There is no doubt that the ongoing pandemic has forced us to rethink our cybersecurity programs and planning. In recent months, we’ve seen several industrial companies that have unfortunately learned a difficult lesson from not applying proper cybersecurity controls to protect their industrial control system (ICS) networks. To help others reconsider their cybersecurity posture, I thought it might be useful to share some of my experiences and learnings in implementing industrial cybersecurity with critical infrastructure around the world. You’ll see that there are some obvious mistakes to avoid, but sadly many end-users are not aware of them. I want to help change that!
During my time as a control systems engineer and automation systems migration leader at customer sites, I worked to solve critical situations including loss of view, loss of control, or both at once. Such situations, if not handled properly, might lead to total plant shutdown and production loss. Generally, there is a predefined timeframe within which the critical issue must be resolved, based on the factory design, type of operation, and capability to handle operations manually at the site level. If these timeframes cannot be met, the operator should opt for emergency operational shutdown. These decisions directly affect production and revenue. Under such pressure, I have witnessed how different groups behave.
The most common behavior in this situation was allowing temporary insecure actions of bypassing standard physical or cybersecurity controls to maintain production levels and avoid revenue loss until the issue was resolved. In my opinion, the top five insecure actions around cybersecurity are:
I have also seen service and site maintenance engineers who bypass cyber and physical security measures. For instance, they carry a USB port blocker key alongside a system cabinet spare key as a common pocket tool in their keychain, just in case!
The transition that I had from being an end-user to a vendor, Honeywell, across many countries, allowed me to see how such behaviors are unfortunately widespread among a handful of plants. Despite the standards, policies, and training, these unsafe practices are still too common irrespective of the industry or the geographic region.
Surely, cybersecurity has never been more important than it is now. The pandemic has forced industrial firms to balance the needs of running the plant while maintaining the health and well-being of their staff. With resulting inherent economic pressures, all of this must be done while also controlling costs. Plant operators have had to embrace remote operations and allow non-essential staff to work from home. Plant operations, health of employees, and cost control seem to be a competing part of a difficult equation that needs to be balanced. While working on balancing this equation, these are, in my view, the top three mistakes to avoid:
Indeed, cybersecurity is a matter of risk management, either by risk prevention or by risk mitigation. As we collectively face the challenges of this pandemic with a cyber maturity enhancement plan, here are my thoughts on the top five short-term actions to consider during planning a “new normal” operation:
Finally, here is my personal recommendations for long-term OT strategy planning:
At the end, we are in this together. Feel free to comment as I am interested to know more about your thoughts and best cybersecurity practices during the pandemic. I wish a healthy and secure environment for your systems.