Recent cybersecurity incidents have demonstrated the process control industry's low tolerance for threats and its inability to maintain adequate defenses. For example, in March of this year, Norsk Hydro, one of the world's largest aluminum suppliers, suffered a "large-scale cyberattack" on multiple plants in Europe and the Americas, impacting operations across several business regions and causing its global computer network to crash. The attack was carried out by LockerGoga, a relatively new ransomware malware that encrypts all files on the target computer and then demands ransom, similar to other ransomware attacks.
Unfortunately, everyday realities often become major obstacles to performing security tasks, including limitations on the number of cybersecurity personnel and the need for older equipment requiring various security patches. The good news is that risk management software can help automate security monitoring, checking for correct server backup installations or reporting risk scores.
DCS system upgrade
A large European oil refinery enhanced its cybersecurity capabilities by transitioning from a proprietary distributed control system (DCS) technology to a modern DCS running Microsoft Windows. The enterprise's IT and field managers recognized the need to do more to understand and address potential cybersecurity vulnerabilities. Any steps toward automation and standardization across platforms require associated risk management, and the enterprise needs to consider security at every stage of the migration.
The first decision was to minimize manual workflows as much as possible. This included checking all endpoints for potential network vulnerabilities, such as outdated patches or missing antivirus updates. In the past, allocating staff resources to this time-consuming task could have cost businesses hundreds of thousands of dollars. In addition to reducing costs, the new system's ability to standardize and automate endpoint checks helps eliminate human error, increases the frequency of security checks, and allows for the measurement and improvement of key metrics through consistent data collection.
This refinery possesses critical infrastructure and requires compliance with IEC 62243SL3 security assurance standards. Therefore, the company needs to enhance its cybersecurity posture awareness, make it easier to forward system logs (message recording protocols) to the security information and event management system, and integrate risk management with existing dashboards.
The company partnered with a leading global industrial cybersecurity provider to conduct a network architecture assessment to identify potential gaps and support network growth in a secure and sustainable manner. Planning over a five-year timeframe allowed the team to consider the near-term impacts on the architecture, such as the need to add wireless connectivity or expand infrastructure. Furthermore, the architecture could be planned to meet compliance requirements based on security information and incident management requirements and dashboard access views.
DCS automation upgrades include cybersecurity system assessments to identify key requirements for a secure migration to the new system. This involves the expertise of operations engineering consultants and industrial cybersecurity specialists. These experts leverage insights from other organizations to provide the refinery team with objective data that they can use to define scope, develop budgets, and prioritize risk mitigation efforts.
Automated risk management can provide enterprises with much-needed risk visibility and actionability across industrial control system (ICS) networks. (Image credit: Honeywell)
Risk management software
To improve visibility and enhance the management of cybersecurity risks, the refinery opted to implement risk management software. This includes 24/7 automated monitoring of key risk indicators across networks, endpoints, and other security factors.
The refinery's automation team identified critical cybersecurity vulnerabilities from the pilot phase, including unused ports, inconsistent backups, and outdated security patches. Risk management software provided staff with a consistent way to measure, monitor, and manage cybersecurity risks on-site without human intervention. The software dashboard highlighted potential issues to help staff protect hundreds of endpoints. It also provided updates on patches, network security, and backup status. This enabled staff to respond to potential threats more quickly, thereby improving site security.
In addition to increased efficiency, the implementation also brought benefits to personnel and processes. For example, companies need to discuss risk appetite and then reach a consensus on defined risk thresholds. Because the software characterizes algorithmic scoring relative to risk as part of the monitoring function, it simplifies visibility into the security situation.
The ExperionPKS solution's dashboard highlights potential issues to help staff protect hundreds of endpoints.
Because employees see the necessary steps to take, their skills and efficiency improve, enabling them to reduce the risk of specific priority matters and even lower the priority of monitored assets. Even non-security personnel are able to follow recommendations and influence risk scores.
From an execution perspective, automated cyber risk management provides businesses with much-needed risk visibility and actionability within Industrial Control Systems (ICS) networks. At the operational level, engineers can identify and resolve operational technology (OT) compliance and performance issues before they become news. Any investment in automating, standardizing, and improving risk management will have significant business implications for businesses before cybersecurity incidents truly impact their bottom line.
