VP Industrial Security, Waterfall Security Solutions. Andrew is one of the most widely read authors in the industrial security space.
”Prevention is dead.” Attend enough cybersecurity conferences, and eventually we hear someone say it. The perimeter is dead. Prevention is dead. Visibility is the new security.
For enterprise IT networks, there is some truth in this. Much of the enterprise has moved into the cloud. Employees work from home, carry company information on laptops and phones and connect from everywhere. Enterprise security programs reflect this reality—we scour our systems to detect compromise, and we respond and recover rapidly.
When Recovery Is Not Enough
Operational technology (OT) is different—these are the computer systems that operate power plants, pipelines and high-speed passenger metros. When an IT laptop is compromised, what do we do? We isolate the device, (optionally) take a forensic image for analysis, erase it and restore from backups. When an OT network is compromised and the attack causes massive turbines to disintegrate in their metal housing, causes trains to collide or shuts down production at a massive factory for weeks, what do we do? This is the essential difference between IT and OT networks—we cannot restore human lives, damaged turbines or lost production from backups. Systems with more serious worst credible consequences of compromise than IT networks require materially stronger protection.
How is this relevant to protect versus detect? Detect/respond/recover works on IT networks because the damage is recoverable. This is a perfectly reasonable strategy when you can always put things back the way they were.
OT Is A Different Animal
Imagine that the engineering community has figured out how to build high-rise buildings at a fraction the cost of today’s buildings—less concrete, less steel, maybe add in some carbon fiber. Tremendous cost savings, but there is a problem. The new design, while very stable under static loads and even sudden shifts like earthquakes, is unstable under a persistent push. A strong, steady wind causes these buildings to start oscillating alarmingly to the point where a really windy day “breaks” the building off, sending the top floors crashing to the ground.
Design engineers understand this problem, though, and have built compensating measures into the new design. Massive steel ropes hidden in shafts at the corners of the buildings apply dynamic force to keep the new buildings steady. Multiple redundant cables, motors, power supplies and computer control systems all keep the buildings perfectly stable in even hurricane-force winds.
Consider: How happy would you be working on the top floor of such a building if you knew the design engineer hoped that if a cyberattack targeted the control system, the building’s security operations center could detect the attack before the building collapsed? How happy would you be in that building if you knew the engineer hoped that if the attack was detected in time, an incident response team could be scrambled fast enough to defeat the attack and save your life?
Hope is not what we expect when we design buildings. We expect buildings to withstand all predictable threats, from earthquakes to tornadoes to cyberattacks. Hope may well be sufficient for the vast majority of IT networks—“Andrew, the fool, clicked another link. We have to go wipe his laptop again,” but we cannot restore human lives, wrecked power turbines or collapsed buildings from backups.
When the worst credible consequences of compromise are unacceptable, we expect our critical automation systems to carry a specified threat load until at least the next opportunity to upgrade our security systems, with a large margin for error. That said, this does not mean the Detect, Respond and Recover pillars of the NIST CSF are unimportant. They remain essential components of every security program, but they serve a different purpose. Detection is no substitute for prevention, not when consequences are truly unacceptable.
Engineering-Grade Prevention
The latest and most important innovation in OT security in 20 years—Cyber-Informed Engineering (CIE)—has been developing this idea for several years. Rather than relying exclusively on probabilistic, IT-style security controls, CIE identifies engineering-grade, deterministic mitigations that protect facilities even in the face of sophisticated cyber compromise. Mechanical overpressure relief valves, centrifugal governors and break-away clutches all behave deterministically, even when software systems have been compromised.
And CIE documents digital as well as expensive electro-mechanical mitigations. The most universally applicable mitigation in the CIE database of engineering-grade mitigations, for example, is the unidirectional gateway. The NIST 800-82 standard defines a unidirectional gateway as a combination of hardware and software. The hardware can physically send information in one direction—usually from the OT system to IT. All cyber sabotage is information—the only way a control system can change from a normal state to a compromised state is if attack information somehow enters the system. With hardware-enforced unidirectionality, even the most sophisticated cyberattacks cannot penetrate the device to reach protected networks.
We will always have software vulnerabilities, misconfigurations and zero-day attacks. CIE teaches us to address the most severe credible consequences early in the design process, ideally eliminating them deterministically. Detection helps us recover from compromise. Engineering-grade defenses prevent compromise.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
