Countermeasure Considerations

Countermeasure Considerations

Exploring how to build resilient industrial networks

Nowadays, more businesses understand that digitalization is necessary for them to survive and thrive. A 2019 Deloitte Smart Factory study found that 86% of manufacturers felt their smart factory initiatives would be the main driver of competitiveness over the next five years. In 2020, these initiatives have accelerated due to the global pandemic.

In a recent report by the World Economic Forum, Building Resilience in Manufacturing and Supply Systems in the COVID-19 Context and Beyond suggests that manufacturers adopt new working models and governing to increase manufacturing resilience. However, as we face the current crisis, accelerating digitalization alone is no longer sufficient. The best plan is to explore how to build resilient industrial networks and deploy cybersecurity defenses, in order to sustain continuous industrial operations.

The Industrial Cybersecurity Journey
As the number of cybersecurity incidents happening in industrial control systems (ICS) continues to increase, many organizations have started to develop their own cybersecurity strategies in order to protect assets they regard as critical to successful operations.

“Is there a silver bullet that can address all vulnerabilities in the ICS?” Unfortunately, there is no such thing. Consider cybersecurity from different perspectives. The start of a cybersecurity journey often begins with a risk assessment. After this, companies can establish security policies accordingly. In order to implement the security policies, it is worthwhile to create a security architecture to help achieve secure network infrastructure.

For instance, regulating who can access the network by utilizing access control lists. Finally, companies can proactively monitor and respond to cybersecurity incidents by implementing industrial cybersecurity countermeasures on OT networks.

Cybersecurity Needs to Be Holistic
As mentioned in the previous paragraph, every industrial cybersecurity journey includes different phases with relevant countermeasures. There is no single solution that can cover all aspects, so a recommendation includes that cybersecurity be viewed from a holistic perspective. Traditional countermeasures such as firewalls strengthen the perimeter defense of industrial networks.

These provide effective vertical protection to prevent people who do not have permission to access the network. However, when someone manages to get through that defense, or engineers accidentally dispatch a wrong command inside the network, there are no measures to mitigate the risks.

Therefore, deploying horizontal protection such as virtual patching and an IDS or IPS is also important. In the following sections, we will consider how vertical and horizontal protection both play a significant role on securing industrial networks. 

Vertical Protection: Build Secure Network Infrastructure to Implement Security Policies
Network management. Industrial networks are often pieced together over years or even decades. Therefore, gaining visibility of the network and its various components and architecture can be a challenging first step. From our experience, we have discovered that an industrial network management tool that can scan a network and automatically draw out the topology will give OT engineers a lot of useful information, which in turn allows them to develop an action plan.

Network protection. Network segmentation is a fundamental precaution that can ensure only certain traffic can flow within designated areas. There are several methods to achieve network segmentation. For instance, stateful firewalls can help create the first line of defense without needing to change the network topology; the perception is friendly for OT environments, as they need to operate continuously.

Creating virtual LANs (VLANs) within a larger network can also help segment networks. Another rule of thumb is to implement authentication via 802.1x (AAA/Radius TACACS) and access control via an ACL. Remote control, monitoring and maintenance have become more and more prevalent during an OT engineers’ daily operations. You should always remember that ensuring secure remote access reduces the chance of breaches.

Device security. As organizations start to take cybersecurity more seriously, the two biggest challenges include developing and implementing practical and appropriate security policies around authentication and network segmentation. Standards such as IEC 62443 can be very helpful in identifying policies that will make sense for their industrial networks.

Horizontal Protection: Deploy Industrial Cybersecurity to Proactively Monitor and Respond
As organizations start implementing cybersecurity measures into their industrial networks, the first step is to protect network traffic that travels vertically is a defense mechanism such as network segmentation.

Is this measure enough? The answer, unfortunately, is no. Although north- and south-bound traffic is managed and the defense is well built, employees, vendors, and contractors still have direct access to the networks. If there are no protection measures, this inadvertently allows them to bypass traditional protections such as firewalls and possibly introduce viruses or malware on to industrial networks. This is why horizontal protection such as virtual patching and intrusion prevention is crucial to protect critical assets such as PLCs and HMIs.

Industrial IPS Safeguards Critical Assets
Since PLCs and HMIs are designed to control production processes, if the communication between PLCs and the control center is compromised or HMIs malfunction, it could cause damage to assets or even staff. Therefore, it is important to prevent any unauthorized protocols or functions going through PLCs and HMIs. An Industrial intrusion prevention system (IPS) features OT-centric Deep Packet Inspection technology, which can identify multiple industrial protocols and allow or block specific functions, such as read/write access. This way, you can be more confident that the traffic on your industrial networks is non-malicious, and is trusted. 

Virtual Patching Protects Unpatched Devices
A well-known rule is to keep devices updated in order to prevent any cyberthreats. However, in industrial networks, it is sometimes less ideal to stop the operations to perform the updates. Furthermore, updates may not be available for these critical assets.

For instance, some HMIs are running on Windows XP, which no longer supports updates. Under such circumstances, virtual patches play an important role to safeguard critical assets from the latest cybersecurity threats.

Security Management Offers Clear Visibility
When a network is up and running it can be quite a challenge to maintain and quickly adjust the network. Therefore, security management software is very helpful for managing devices and security policies, as well as performing virtual patches.

As there is no single cybersecurity solution, organizations have to examine their status and select the right combination of solutions. Try to think from both perspectives of secure network infrastructure and industrial cybersecurity to build vertical and horizontal protection.

This article originally appeared in the January / February 2022 issue of Security Today.

Featured

  • Paving the Way to Smart Buildings

    In today's rapidly evolving security landscape, the convergence of on-prem, edge and cloud technologies are critical. The physical security landscape is undergoing a profound transformation, driven by the rapid digitalization of buildings and the evolving needs of modern organizations. As the buildings sector pivots towards smart, AI and data-driven operations, the integration of both edge and cloud technology has become crucial. Read Now

  • The Cybersecurity Time Bomb

    If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk. Read Now

  • Deploying in a Hybrid, Cloud Environment

    The way organizations manage access control is evolving. Traditional on-premises systems come with high IT and server requirements. At the same time, fully cloud-based solutions may not meet the needs of every facility. Read Now

  • Facing Facts for Facilities

    Despite the proliferation of constantly evolving security solutions, there remains a troubling trend among many facility operators who often neglect the most important security assets within their organization. Keys and shared devices like radios, laptops and tablets are crucial to successful operations, yet many operators are managing them haphazardly through outdated storage systems like pegboards and notebooks. Read Now

  • Report Reveals Security Training Reduces Global Phishing Click Rates by 86%

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, today launched its “Phishing by Industry Benchmarking Report 2025” which measures an organization’s Phish-prone Percentage (PPP) — the percentage of employees likely to fall for social engineering or phishing attacks, indicating the organization’s overall susceptibility to phishing threats. This year’s report found a global average baseline PPP of 33.1%, meaning a third of employees interact with phishing simulations before taking part in best-practice security awareness training (SAT).COVER 2025-PIB-NA-Report_EN-US Read Now

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.