The 4th Industrial Revolution

July 2019 Editor's Choice, Cyber Security, Security Services & Risk Management, Industrial (Industry)

When one thinks of the word ‘revolution’, images of armed insurgents attempting to overthrow an incumbent government or system invariably springs to mind. Adding the word ‘industrial’ changes the image to one of technological change. Today, however, the two meanings are becoming increasingly intertwined and the future vision is increasingly worrying.

Craig Rosewarne.
Craig Rosewarne.

A quick preview of preceding revolutions puts things into perspective:

First Revolution – The invention of the steam engine in 1760 powered new manufacturing processes leading to the creation of factories and industry.

Second Revolution – Mass production in new industries such as steel, oil and electricity coupled with key inventions including the telephone, light bulb and internal combustion engine.

Third Revolution – Also known as the ‘Digital Revolution’ after the introduction of the semiconductor, personal computer and Internet.

Fourth Revolution – Due to the fact that our physical, biological and digital world is shrinking rapidly due to rapid advancements in technology, a conflict of interests relating to ideology, supremacy, financial, etc. will occur. Cyber warfare is already taking place and a major attack vector are countrys’ industrial sectors. With every attack comes the need for defence, but are we ready?

Technology: good and bad

Most major industries have turned to and are reliant on technology to run their operations. This is a time of great promise, but also one of frightening peril. Cyber technology can both help save lives or cause irreparable harm and in a combination of the two, depending on whose side you’re on, both.

Some notable cases of cyberattacks against industry have included:

Stuxnet – In the early 2000s, Iran began to flex its nuclear muscle as it sought to counter the threat that Israel posed by possessing nuclear weapons. A uranium processing plant began enriching uranium at a plant supplied by America in the 1950s, when Iran was still a regional ally. The West and Israel had two options, go to war or allow Iran to complete its plan, which it claimed was for humanitarian purposes. A third proposal was then put forward, the use of cyber technology to destroy or at least delay the enrichment.

The problem was that the plant’s computer systems were air-gapped and only a few key personnel had access to them. The solution was simple, the old Greek Trojan Horse. USBs containing malicious code were left near the cars of the key scientists and sure enough, one was picked up and inserted into his laptop and then transferred to the main system.

The targets were the centrifuges (simply put, giant ‘spin driers’) rotating at 100 000 rpm which extracted purer forms of uranium. Stuxnet caused these centrifuges to speed up without showing it in the control rooms. They eventually tore themselves to pieces, delaying Iran’s plans long enough (along with sanctions) to bring them to the negotiating table.

German blast furnace – In 2014, a German steel mill’s blast furnace was hacked causing the electronic doors not to seal properly. The damage was enormous. This form of attack is known as an Advanced Persistent Threat (APT) where attackers infiltrate the system and gather information over a period of time. When weaknesses are found, they strike.

Ukrainian power grid – This is one of the first major attacks, again using a Trojan, that affected a large portion of the populace in Western Ukraine. This attack has given us a taste of the potential consequences that cyber-attacks can have on industrial sites and the roll-on affect to consumers.

We now have the Industrial Internet of Things (IIoT)

How safe is South Africa’s industrial and critical infrastructure? Sad to say, we are woefully unprepared for any major cyber incident and have thankfully not (yet) been targeted in a major attack. Koeberg, our only nuclear power station, has been around for 35 years and has suffered its fair share of shutdowns and mishaps, mostly due to human negligence and sabotage. Total estimated costs due to outages is around R 2 billion.

Our financial and retail industries have been hit fairly hard recently, but the main motivation here appears to be exfiltration of data and financial gain via ransomware attacks. Attacks against industrial targets are normally carried out by nation states, hacktivists (opposition groups, environmentalists, etc.) or even individuals with an axe to grind. With the outcry surrounding our state capture commission, people in power are turning a blind eye to a far greater threat of a major cyber incident against industrial and critical infrastructure.

What can be done to protect us? According to security group Sentryo, the approach of teams in charge of ICS cyber security must overcome five key constraints:

• Take into account physical processes*.

• Using technology specially designed for industrial environments.

• Mapping installations and analysing risks: an inventory of all material installations, critical systems and applications – this enables us to identify each weakness, the needs as well as the objectives when faced with threats.

• Placing actors, who are often unaware of the risks and thus responsible for a large part of incidents, at the heart of the security process – it is essential to promote rules of good computer hygiene, especially when it comes to access, login details or even the use of a simple USB flash drive.

• Engage actively in intelligence to stay up-to-date with the threats and vulnerabilities that are unique to the ICS sector.

o *Include skills in security and industrial process control.

o Adapt intrusion tests and security assessments for ICS in order to avoid interfering with physical processes.

o Adapt measures for detecting intrusions in order to take into account attacks that target physical processes (for example Stuxnet or CrashOverride). https://www.sentryo.net/specific-challenges-industrial-cybersecurity/)



Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Stolen credentials on the Dark Web
October 2019 , Cyber Security, Security Services & Risk Management
Over 21 million credentials belonging to Fortune 500 companies, 16 million of which were compromised during the last 12 months, are up for sale.

Read more...
Stolen credentials on the Dark Web
October 2019 , Cyber Security, Security Services & Risk Management
Over 21 million credentials belonging to Fortune 500 companies, 16 million of which were compromised during the last 12 months, are up for sale.

Read more...
Enterprise security must change
October 2019 , Cyber Security, Security Services & Risk Management
The recent wave of cyberattacks against local banks has highlighted the importance of protecting data against malicious users.

Read more...
Kaspersky uncovers zero-day in Chrome
October 2019, Kaspersky Lab , News, Cyber Security
Kaspersky’s automated technologies have detected a new exploited vulnerability in the Google Chrome web browser.

Read more...
Body-worn cameras transforming security
October 2019 , CCTV, Surveillance & Remote Monitoring, Security Services & Risk Management
Police Service Northern Ireland now has over 7 000 officers using 2 500 cameras covering approximately 173 000 incidents each year.

Read more...
Protecting your customers’ data
October 2019 , Training & Education, Security Services & Risk Management
Simon Murrell, head of development and executive director at BrandQuantum says companies need to protect their customers from identity theft and data breaches.

Read more...
A platform approach to innovation and value
CCTV Handbook 2019, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Integrated Solutions, IT infrastructure
Moving to the platform model of doing business holds tremendous advantages for end users and smaller developers, but also for the whole technology supply chain.

Read more...
Open does not always mean easy integration
CCTV Handbook 2019, VERACITECH, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Integrated Solutions
Customers who opt for best-of-breed solutions will have to rely on their integrators to develop customised integrated solutions for them.

Read more...
The impact of AI on the surveillance industry
CCTV Handbook 2019, G4S South Africa, Hikvision South Africa, Myertal Tactical Security, Technews Publishing , Editor's Choice, CCTV, Surveillance & Remote Monitoring
What the impact of AI will be on companies, the services and solutions they supply, as well as on the jobs people do.

Read more...
Video analytics and AI
CCTV Handbook 2019, Axis Communications SA, Dallmeier Electronic Southern Africa , Hikvision South Africa, Technews Publishing, Dahua Technology South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Integrated Solutions
Artificial intelligence has the potential to deliver real benefits in the world of video analytics and many companies are already delivering customer benefits.

Read more...