Building a Resilient World:
The ISAGCA Blog

Welcome to the official blog of the ISA Global Cybersecurity Alliance (ISAGCA).

This blog covers topics on automation cybersecurity such as risk assessment, compliance, educational resources, and how to leverage the ISA/IEC 62443 series of standards.

All Posts

Cybersecurity and Safety: Increasing Risks and Escalating Impacts

For the general public, cyberattacks causing catastrophic damage and loss of life are still thought of as only “real” within the sci-fi genre—movies, books, television series, and video games. But the truth is, cyberattacks with dire consequences no longer live merely in film, or in the digital realm for that matter. They’ve transcended into the physical world with real, tangible impacts.

And perhaps for the first time, a cyberattack has also resulted in the loss of human life.

When Cyberattacks Have Physical Repercussions

On September 10, 2020, a hospital in Germany fell victim to a ransomware attack that encrypted 30 servers, severely disrupting its internal IT systems and operations. Functioning with only limited phone and email communications, the hospital announced it had “deregistered from emergency care” and would postpone all planned and outpatient treatments due to its “extensive IT failure.”

As a result, inbound hospital traffic was redirected to other hospitals. In one situation, a patient with a life-threatening condition was detoured an hour to another hospital, dying shortly after arrival.

“If the ransomware attack did indeed lead to a patient’s death, however indirectly, the incident could go down in history as a first of its kind.”

- Fortune, Ransomware attack on a hospital may be first ever to cause a death

According to AP, the hospital’s systems were infected and disrupted for a week before gradually crashing to a halt. Upon investigation, authorities identified the attackers exploited a known Citrix vulnerability and found a ransomware note in one of the 30 encrypted servers. However, the message was addressed to a university, not the hospital.

German authorities contacted the adversaries, explaining their target was, in fact, not a university but a hospital and was endangering patient lives; the attackers withdrew the ransom and provided the decryption key.

Among other charges, German prosecutors are investigating negligent manslaughter or homicide due to the patient’s death that was rerouted and received medical care an hour later than would have otherwise been necessary.

From Ransomware’s Financial Gain to Personal Liability and Homicide

Many have drawn the line between cybersecurity and safety in commercial operations, and this latest cyber incident reinforces that parallel.

Environment, health, and safety (EHS) practices are far more mature than cybersecurity. In the United States, for example, Occupational Safety and Health Administration (OSHA) has numerous regulations as well as reporting requirements, audits, citations, and fines to regulate employer practices and help ensure the health and safety of employees and the environment. The OSH Act further expanded OSHA’s available recourses, empowering them to bring criminal charges against employers that violate or neglect their responsibilities. On top of the OSH Act, OSHA is also working with the Department of Justice to refer safety violations to local district attorneys for prosecution.

As cyberattacks cross into the physical world, consequences of these attacks are also escalating—both for victims and perpetrators. Just like safety. While there are numerous cases of employers facing steep fines and jail time for failing to comply with EHS protocols, there are few cyber incident cases. This recent case might be the first incident to result in death and a negligent homicide investigation, but the stakes for cybersecurity are increasing across the board.

By 2024, 75% of CEOs will be personally liable for cyber-physical security incidents, according to a new Gartner report. By 2023, the financial impact of a cyber-physical attack resulting in fatalities is expected to reach over $1 billion dollars. The ramifications of a cyber-physical incident are far-reaching, similar to safety. Gartner states, “Even without taking the actual value of a human life into the equation, the costs for organizations in terms of compensation, litigation, insurance, regulatory fines and reputation loss will be significant.”

“…incidents in the digital world will have a much greater effect in the physical world as risks, threats and vulnerabilities now exist in a bidirectional, cyber-physical spectrum.”

- Gartner

Cybersecurity regulations, especially for cyber-physical systems, are in their early stages for most industry sectors. But there are fines to date, and they aren’t small.

The North American Electric Reliability Corporation (NERC) regulates and enforces cyber and physical security (through the Critical Infrastructure Protection, CIP, standards) for the U.S. bulk power grid. As of 2019, the largest single NERC-CIP related fine was $10 million against an unidentified utility with over 120 security violations over four years.

Pacific Gas and Electric (PG&E) previously held the largest NERC-CIP fine of $2.7 million in 2018. The company has also incurred over $30 billion in legal damages due to its negligence in the California wildfires.

Cybersecurity is still a relatively new discipline. But if lessons can be learned from safety practices, the stakes for cybersecurity and costs of cyber incidents will continue to rise. And rightly so.

Protecting Today’s Cyber-Physical World

As technology has helped increase efficiency, efficacy, and many times, safety, over the last several decades, it has also slowly blurred the cyber and physical lines. Today, the majority of these cyber-physical systems rely on operational technology (OT), and OT is notorious for being unsecure and a target for cyber adversaries. So, what can organizations do to protect their operations?

In operational environments where 24/7 availability and uptime are crucial, patching vulnerabilities is often arduous. But unpatched assets leave operations exposed and vulnerable to attack, as was the case for the German hospital ransomware incident.

Attackers in the German hospital cyber incident exploited a known Citrix vulnerability, the Citrix ADC CVE-2019-19781 vulnerability. Citrix had previously released a patch for the vulnerability in January of this year. But the hospital isn’t alone. Luxottica, who designs, manufacturers, and sells luxury and sport eyewear, also fell victim to a ransomware attack exploiting the same Citrix vulnerability during the same week. For Luxottica, the attack resulted in downed online properties and disruption to their production chain.

Compounding the effect of lacks patch management, many of these environments operate in flat or unsegmented networks, which puts them at greater risk. For example, a breach in the email system can traverse to critical systems like chemical compound processes in pharmaceuticals or ballast operations in maritime. As Paul Arceneaux of Mission Secure states in a previous blog post, “With perimeter-only protection, once an adversary gains access, nothing prevents them from traversing the network unchallenged. Segmentation and micro-segmentation stop unbridled access in IT environments and should be doing the same in ICS environments.” Organizations need to segment their networks and start implementing a zero-trust model of security. In establishing segmentation, organizations can also “virtually” patch their systems by monitoring and controlling access to each asset in real time, further reducing risks and the likelihood of a cyber incident.

Today, there are few industries that don’t leverage cyber-physical systems. Cyber-physical operations permeate nearly every part of our lives, from the food we eat and the medicine we take to the energy that powers our lights and the lights that manage traffic flow. Even building and facility management utilize cyber-physical technologies like security controls and smart HVAC systems.

Cybersecurity is no longer only safeguarding personal data and intellectual property—it is protecting vast, complex operations that impact everyday life and each individual’s lives throughout society. As Gartner states, “A focus on ORM—or operational resilience management—beyond information-centric cybersecurity is sorely needed.”

“A focus on ORM—or operational resilience management—beyond information-centric cybersecurity is sorely needed.”

- Gartner

 

Interested in reading more articles like this? Subscribe to the ISAGCA blog and receive weekly emails with links to the latest thought leadership, tips, research, and other insights from automation cybersecurity leaders.

Mark Baggett, Mission Secure
Mark Baggett, Mission Secure
With 30 years of experience, Mark Baggett is an industry veteran and industrial control systems (ICS) expert. His expertise stems from the energy sector where Mark has designed, engineered, and implemented control systems for the industry’s most prominent players, including BP, Total, Shell, Exxon, and ConocoPhillips. Mark’s experience spans the globe with projects across Asia-Pacific, Europe, and North America. As VP of ICS at Mission Secure, Mark leverages his expertise to help operations assess current systems, providing guidance and recommendations to mitigate cyber risks and implement a secure cyber architecture. Mark’s managed cybersecurity projects for oil rigs, refineries, pipelines, manufacturing plants, and chemical facilities.

Routinely invited to speak on operational technology (OT) cybersecurity, Mark recently presented in and co-chaired the cybersecurity session at the American Institute of Chemical Engineers’ 2020 Spring Meeting and Global Congress on Process Safety. Previous engagements include the American Petroleum Institute’s Annual Cybersecurity Conference for the Oil & Natural Gas Industry, a U.S. Homeland Security/FBI joint taskforce meeting, and the fall U.S. ICS Joint Working Group (ICSJWG), among others. Mark holds a bachelor’s degree in Secondary Education and frequently teaches control system training courses at San Jacinto College located in Pasadena and Houston, Texas.

Related Posts

Cybersecurity Investment Tax Credits

Cyberattacks continue to grow worldwide, which has increased awareness and concern about utilities, indus...
Bill Lydon Nov 30, 2021 5:30:00 AM

IEC Designates ISA/IEC 62443 as a Horizontal Standard

The International Society of Automation (ISA) and the ISA Global Cybersecurity Alliance (ISAGCA) are prou...
Steven Aliano Nov 23, 2021 5:30:00 AM

Architecture vs. Design

Many Operational Technology (OT) projects start with identifying the requirements and then diving straigh...
Achal Lekhi Nov 16, 2021 5:30:00 AM