Industrial Control System Security: Getting a Grip on OT Cyber Security
- LANGUAGE: English DATE: Thursday, March 05, 2015 TIME: 4:00pm CET, 10:00am EST, 7:00am PST
Common Problems and Unique Challenges of Protecting OT networks in Critical and Non-Critical Infrastructures
Are your operational technology (OT) networks hosting Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems, well secured? For many organizations, the answer is still “no”. Information security generally focuses on Information Technology (IT) networks and systems, not on the OT systems used in manufacturing, utilities and critical industrial infrastructures.
What makes ICS systems so difficult to secure? Although these systems suffer the same security issues as any other networks, such as outdated software, inadequate patch management and malware attacks, there are other factors that traditional IT security solutions are not yet able to address. This includes both technical issues such as securing proprietary programmable logic controllers and business requirements such as ensuring industrial process safety and reliability.
Historically, industrial control systems have been a very separate area of the software development market, with their own business drivers, requirements and regulations, and were never designed with security in mind. For decades, these systems were based on proprietary hardware, software, network protocols and were largely isolated from corporate networks. This has changed. In the 1990’s, many control systems switched to commodity computer, networking and even software components, and control networks were widely interconnected with corporate networks to realize cost savings and productivity improvements. 20 years later, most organizations are still struggling with the security implications of this shift.
The consequences of current-day industrial cyber security are adding up. Very recently, a German government report explained how a blast furnace at a steel mill suffered serious damage as a result of a cyber attack. Many authorities are warning that even low-tech “erase the control system hard drives” types of attacks could cripple manufacturing, utilities and other infrastructures for long periods of time. And more sophisticated attacks are possible.
In this KuppingerCole webinar, you will learn about:
- How IT cyber security is similar to OT cyber security, and how they differ
- Common and specific security challenges for OT networks
- Security solutions for protecting OT networks and systems
- Unidirectional Security Gateways: hardware-enforced protection for OT network perimeters
In the first part of the webinar, Martin Kuppinger, founder and principal analyst and Alexei Balaganski, senior analyst at KuppingerCole, introduce to the field of industrial network security. They look at security challenges that the industry is facing, both common to all areas of information security and the challenges unique to industrial networks and critical infrastructures. Finally, they outline the ways current IT trends will shape the future ICS security solutions and discuss the possibility of convergence between traditional and industrial network security.
In the second part of the webinar, Andrew Ginter, VP Industrial Security at Waterfall Security Solutions presents deeper insights into specific industrial security challenges that traditional IT security products cannot reliably address. He introduces the concept of a Unidirectional Security Gateway, a hardware-enforced network perimeter protection able to safely and reliably integrate IT and OT networks without the complexity and vulnerabilities that always accompany firewall deployments.
For traditional or Business-to-Employee (B2E) IAM, HR departments are responsible for gathering documentation from employees to determine their suitability for employment. For Business-to-Consumer (B2C) or CIAM, identity proofing can be more difficult. Depending on the nature of the business, the attributes that need to be collected and verified can differ widely. For example, Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations govern the kinds of attributes and authoritative attributes that must be collected in the finance industry.
At the Consumer Identity World you learn how to balance the user experience, privacy, and security of your connected customer and how to enhance the customers' journey by leveraging Artificial Intelligence (AI) and Machine Learning (ML) to provide a superior and customized experience.