Building a Resilient World:

Welcome to the official blog of the ISA Global Cybersecurity Alliance (ISAGCA).

This blog covers topics on automation cybersecurity such as risk assessment, compliance, educational resources, and how to leverage the ISA/IEC 62443 series of standards.

The material and information contained on this website is for general information purposes only. ISAGCA blog posts may be authored by ISA staff and guest authors from the cybersecurity community. Views and opinions expressed by a guest author are solely their own, and do not necessarily represent those of ISA. Posts made by guest authors have been subject to peer review.

All Posts

Fortifying Your Security Arsenal: A Strategic Approach to Safeguarding OT Security Assets from Adversarial Threats


Despite investing significant budgets and resources in security products and services. The common response is inconclusiveleading us to focus on incident response and system recovery as our primary objectives. 

Why Do Attackers Target Security Systems First?

To address this question, one must comprehend the situation through a thorough investigation processparticularly when substantial funds are allocated to security measures. Let's explore two concepts for a better understanding. First, consider the analogy of armies in a real war attempting to strike each other's critical infrastructure. They need to neutralize the defense ability first to proceed with hitting the critical infrastructure successfully.

Similarly, in cyberattacks, hackers aim to compromise security systems initially to ensure the overall success of their subsequent attacks. Secondly, in the Operational Technology (OT) environment, security products are often configured not to disrupt OT operations. This reduction in security measures may introduce vulnerabilities, making it easier for attackers to compromise the system compared to traditional IT systems.

The answer lies in understanding concepts like these: attackers target our security measures first to ensure the success of the entire attack. In our OT environment, where security products are customized, vulnerabilities may arise due to the need for adjustments that do not interfere with operations. Consequently, attackers find it easier to exploit these security weaknesses compared to other systems like IT.

The response to the challenging question from management can be summarized as follows: the initial answer lies in our security measures, where significant investments are made. Let's delve into the Adversary Tactics, Techniques, and Procedures (TTP) to understand how they target security measures and penetrate these layers. Subsequently, we'll provide solutions to safeguard our security measures from adversaries.

Adversaries' Tactics and Techniques

In the current landscape, adversaries employ various methods to target and bypass security products and services such as firewalls, IDS, IPS, and antivirus. These methods can be broadly categorized into three groups:

  • Bypassing Tactics: Attackers manipulate network connections to penetrate security products like firewalls without detection. Techniques include packet rebuilding, network protocol exploitation, and session encryption. Detection requires advanced measures like Security Operations Center (SOC) monitoring.

Scenario: Attackers use packet rebuilding to conceal attacks within seemingly legitimate packets, making it challenging for firewalls to identify malicious activities.

  • Exploitation of System and Software Vulnerabilities: Traditional attacks target programming errors in security products and services, exploiting common operating systems, firmware, or software vulnerabilities.

Scenario: Attackers exploit vulnerabilities in edge firewalls facing the internet, ensuring their attacks pass through undetected.

  • Input and Output Manipulation: This method focuses on misconfigurations in security products and services. Attackers exploit these misconfigurations to custom-tailor attacks, testing and playing with input for applications.

Scenario: Attackers test firewall policies for misconfigurations, using loopholes in network policies to facilitate scanning methods and successful attacks.

How to Enhance Your Security Strategies:

Understanding why attackers target security capabilities and the common methods used, we now need a strategic approach to mitigate these risks. ISA/IEC 62443 standards provide a foundation for security concepts, fundamental requirements, and system and component requirements. By following these standards (e.g., 62443-2-1, 62443-3-3, and 62443-4-1), you can apply them across different industries and sectors, addressing unique challenges.

It's crucial to recognize that cybersecurity standards and frameworks serve as baselines for your cybersecurity program. While they aid in compliance, breaches often surpass these guidelines and budgets.

To reinforce your security mindset, consider security products as any software or hardware in your possession. Understand that these products, while providing security services, are vulnerable. Approach security products with extra focus during risk assessments and audits, subjecting them to rigorous testing such as vulnerability assessments and penetration testing. This proactive approach reduces the likelihood of security products becoming the weak link in your organization.

For example, implement IEC 62442-3-2 risk assessment specifically for security systems and architecture in OT systems. This focused risk assessment provides insights into security capabilities, allowing you to identify and address risks effectively. Keep in mind that additional budget and resources may be required for such assessments.


When dealing with organizational assetsprioritize testing security products and services thoroughly. Develop a robust security testing plan, as these products are the primary targets for attackers. Regardless of the budget allocated to these products, vulnerabilities persist. One vulnerability in these products could serve as an entry point for multiple attacks on your OT system.

Embrace a mindset shift within your organization, recognizing that handling security assets requires special attention. Implementing security-focused risk assessments for security systems ensures a proactive approach without conflicting with broader OT system risk assessments. While these standards and frameworks provide a starting point, enhancing your security capabilities against advanced attackers targeting your OT system requires a change in mindset.

Mohannad AlRasan
Mohannad AlRasan
Mohannad AlRasan is formerly a cybersecurity consultant at Schneider Electric, specializing in control systems for oil, gas, and petrochemical industries. Certified in cybersecurity and networking standards, including IEC 62443 CFS, GICA GCIA, GMON, CompTIA Network+, Security+, PenTest+, CNVP, and CCNA. Currently engaged in research on AI integration in cybersecurity for IT and OT.

Related Posts

AI and Machine Learning in Automation: The Security Imperative

As artificial intelligence (AI) and machine learning (ML) continue to revolutionize industrial automation...
Vaibhav Malik Jul 12, 2024 7:00:00 AM

Top ISAGCA Blog Posts of 2024 (So Far)

Here on the official blog of the ISA Global Cybersecurity Alliance (ISAGCA), we're dedicated to sharing i...
Kara Phelps Jul 5, 2024 7:00:00 AM

Importance and Challenges of OT Patching in Line with ISA/IEC 62443-2-3

In the realm of Industrial Automation and Control Systems (IACS), effective patch management is critical,...
Muhammad Musbah Jun 28, 2024 11:00:00 AM