>\n Companies don’t like to spend money on security if they don’t have to. Unfortunately, it’s going to take an attack. We didn’t have electric reliability standards until we had two Northeast blackouts that affected millions of people in 1965 and in August 2003. After that, they said, \u201cOh, we should probably have some electric reliability standards.\u201d When I started at the power company, one of the lineman safety instructors said, \u201cSafety rules are written in blood.\u201d The only reason why we have reliability rules is because we’ve had darkness.<\/p>\n Natalia: How can teams break down IT and OT silos?<\/strong><\/p>\n Chris:<\/strong> Communication. It\u2019s the only thing you can do. If you\u2019re in IT, go take a box of doughnuts down to the operators and ask, \u201cWhat are the pain points here? How can I learn more about what you do so I can understand and so you won’t slap my hand every time I say, \u2018Please patch.\u2019\u201d They will be overjoyed that someone came and visited them to learn about what they do.<\/p>\n Generally, if an IT guy with a white hard hat that has never had a scratch on it comes in, operators think, \u201cDon’t touch anything.\u201d But if you build that trust and communication, that strengthens an organization, and you can start training and knowledge sharing.<\/p>\n Natalia: What should roles and responsibilities look like?<\/strong><\/p>\n Chris:<\/strong> Now, anything that’s on a network, even in the control system environment, can report up through the chief information officer (CIO) or chief information security officer (CISO). Even in power companies, they’re putting everyone, even the folks who do SCADA for the power grid, under the CIO or CISO instead of under operations. At smaller companies, like water and wastewater, it\u2019s still the old situation, where you have an IT guy and an OT engineer or operator. At larger companies, OT is coming through the IT organization under the CIO or IT is under the CIO and operations is still under operations, and the link is under the CISO. You might have security people in IT and security people in OT.<\/p>\n If you\u2019re wondering whether the CISO should be responsible for both IT and OT security, it\u2019s a simple answer. You can’t have enterprise-wide security unless you include OT. Security needs to be applied to it all, but go to a provider that says they provide enterprise-wide security and ask, \u201cDo you know anything about OT networks in power plants?\u201d \u201cNope.\u201d OK, then, you don\u2019t do enterprise-wide security. You\u2019re not protecting what makes money.<\/p>\n Natalia: Should companies unify IT and OT security in the security operations center (SOC)?<\/strong><\/p>\n Chris:<\/strong> I’ve seen it implemented as one unified SOC, but I’ve also seen two separate ones because if they have physically separate systems, they have to have physically separate SIEMs<\/a>. For instance, a nuclear plant will have its own SOC, and corporate will have its own SOC. If a power company has a nuclear power plant, that plant will have its own SOC because it\u2019s air-gapped and not connected to the outside world or the IT network. But if you have an oil and gas environment, it may have both combined into one.<\/p>\n There are pros and cons. If you have the money and the budget and the people, you can do it either way. Just put your people in a room, give them a lunch of pizza, and let them come up with the best solution. There are advantages of having a unified SOC. You don’t even need an OT-specific SOC analyst. Just have a good IT security person learn from the control engineers or operators, and then create those alerts, and do hunting, tool tuning, and rule tuning.<\/p>\n Natalia: What would you say to a board of directors to get them to prioritize OT security?<\/strong><\/p>\n Chris:<\/strong> I\u2019d keep it short and sweet: \u201cWhat would happen if you couldn\u2019t make hammers anymore?\u201d If the CISO can’t answer that question, you know the person needs to gain that awareness. Do we have visibility of the network? Do we have offsite backups for our control systems? Do we have security awareness training?<\/p>\n Board members<\/a> are not concerned with the latest and greatest advanced persistent threat (ATP), but they do care about risk to the business. They\u2019ll say, \u201cWe don’t have any security because we don’t have enough people. If we don’t have security implemented, we have a small risk of having downtime.\u201d If you talk to any manager, they\u2019ll know exactly how much money they lose per day if production goes down. We look at business risk in terms of the equation: risk equals impact times probability. Since we don’t have enough data about cyberattacks in OT to have a probability, we tie cybersecurity to the risk register and substitute probability with exploitability. How easy is it to exploit? Can a script kiddie do it? Could my 13-year-old son do it?<\/p>\n If you’ve got an operating system exposed to the Internet, discoverable via Shodan, it is exploitable within minutes. What is the impact of that? If it’s in a chemical, pharmaceutical, food factory, or refinery, that’s a problem not just for downtime but more importantly because it could cause a safety or environmental incident. If it’s a temperature gauge, that’s much less risk. Companies will have a risk register for everything else, including natural disasters. They should have one for OT cybersecurity risk too.<\/p>\n To learn more about Microsoft Security solutions, visit our website<\/a>. Bookmark the Security blog<\/a> to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity<\/a> for the latest news and updates on cybersecurity.<\/p>\n","protected":false},"excerpt":{"rendered":" Chris Sistrunk, a Technical Manager in Mandiant\u2019s ICS\/OT Consulting practice, shares best practices to improve operational technology security.<\/p>\n","protected":false},"author":106,"featured_media":93535,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[3685,3687],"products":[3690],"threat-intelligence":[3733],"tags":[],"coauthors":[2433,2568],"class_list":["post-93534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-best-practices","topic-siem-and-xdr","topic-threat-intelligence","products-microsoft-defender","threat-intelligence-iot-ot-threats"],"yoast_head":"\nLearn more<\/h2>\n