Securing your operational systems - July 2018 - Hi-Tech Security Solutions
 
classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
 

Search...
Hi-Tech Security Solutions Business Directory
Residential Estate Security Handbook 2017


Securing your operational systems
July 2018, Industrial (Industry), Cyber Security

Capitalising on the new digital marketplace not only requires that organisations collect and process data, but that they also use that data to impact the bottom line. Much of that is achieved simply by serving up data on demand to consumers. But some of the rest is achieved by leveraging real-time data to impact things such as the manufacturing floor, inventory management, or fine-tuning production to meet shifts in demand. This requires connecting traditionally isolated operational technology (OT) networks with IT.

Survey of ICS/scada decision makers

In a commissioned study conducted by Forrester Consulting on behalf of Fortinet this past January 2018, 429 global decision-makers across a wide variety of industries, responsible for the security of their organisation’s critical infrastructure, IP level protection, IoT, and/or scada, were asked about this convergence process and the security challenges they are facing.

What we learned is that nearly all companies have already begun at least a basic convergence of OT and IT. As these organisations begin to actively converge these environments, however, they are encountering issues related to integration and security that they may not be equipped to handle. IT teams have a tendency to just want to throw security technology at the network and call it good. But these networks can be very different, and what works well in one environment can have devastating consequences in the other. For example, an error that opens a port on a switch can have a very different result from one that opens a valve on a boiler.

Why securing OT systems can be so difficult

What organisations now understand is that IT and OT teams speak very different languages when it comes to issues like security. An ICS or scada system, for example, may have been running on ageing hardware on top of an obsolete operating system for a decade or more. But that may be because it only has one job: for example, monitoring a thermostat and then throwing a switch when it reaches a critical temperature. That doesn’t require the latest technology, and if it is doing the job it was designed to do, then there is no reason to change it. But because so many of these systems run on proprietary software and use delicate instrumentation, even something as benign as scanning a device for malware can cause it to malfunction.

Besides, changing out that technology may not be as simple as it sounds. You may have to pull down an entire production line, wait for a system to cool down, make the change, heat the system back up again, and then be ready to pull the plug if it doesn’t work the way it needs to. It might take an open forge furnace a week for that to happen. And every minute of downtime costs money.

But at the same time, there are increasing business cases to be made to tie these systems to the larger network. Being able to monitor a control system remotely over the cloud may save significant amounts of time and money. And being able to redirect resources based on real-time data may mean the difference between being a viable competitor in an emerging marketplace or not. But that means connecting these systems to an open IT environment, thereby exposing that portion of your organisation to new forms of cyberattack it was never designed to detect and defend against.

Most organisations have experienced a scada/ICS breach

This isn’t a concern about a potential problem. In fact, 88% reported having experienced a security breach in their scada/ICS systems, with over half of these occurring just within the last year. The impacts were widely felt for over 90% of these organisations, and most critically, affected their ability to meet compliance or regulations or to operate at a sufficient level of functionality. And 63% said that a breach impacted the safety of the organisation’s employees.

The issue is magnified by the fact that 56% of these organisations outsource at least some part of their scada/ICS infrastructure and security, and grant outside parties with complete or high-level access. As a result, most organisations acknowledge the importance of scada/ICS security, and they already undertake numerous measures to secure their scada/ICS. But this is also why over three-fourths of respondents plan to increase scada/ICS security spending in the next year more than in other areas.

What are organisations doing to protect their OT environments?

Well, to start, 97% of those organisations converging these systems are looking to implement solutions aimed at performing a risk assessment or implementing common standards. And it’s a good start. But it also reveals that they may not have the resident expertise needed to properly assess their needs or implement an adequate security solution.

So, who do they turn to for help in ensuring that their business objectives can be met without compromising the entire OT arm of their organisation?

When considering a security vendor for their scada/ICS environments, the ability to meet compliance standards and provide end-to-end solutions, along with a reputation for reliability are most important attributes they look for. These organisations are looking for solutions from a variety of vendors, from system integrators to security manufacturers.

Preferred security provider

Of all the vendors considered, the most commonly chosen security vendor is Fortinet. That’s because there is a growing trend to consolidate their solutions through a single vendor rather than the traditional best-of-breed approach that has made traditional security operations so complex. And since their top five security concerns include viruses (77%), internal (73%) or external (70%) hackers, data leakage (72%), and lack of device authentication (67%), they are looking for a vendor who can solve a wide range of solutions with a single integrated strategy.

Fortinet’s Security Fabric and Fabric-Ready Partner approach also enables organisations to more easily map security solutions to compliance regulations, enabling them to focus on those requirements that are most important to their scada/ICS, which they feel is key to protecting their OT environments.

Fortinet is one of the few security vendors committed to protecting and securing OT operations, especially those that are part of critical infrastructures. Here are some additional resources to help you learn more about Fortinet’s OT security strategies and solutions:

• Fortinet’s ruggedised firewall, switching, and wireless access point appliances, combined with FortiGuard industrial threat intelligence, provide integrated cybersecurity protections for industrial control systems (ICS) and supervisory control and data acquisition (scada) systems, whether deployed in the field or in non-environmentally controlled facilities across an organisation’s OT infrastructure.

• FortiGuard’s Industrial Security Services (ISS) protect the most widely-used scada devices and applications, providing vulnerability protection, deep visibility, and granular control over ICS and scada systems. FortiGuard ISS complements Fortinet’s industrial-strength security appliances, which are designed to run in harsh environments.

• Many of today’s OT systems are transited or tunnelled over corporate networks, leverage common Internet protocols, run on general-purpose hardware and mainstream operating systems, and are increasingly connected via wireless technologies. Which also makes them targets for cybercriminals looking to steal data or proprietary processing systems, or to simply cause havoc. Fortinet is committed to securing OT networks against rising attacks.


  Share via Twitter   Share via LinkedIn      

Further reading:

  • Facing the cybersecurity challenge
    August 2018, Technews Publishing, Cyber Security
    There are many cybersecurity products and solutions out there, but what do they offer and how will they protect you and strengthen your cybersecurity posture?
  • Where safety, security and Industry 4.0 meet
    July 2018, Technews Publishing, This Week's Editor's Pick, Integrated Solutions, Industrial (Industry)
    Integrated security offers more than simply a means to keep unwanted people out of industrial settings, its benefits extend to supporting and enhancing daily operations.
  • Protecting the machines
    July 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Integrated Solutions, Industrial (Industry)
    Security operations at industrial sites need to include cybersecurity and it needs to be treated with the same importance as the physical security of the site as well as health and safety standards.
  • Securex 2018 pulls the (right) crowds
    July 2018, Technews Publishing, Access Control & Identity Management, CCTV, Surveillance & Remote Monitoring, Cyber Security, Integrated Solutions
    With over 6000 visitors attending and exhibitors expressing their satisfaction with not only the number, but also the calibre of the visitors, this year’s Securex was a winner.
  • Securing your digital assets
    July 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, IT infrastructure
    Cyberattacks can’t be prevented, but companies and individuals have ways to keep the attackers out. However, the coming year will see more attacks and more losses because of poor cyber planning.
  • The generations that matter
    July 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Security Services & Risk Management
    According to Doros Hadjizenonos, country manager, SADC at Check Point, we have entered the fifth generation of cyberattacks.
  • EOH introduces managed Security-as-a-Service
    July 2018, EOH Security & Building Technologies, News, Cyber Security, Security Services & Risk Management
    EOH has introduced a solution to modern security concerns through a managed Security-as-a-Service suite of offerings.
  • How data leaks can be avoided
    July 2018, This Week's Editor's Pick, Cyber Security, News, Security Services & Risk Management
    MyID runs as a service, monitoring your ID number, email address, mobile number and credit card number for fraudulent usage or fraudulent input on the Web.
  • Keeping trains on schedule
    July 2018, SICK Automation Southern Africa, Industrial (Industry), Security Services & Risk Management
    SICK LMS511PRO laser scanners protect the overhead line and help ensure trains operate on schedule through the 57 km Swiss railway tunnel, the longest in the world.
  • Wireless transportable multi-gas detectors
    July 2018, Spero Sensors & Instruments, Industrial (Industry), Fire & Safety, Products
    Sperosens reduces the complications of gas detection by supplying the Oldham range of wireless multi-gas solutions, with a focus on maximising performance, quality and reliability.
  • Securing the Internet of Things
    July 2018, Cyber Security, Industrial (Industry)
    With more than 75 billion devices expected to be connected to the Internet by 2025, the Internet of Things (IoT) has become an integral part of the digital world, but are these devices secure?
  • Delivering measurable return on ­investment
    July 2018, Active Track, Industrial (Industry), Access Control & Identity Management
    Manufacturing concerns will agree that personnel management and keeping costs to a minimum is key. Biometric access control can help control payroll waste.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.