Emergency at Colonial Pipeline
Another ransomware attack hit the headlines last week. This time it’s Colonial Pipeline, the largest in the USA by some estimates, 8,850 km long, with carrying capacity of over 3 million barrels of petroleum products. The attack has prompted the US Department of Transportation to issue an emergency declaration, easing restrictions on overland transport of supply by truck, a necessary but high-cost alternative for the company.
Colonial is wisely reluctant to release details, so we might never know exactly who did this or how it happened. But that’s not the point. One way or another, a malicious actor may have compromised a node on the IT network, which could have been used as a staging ground to launch an attack on the OT (Operations Technology) network.
What we do know is how to prevent that kind of attack from spreading. There should be no need for emergency declarations. As we have discussed previously, most people in the know―from government regulators and standards agencies to top management and on-site engineering staff―understand that you must isolate your networks. In this age of cloud, IoT, and digital transformation, when it is becoming possible to connect everything together, we also need to implement ways to keep things separate.
A Well-Known Solution
Isolating a control network from an IT network is not difficult. The technology has been around for decades. It involves inserting a defensive layer, a DMZ (Demilitarized Zone) between the two networks, and using firewalls to protect them.
The challenge lies in moving production data securely across the DMZ in real time. This is where Skkynet’s DataHub technology shines. The DataHub can connect to equipment and SCADA systems on the industrial side, and pass that data through the DMZ to the IT side, without opening any firewall ports on either side.
We hope Colonial Pipeline recovers quickly from this emergency, and that oil and gas will soon begin to flow again up the East Coast of the USA. Meanwhile, we encourage others to heed this wake-up call. The attack surface of an entire company is huge. Persistent hackers are bound to find their way in, eventually. The best way to prevent damage to the production systems is to isolate the corporate network from the control network and insert a DMZ. They may get that far, but no farther.
