OT security is “hard” – engineering change control (ECC) makes patching slow and expensive, many OT devices and systems have no real support for zero trust (ZT), and most OT systems have large subsystems that operate without encrypted or authenticated communications. But imagine – imagine we could “wave a magic wand” and solve all of this, instantly. With one gesture, we patch everything, encrypt everything and ZT everything. Would we be “done?”

No. IT networks have near-universal security updates, ZT and encryption. If with a “magic wand” we could make our OT networks exactly as strong as our IT networks, then for most OT networks this would be a material improvement over the present-day, but would not be enough. From first principles, most OT networks must be materially better protected than most IT networks. The severity of worst credible consequences of cyber compromise drives the strength of security program that any network or system needs.

One way to make OT stronger than IT is to make OT security programs reflect OT rather than IT priorities. In most IT systems, information is the asset we protect and preventing espionage is the priority – encrypt the information and otherwise control the ability of adversaries to read the information. In most OT systems, on the other hand, physical operations are the asset, preventing sabotage is the priority, and information is the threat – the only way an OT system can change from a normal to a compromised state is if attack information enters the system, somehow. In OT it is therefore vital to control the movement of information, because all information flows can contain attacks.

How do we do that? Some examples:

• The humble “deny by default” rule – do not allow connections through the IT/OT firewall to email servers, Google, nor the Internet at large. We cannot afford to pull attack information into OT,
• More powerful unidirectional gateways at the IT/OT interface are hardware components that enable real-time server synchronization outbound from OT to IT, and allows no attack information at all to flow back into OT from IT, nor from the Internet, and
• Strict procedural, software and sometimes hardware controls over the use of removable media, such as DVD’s and USB thumb drives.

In most OT networks there are less than a dozen kinds of ways that information can enter the network. Lock them down. Lock them hard.

The fact that AI found hundreds of vulnerabilities in the Firefox open-source browser is really alarming. Firefox is a veteran, relatively highly secured open-source product that has been pen tested and code reviewed by governments, cyber companies and experts, multiple times. The Mythos AI found 250+ zero days in Firefox despite all this. 

What about products that are not open source, not as widely used, and not as seasoned. AI tools will find thousands of vulnerabilities, develop exploits, and chain those exploits together in ways that would have taken years for humans to figure out, code and test.

AI is taking nation-state grade tools and techniques and democratizing them, making nation-state grade attack capabilities available to a much wider audience, a much wider set of potential attackers. Within 12 or 24 months, I believe we are going to see fully automated and autonomous attacks on OT networks.

What can be done about this? The answer to these threats is not more software, but stronger hardware. Today we are officially launching the WF-600 DiodeCore, our newest addition to the WF-600 family. DiodeCore is a modern Unidirectional Gateway designed for simpler deployment scenarios: entry-level or simpler needs, smaller sites, and larger numbers of sites.

DiodeCore’s level of security, cybersecurity concepts, and unidirectionality are at the same hardware-enforced standard of protection Waterfall has always provided. And DiodeCore is a product that fits a different use case. I am very proud to introduce this to the market.

Watch our webinar on-demand
as we explore the impact of AI-driven cyber threats on OT security
and introduce Waterfall’s newest Unidirectional Gateway.

For OT environments, this matters enormously.

OT systems are intrinsically vulnerable. Rapid patching of OT systems is extraordinarily expensive and difficult. In safety-critical and reliability-critical environments, patches cannot simply be deployed overnight. Engineering change control processes that minimize safety and reliability risks require testing, validation, outage coordination, safety review, and operational acceptance. 

In many facilities, those processes take months or years. Worse, patching (hopefully) remediates only known defects, and again, AI’s have proven adept at finding previously unknown vulnerabilities. Even with a patching “magic wand,” IT and OT systems would still be intrinsically vulnerable.

1) Information is the asset we protect – protect the confidentiality, integrity and availability (CIA) of the information, in that order, or maybe in AIC order, or IAC, or something.

Information is the asset we protect in most IT networks. In OT networks, in contrast, we most often protect safe, reliable and efficient physical operations. Take a metro for example: safety is first – nobody wants to die on the way to work. Reliability next – the metro needs to get hundreds of thousands of people to work every day, and passengers want their trains to be on time. And then efficiency – it does no good to have the world’s safest, most reliable metro, if the population cannot afford to use it.

So what? Can we not stand on our heads and say there must be information somewhere in the metro’s automation system that we can protect? Well, we can stand on our heads, yes, a lot of people do, but why bother? 50-year-old cybersecurity theory (Bell / La Padula) teaches us how to prevent theft or leakage of important information. Many of us learned this theory in school. What we did not learn is that 2 years after Bell & La Padula came out with their theory, Biba came out with a complementary theory.

Bell / La Padula teach us how to prevent espionage – theft or leakage of important information (eg: how to make a Nuclear Bomb – these researchers were funded by the US DoD in their day). Biba teaches us how to prevent sabotage (eg: changing the targeting coordinates for the missiles delivering The Bomb).

Biba’s theory used exactly the same concepts and terminology as Bell / La Padula but applied the concepts differently. In Biba’s theory, information is not the asset we protect, but the threat. All cyber-sabotage is defined (mathematically) as information. The only way a targeting system or an OT control system can change from a normal state to a compromised state is if attack information enters the system – somehow. The goal with OT systems is not to “protect the information” – the CIA, or IAC, or AIC of the information. The goal is to protect control systems from information – to keep attack information from affecting critical functions, such as safe, reliable and efficient physical operations.

Get this wrong and we fixate on information as the asset, when attack information entering the system is in fact the threat we must defeat.

Terminology first. The word “secure” is in quotes, because cybersecurity (like safety) is a continuum, not a pair of discrete yes/no states. We can always be safer, or less safe. We can always be more secure, or less. The question “Are we secure?” is meaningless. The question “How secure are we?” has an answer. The question “How secure should we be?” is even more important. Anyone who uses “secure” as an adjective is selling something – “secure” communications (really: encrypted and/or authenticated), “secure” boot (really: cryptographically authenticated firmware), “secure” by design (really: better security by designing security in), and so on.

There is no such thing as “secure” remote access.

Want to learn more about OT remote access? Watch our webinar: “13 Ways To Break “Secure” OT Remote Access Systems”