Security During a Pandemic
Back in March of this year, Newsweek Vantage published a special report on industrial cybersecurity titled Weathering the Perfect Storm. No sooner had it been released than we were broadsided by the COVID-19 crisis. In response, Newsweek editor Nigel Holloway sat down to discuss this new challenge with the two main contributors to the article: Eric Cosman, President of the International Society of Automation (ISA), and Steve Mustard, an ISA executive board member.
Their insights on industrial cybersecurity during the pandemic were recorded, and are available on the ISA website. Here are some of the highlights:
Both Cosman and Mustard agree that you need to prepare for the unexpected, even though it is difficult to imagine what that might be. Having so many more people working remotely during this pandemic is probably leading to more cyber vulnerabilities. Adversaries are going to try to exploit these weaknesses, and the quick, easy solution is not always the most secure. In any case, now is the time to act.
Security – robust yet invisible
Increasing security can add friction, and people often look for creative ways to get around it. “Convenience is at the other end of the scale to security,” said Mustard. Cosman suggests: “We need to find ways to make security robust, yet almost invisible….The theme that goes through all of this is to integrate security into your work processes in such a way that is not seen as something that’s added on.”
IT and OT working together?
Another challenge is the difference between IT and OT (Operations Technology) cultures. Both are running mission critical systems, but while IT thrives on change, OT shuns it. You can’t be updating an industrial system every few hours or playing what-if scenarios on a running production line. What Mustard and Cosman suggest is to form a team of experts from both IT and OT, the “right people with the right skills and the right experience, who have the right understanding, irrespective of what organization they may come from.”
The right tools
To this we would add: Give these people the right tools. At the heart of the security issue is providing secure access to OT system data. Much of the exposure for remote access comes from using IT technologies like VPNs in environments and scenarios they were not created for. Other risks stem from using industrial protocols not designed for open networks like the Internet.
That’s why we offer data communication tools that are secure by design. Industrial users should not have to compromise—either on security or convenience. For our large and growing customer base, frictionless, secure access to their industrial data provided by the DataHub is a normal daily experience. Their plants and production lines are linked in real time, they monitor their systems securely from remote locations, and they can send control commands as needed. When the COVID-19 pandemic hit, they simply kept on working, keeping their staff safe and their mission-critical processes secure.
