More organizations are starting to view cybersecurity as a strategic risk. They have to—it’s becoming unavoidable. Technology and the business are so intertwined. Regulators are issuing more compliance measures that include information security directives. And all the while, adversaries are relentless in their campaigns to compromise defenses to steal information, money, or otherwise create disruption.
The HAVEX worm is making the rounds again. As Cisco first reported back in September 2013, HAVEX specifically targets supervisory control and data acquisition (SCADA), industrial control system (ICS), and other operational technology (OT) environments. In the case of HAVEX, the energy industry, and specifically power plants based in Europe, seems to be the primary target. See Cisco’s security blog post for technical details on this latest variant.
When I discuss security with those managing SCADA, ICS and other OT environments, I almost always get the feedback that cybersecurity isn’t required, because their systems are physically separated from the open Internet. This practice, referred to in ICS circles as the “airgap”, is the way ICS networks have been protected since the beginning of time; and truth be told, it’s been tremendously effective for decades. The problem is, the reality of the airgap began to disappear several years ago, and today is really just a myth.
Today, networks of all types are more connected than ever before. Gone are the days where only information technology (IT) networks are connected, completely separated from OT networks. OT networks are no longer islands unto themselves, cut off from the outside world. Technology trends such as the Internet of Things (IoT) have changed all of that. To gain business efficiencies and streamline operations, today’s manufacturing plants, field area networks, and other OT environments are connected to the outside world via wired and wireless communications – in multiple places throughout the system! As a result, these industrial environments are every bit as open to hackers and other cyber threats as their IT counterparts. The main difference, of course, is that most organizations have relatively weak cybersecurity controls in these environments because of the continued belief that an airgap segregates them from the outside world, thereby insulating them from cyber attacks. This naivety makes OT environments an easier target.
The authors of HAVEX certainly understand that OT environments are connected, since the method of transmission is via a downloadable Trojan installed on the websites of several ICS/SCADA manufacturers. What’s considered a very old trick in the IT world is still relatively new to those in OT.
It’s absolutely essential that organizations with ICS environments fully understand and embrace the fact that IT and OT are simply different environments within a single extended network. As such, cybersecurity needs to be implemented across both to produce a comprehensive security solution for the entire extended network. The most important way to securely embrace IoT is for IT and OT to work together as a team. By each relinquishing just a bit of control, IT can retain centralized control over the extended network – but with differentiated policies that recognize the specialized needs of OT environments.
We’ll never completely bulletproof our systems, but with comprehensive security solutions applied across the extended network that provide protection before, during, and after an attack, organizations can protect themselves from most of what’s out there. A significant step in the right direction is to understand that the airgap is gone forever; it’s time to protect our OT environments every bit as much as we protect our IT environments.
The fire alarm went off in my building again, but fortunately, it was only a drill. By now, we are all used to the periodic fire drills for emergency preparedness in our workplaces. But have you ever wondered if there is a similar exercise possible for a cyber attack? The same logic applies. Your team will be better prepared to handle a disaster if they are trained for it.
Seeing is believing: Today I am excited to share this video from our Cisco Korea team that showcases Cisco CyberRange.
The Internet is evolving, and its next phase – the Internet of Everything – brings together people, process, data and things to create opportunities that benefit people, communities, and the environment. Cisco estimates that 50 billion devices will be connected to the Internet by 2020, making cybersecurity more vital than ever before. Cisco is engaged in several efforts to prepare young people for careers in the field.
First, Cisco has partnered with CyberPatriot, the national youth cyber education program. Bernie Skoch, CyberPatriot National Commissioner, emphasizes the need for cybersecurity training as breaches and threats become more common on the Internet.
“There are 15,000 attacks per second in the United States by people who would do ill to our systems,” Skoch said. “We have a dire need for cybersecurity professionals in the United States, but we frankly aren’t drawing enough young men and young women to be the designers, to be the planners, to be the operators of these very technical systems.”
If Dallas only brings images of football games and TV soap operas to mind, it’s time to re-consider this southern city.
A year ago, Dallas faced some challenges adopting comprehensive sustainability programs. But since then, the city has not stagnated in its journey to become smart and connected. Recently, Dallas has caught the attention of large technology companies, won grants, and been selected to hold thought leadership events.
This week, Dallas hosted the annual New Cities Summit, joining past host cities and world capitals Paris and São Paulo. The summit sponsor, New Cities Foundation, founded by Cisco and Ericsson, strives to incubate, promote, and scale urban innovations. The selection of Dallas as the summit’s 2014 location indicates its position as a city well on its way to becoming a technology hub. Read More »