Daily headlines evidence that critical national infrastructure organizations face unprecedented cyber challenges, with the last 12 months particularly brutal as cyber defences fell. In February this year KP Foods was forced to cease operations after also falling victim to a ransomware attack. In May this year, agricultural equipment giant AGCO says its business operations had been impacted after falling victim to a ransomware attack. And the organization itself doesn\u2019t have to be affected as a cyberattack on a supplier can be just as damaging as Toyota experienced in March this year when it had to stop production following a cyberattack against Kojima Industries that supplies it with plastic parts and electronic components.<\/p>\n
These incidents are not isolated and the threat is increasing. In fact, speaking at a cybersecurity conference, Infosecurity Europe, at the end of June [2022] Marsha Quallo-Wright, deputy director for critical national infrastructure at the National Cyber Security Centre (NCSC), said that the impact of a ransomware attack to critical infrastructure means that this attack vector is \u201cpotentially as harmful as state-sponsored attacks.\u201d Of course, it\u2019s not just ransomware that poses a threat as highlighted by the Department for Digital, Culture, Media & Sport (DCMS). In its policy paper titled \u20182022 cyber security incentives and regulation review\u2019 it said: \u2018For every highly sophisticated hostile state attack such as SolarWinds, there are hundreds of low-level phishing, denial of service, and ransomware attacks.\u2019<\/p>\n
How can critical infrastructure operators adequately defend themselves from these persistent threats?<\/p>\n
Connectivity introduces risks<\/b>
\nToday\u2019s economic background has driven the need for efficiency and resiliency, resulting in massive transformation and an increased reliance on technical automation and connectivity. As illustration, when we consider food production, this is a highly competitive sector where cost is a dominating factor and waste can cripple a business. For the automotive industry, the drive to move from fossil fuels to more sustainable and green power is forcing innovation and a redesign of production lines.<\/p>\n
![\"\"](\"https:\/\/manufacturing-today.com\/wp-content\/uploads\/sites\/4\/2022\/08\/Cyber-203b.png\")
To enable this evolution requires digital transformation to create new business models and ecosystems, deliver new products and services and operate more efficiently in the digital economy. Critical infrastructure typically relies upon operational technology (OT) used to control physical devices. However these systems are increasingly connected and even controlled by IT systems.<\/p>\n
Physical devices and systems of all types – from corporate conference systems to power grids – are now network connected and programmable. New digital compute platforms and development shifts such as cloud, mobile, SaaS and DevOps have made it possible to move from concept to capability on a daily basis.<\/p>\n
While digital transformation delivers immense benefits, it also hugely expands the attack surface organizations have to defend. And attackers have capitalized on these converged networks to move laterally from one system to another, making the compromise of just one device dangerous with an attack on an IT system rendering OT systems inoperable.<\/p>\n
Addressing attack paths<\/b>
\nThe harsh truth is that the vast majority of attacks are preventable. Threat actors rely on leveraging unpatched, legacy vulnerabilities across a wide spectrum of software solutions to infiltrate organizations. In the case of ransomware, research from Tenable\u2019s Security Response Team determined that over 30 known but unpatched vulnerabilities were leveraged by Conti (a ransomware gang) and its affiliates alone. Addressing these flaws would dramatically reduce the number of attack paths threat actors can exploit.<\/p>\n
To do this requires a holistic view of both IT and OT environments, the interdependencies that exist for critical functionality, and determine where weaknesses and vulnerabilities exist. When it comes to our physical OT environments, there are a myriad of hidden systems, tucked away in a closet or hidden under a desk, that were temporarily installed, promptly forgotten, and left under protected.<\/p>\n
Once a holistic viewpoint is established, the next step is to identify what would cause theoretical versus practical damage. From this stance steps can be taken to remediate the risks where possible, or monitor the assets related to the risk for deviations, to nullify attacks.<\/p>\n
Knowing where to start can seem insurmountable, but there are a number of resources at hand. The UK\u2019s NCSC published a joint cybersecurity advisory (CSA) with key cyber agencies in Australia, Canada, New Zealand and the United States that underscores a key trend regarding the most routinely exploited vulnerabilities.<\/p>\n
The reason advisories and guidance are vital for organizations is it provides strong intelligence about which threats bad actors are actively exploiting.<\/p>\n
If organizations fix these flaws, the vast majority of attack paths will be closed off, preventing compromise, malware infiltration and\/or exfiltration of data. You can\u2019t operate with your eyes closed!<\/p>\n
![\"\"](\"https:\/\/manufacturing-today.com\/wp-content\/uploads\/sites\/4\/2022\/08\/Bernard-Montel.png\")
<\/b><\/p>\n