White House Pushes for Security

Since the ransomware attack on the Colonial Pipeline last month, the US government has become more vocal on the need for industrial cybersecurity. A recent memo from the White House to corporate executives and business leaders across the country urges them to protect their companies against hackers. Among the action items is the need to segment networks, to isolate OT from II.

“It’s critically important that your corporate business functions and manufacturing/production operations are separated,” the memo states, “and that you carefully filter and limit internet access to operational networks, identify links between these networks and develop workarounds or manual controls to ensure ICS networks can be isolated and continue operating if your corporate network is compromised.”

The memo says that although the government is leading the fight against cyber attacks of all kinds, the private sector is also expected to play their part. They are urged to back up data, update systems, and test response plans and implementations. The memo also listed five best practices from the president’s Improving the Nation’s Cybersecurity Executive Order, including:

  1. Multifactor authentication
  2. Endpoint detection
  3. Response to an incursion
  4. Encryption
  5. A capable security team
Isolate Control Networks

Most of the recommendations could apply to any system or network exposed to the Internet, but the White House also included one directly related to industrial systems: Segment your networks to protect operations. Industrial control system networks, it says, should be isolated so they can continue operating even when the management network is compromised.

This was the case with the Colonial Pipeline incident last month. Although the hack caused turmoil in the company and a week of problems for the whole East Coast of the US, it could have been much worse. If the hackers had been able to take control of the pipeline itself, we might have witnessed physical damage both to property and the environment.

To avoid such problems, isolating control networks is critical. This is best accomplished using a DMZ, a “demilitarized zone” that separates control systems from management systems. Using a DMZ ensures that there is no direct link between corporate networks and control networks, and that only known and authenticated actors can enter the system at all.

Skkynet recommends using a DMZ for OT/IT networking, and provides the software needed to seamlessly pass industrial data across a DMZ-enabled connection. Most industrial protocols require opening a firewall to access the data, but Skkynet’s patented DataHub architecture keeps all inbound firewall ports closed on both the control and corporate sides, while still allowing real-time, two-way data communication through the DMZ.

We are pleased to see support for securing industrial control systems coming from the White House and US government, as well as governments and agencies throughout the industrialized world. A more secure environment will keep costs down and production running smoothly by keeping hackers out of our control systems.

Emergency at Colonial Pipeline

Another ransomware attack hit the headlines last week.  This time it’s Colonial Pipeline, the largest in the USA by some estimates, 8,850 km long, with carrying capacity of over 3 million barrels of petroleum products.  The attack has prompted the US Department of Transportation to issue an emergency declaration, easing restrictions on overland transport of supply by truck, a necessary but high-cost alternative for the company.

Colonial is wisely reluctant to release details, so we might never know exactly who did this or how it happened.  But that’s not the point.  One way or another, a malicious actor may have compromised a node on the IT network, which could have been used as a staging ground to launch an attack on the OT (Operations Technology) network.

What we do know is how to prevent that kind of attack from spreading.  There should be no need for emergency declarations.  As we have discussed previously, most people in the know―from government regulators and standards agencies to top management and on-site engineering staff―understand that you must isolate your networks.  In this age of cloud, IoT, and digital transformation, when it is becoming possible to connect everything together, we also need to implement ways to keep things separate.

A Well-Known Solution

Isolating a control network from an IT network is not difficult.  The technology has been around for decades.  It involves inserting a defensive layer, a DMZ (Demilitarized Zone) between the two networks, and using firewalls to protect them.

The challenge lies in moving production data securely across the DMZ in real time.  This is where Skkynet’s DataHub technology shines.  The DataHub can connect to equipment and SCADA systems on the industrial side, and pass that data through the DMZ to the IT side, without opening any firewall ports on either side.

We hope Colonial Pipeline recovers quickly from this emergency, and that oil and gas will soon begin to flow again up the East Coast of the USA.  Meanwhile, we encourage others to heed this wake-up call.  The attack surface of an entire company is huge.  Persistent hackers are bound to find their way in, eventually.  The best way to prevent damage to the production systems is to isolate the corporate network from the control network and insert a DMZ.  They may get that far, but no farther.

OPC Attack Surface Exposed

Industrial systems, once of little interest to hackers, are now targeted on a regular basis, making security an ever-growing concern.  At the same time, as more companies update and add to their control systems, the OPC industrial protocol continues to grow in popularity. So it would make sense to ask the question, how vulnerable to attack is an industrial system that uses OPC?

A recent white paper by Claroty, Exploring the OPC Attack Surface, discusses a number of security vulnerabilities in the products of three well-known suppliers of OPC software.  These issues, reported to the Industrial Control System Cyber Emergency Response Team (ICS-CERT), could “expose organizations to remote code execution, denial-of-service conditions on ICS devices, and information leaks,” according to the report.

The companies involved have isolated the bugs, fixed them, and issued upgrades to their software, but the underlying problem remains.  All software has bugs, and OPC software is no exception.  Every connection to the Internet risks exposing an attack surface that could be exploited.

Unforeseen requirements

Like most industrial protocols, OPC was conceived and developed before the advent of Industrie 4.0 and the Industrial IoT.  Back then, nobody seriously considered connecting their process control systems to the Internet.  All production equipment and networks were entirely disconnected (“air-gapped”) from the outside world, or at least secured behind closed firewalls.

Connecting a factory or industrial process to an IT department or cloud service introduces risk.  The design of OPC requires an open firewall port to make a connection.  Most companies are currently using workarounds to overcome this Achilles heel, but none of them are adequate.  Using a VPN simply expands the security perimeter of a control network to the outside world of phishing emails and ransomware attacks. Using an IoT gateway to connect an OPC server to a cloud service still requires connecting the plant network to the Internet in some way.

The most secure approach

Instead, the most secure way to get data from OPC servers running on a plant network is by using one or more DMZs.  According to a recent NIST report, “The most secure, manageable, and scalable control network and corporate network segregation architectures are typically based on a system with at least three zones, incorporating one or more DMZs.”

Using a DMZ makes it possible to isolate the plant from the Internet. Although OPC alone cannot connect through multiple hops across a DMZ, adding Skkynet’s DataHub technology makes it possible.  A DataHub tunnel for OPC can establish secure, real-time data flow across the connection, without opening any inbound firewall ports.  This effectively cuts the attack surface to zero.  Even if there is an undiscovered bug lurking somewhere in an OPC server, there is much less risk.  After all, hackers cannot attack what they can’t see.

NIS 2 Raises the Bar for Network Security

Key directive: One or more DMZs are needed for the most secure, manageable, and scalable segregation of control and corporate networks.

The recent adoption of a new NIS 2 Directive by the European Commission is a sign of the times.  Beset by a world-wide pandemic, many companies across the EU have turned to digital technologies to allow their workforce to stay productive, and to facilitate access to valuable production data.  This has led to unprecedented levels of industrial data being passed between company networks and across the Internet, increasing the risk of exposure to malicious intruders.

To combat the threat, the European Commission has accepted revisions to the Directive on Security of Network and Information Systems (NIS), now calling it NIS 2. Among other things, this document mandates a number of basic security elements, including standards for networking data between the production and corporate levels of a company.

The Commission has tasked ENISA, the European Union Agency for Network and Information Security, with implementing the standards.  In pursuit of this mandate, ENISA relies on the expertise of three well-known bodies, NIST, ISO, and ISA to provide detailed descriptions of how network security should be implemented, as published in its Mapping of OES Security Requirements to Specific Sectors document.

Using DMZs

For example, the recommended way to bring process data into the corporate office is summed up in NIST document SP-800-82.  It says: “The most secure, manageable, and scalable control network and corporate network segregation architectures are typically based on a system with at least three zones, incorporating one or more DMZs.”

These three zones are the control zone (OT), the corporate zone (IT), and the DMZ itself.  The document describes the value and use of firewalls to separate these zones, and to ensure that only the correct data passes from one to the other. Using a DMZ ensures that there is no direct link between corporate networks and control networks, and that only known and authenticated actors can enter the system at all.

Skkynet recommends using a DMZ for OT/IT networking, and provides the software needed to seamlessly pass industrial data across a DMZ-enabled connection.  Most industrial protocols require opening a firewall to access the data, but Skkynet’s patented DataHub architecture keeps all inbound firewall ports closed on both the control and corporate sides, while still allowing real-time, two-way data communication through the DMZ.

Unlike MQTT, which cannot reliably daisy-chain connections across the three zones as ENISA recommends, the DataHub maintains a complete copy of the data and connection status from the source to final destination.  Thus, it provides accurate indicators of data reliability at each zone in the system, along with making the data itself available.

We applaud the European Commission for its no-nonsense stance on cybersecurity with NIS 2, and encourage all EU members, indeed any company expanding its use of corporate networking, Industrie 4.0, or Industrial IoT technologies to adhere closely to the guidance of ENISA, and to implement three-zone security using one or more DMZs.

A Sustainable Future

After a year of uncertainty, confusion, and disruption, suddenly people are talking about sustainability.  Public opinion, government policy, and economic realities seem to be converging on this theme, pushing us towards creating a more sustainable future.  The pandemic has underscored the need for us to be more effective and resilient in many ways.  For industry, this points to digitization.

At a recent AVEVA World Digital event, Craig Hayman, AVEVA CEO said, “As business leaders, it’s our duty to go further and faster than we believed possible to realize a sustainable future through digital transformation.”  Summing it up, he calls this the “Decade to Deliver.”

He is talking about delivering on the promises of Industrial IoT, of Industrie 4.0, and digitization.  We are at a critical juncture.  Many people are looking for jobs, and there is lots of work to be done.  Thankfully, we have developed the necessary technologies, ready for use.

Staying connected

“Covid-19 is a massive catalyzer of digital adoption, because people want to be more efficient, we want to be more resilient. Therefore, things have to be connected, ” said Jean-Pascal Tricoire, Chairman and CEO of Schneider Electric, in that same on-line conference.  “We want to operate things from remote, to enforce social distancing. ”

The need is there, and so are the resources.  “All of this has been accelerated, ” continued Tricoire, “by the massive recovery packages like no other in history, put in place by countries, and a large part of those are about digital and green.  Because countries have understood that you can’t dissociate a step-change to sustainability from digitization. ”

In the AVEVA World Digital presentations, the links from digital to sustainable were made clear through example after example.  Emerging technologies for carbon capture, plant optimization, circular systems, remote access, solar parks, wind farms, decentralized power grids, and more―all rely heavily on digitized data communications.  Since most CO2 emissions come from industry, transportation, and buildings, securely connecting them in real time to IT platforms empowered by AI promises to make them greener and more sustainable.

The Great Acceleration

Mike Walsh, futurist, author, and CEO of Tomorrow explained how the pandemic has opened new opportunities.  It has unleashed, in his words, “the great acceleration. ”  We are now living a full decade ahead of the predictions, he says, in a space that we could only imagine twelve months ago. He sees three rules in play:

  1. It is no longer “digital disruption, ” now it’s digital delivery. We are all disruptors now. If you are not a digital business, you are no longer in business.
  2. There is no such thing as “remote work”, just work. Each of us has more mobility and autonomy than ever before, and that will require documenting our decision-making, relying on data, and acting on it more quickly.
  3. AI will not destroy jobs, but it will change them. Rather than doing work, we will be increasingly called upon to design work. We will need to bring more of our humanity to the table.

Who would have guessed that a global pandemic would accelerate a need for digitization?  Whatever the reason, all this digital data needs to be connected, and this is where Skkynet shines.  We have the tools and experience to meet current and future demand for the secure, real-time data communications used in remote access and the convergence of OT, IT and the cloud.  We are playing our part to help ensure a more sustainable future for industry and for the planet.

Embracing Automation in Tough Times

What do a car-parts maker in Germany, a chemical plant in Singapore, a mine in Latin America, and the American health-care industry have in common?  Due to the global pandemic, all of them are automating their systems more than ever before.

A recent article in The Economist, Bearing fruit: After years of dithering companies are embracing automation, recounts how the pandemic has pushed many companies to take the plunge and automate their plants, warehouses, and internal systems.  Sales of robots have doubled for some popular models, and remote connectivity has gone from luxury to necessity.

“Bosses have boasted of automating their operations for years without an awful lot to show for it,” the article says. “Covid-19 has spurred them to put their money where their mouths are.”

Automation goals are changing

The fact that this is a pandemic-driven response is illustrated in a Bain Automation Survey of 500 companies, showing that goals for automation have changed dramatically.  Before the pandemic, the leading reasons for automating were to lower costs, increase performance, and grow revenue.  Since the pandemic, improving business resilience, lowering risk, and generating business insights are at the top of the list.

Projected adoption rates have doubled for sensors, Internet of Things (IoT) connectivity, and Artificial Intelligence (AI), according to another survey of 1001 supply-chain professionals.  A third survey quoted in the Economist article shows that a full 80% of companies surveyed had accelerated their adoption of digital employee interaction and collaboration.

Beyond automation, and expected to be even a bigger wave, is the resulting data, and how it gets used. The article says, “The pandemic’s bigger long-term impact may be a fuller embrace by firms of data their operations generate, and predictive algorithms to help guide real-time decisions.”   Major automation companies like ABB, Emerson, and Rockwell are racing against smaller start-ups and consultants to turn the real-time and archived data from their systems into actionable intelligence.  The resulting efficiencies have led to a prediction from Allied Market Research that process-automation product sales will rise from $1.6 billion two years ago to just under $20 billion by 2027.

Connecting the data

All this data must be connected.  Data from the sensors, devices, and automation systems on the plant floor has to be connected securely, in real time, to the managers, analysts and decision-making executives in corporate HQs.  Factories spread across the globe need to share data seamlessly and securely.  Workers staying at home require remote access to processes in the field.  For all of this to work, robust data communication is crucial.

This explains why, despite the pandemic and economic slowdowns in major world economies, our customers have been hard at work building and expanding their systems.  Management in these companies are embracing automation, as a hedge against uncertainty and an investment in data-driven solutions.  Our job is to ensure that they get the data they need, easily, rapidly, and securely.