scada security – Waterfall Security Solutions https://waterfall-security.com Unbreachable OT security, unlimited OT connectivity Thu, 14 Aug 2025 11:42:40 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.2 https://waterfall-security.com/wp-content/uploads/2023/09/cropped-favicon2-2-32x32.png scada security – Waterfall Security Solutions https://waterfall-security.com 32 32 SCADA Security Fundamentals https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/what-is-scada-security/ Thu, 14 Aug 2025 11:42:40 +0000 https://waterfall-security.com/?p=35683 Protect SCADA systems with best practices in SCADA security, including access control, monitoring, encryption, and compliance for critical infrastructure.

The post SCADA Security Fundamentals appeared first on Waterfall Security Solutions.

]]>
OT Insights CenterSCADA Security Fundamentals

SCADA Security Fundamentals

SCADA security protects industrial control systems from cyber and operational threats through access controls, encryption, monitoring, governance, and regulatory compliance. Learn how best practices and Waterfall Security solutions safeguard critical infrastructure. Ask ChatGPT
Picture of Waterfall team

Waterfall team

What is SCADA Security

SCADA systems, or Supervisory Control and Data Acquisition systems, are at the heart of modern industrial operations, controlling everything from power plants and water treatment facilities to manufacturing lines and transportation networks. While they keep critical infrastructure running efficiently, SCADA systems are also increasingly exposed to cyber threats due to greater connectivity and digital integration. Understanding the fundamentals of SCADA security is essential for protecting industrial operations, ensuring safety, and maintaining operational continuity.

Understanding SCADA Systems in Security Context

A SCADA system typically includes several key components:

  • Central control servers that process and manage data

  • Human-Machine Interfaces (HMIs) that allow operators to monitor and control processes

  • Remote Terminal Units (RTUs) and Programmable Logic Controllers (PLCs) that collect data from field devices and execute commands

  • Communication networks connecting the central system with remote devices
     These components work together to provide real-time monitoring, automation, and reporting across industrial environments, forming the backbone of critical infrastructure operations.

The evolution of SCADA architecture from isolated to networked environments

Originally, SCADA systems were isolated, often using proprietary protocols and physically separated networks, which naturally limited cyber risks. Over time, they have become increasingly networked, connecting to corporate IT systems, the internet, and cloud platforms to enable remote monitoring and analytics. While this connectivity improves efficiency and operational insight, it also introduces new attack surfaces and vulnerabilities that must be addressed with modern cybersecurity measures.

Critical infrastructure sectors relying on SCADA systems

SCADA systems are essential across multiple critical infrastructure sectors:

  • Energy: Power generation, transmission, and oil & gas refineries rely on SCADA for stability and control.

  • Water and Wastewater: Treatment plants use SCADA to monitor chemical levels, flow rates, and system health.

  • Manufacturing and Industrial Production: Automated production lines and robotics are coordinated through SCADA for efficiency.

  • Transportation and Logistics: Rail networks, traffic systems, and ports use SCADA for safe and timely operations.
     A compromise in any of these sectors can have wide-reaching operational, economic, and safety consequences.

Critical infrastructure sectors relying on SCADA systems

Operational technology (OT) vs. information technology (IT) security paradigms

SCADA systems fall under the broader category of OT, which focuses on physical processes and operational continuity. Unlike IT systems, which prioritize data confidentiality and integrity, OT emphasizes safety, uptime, and real-time reliability. Security strategies for SCADA must account for this difference, ensuring that protective measures do not disrupt critical processes while still defending against cyber threats.

Security implications of legacy SCADA implementations

Many SCADA environments still operate on legacy hardware and software that were not designed with modern cybersecurity in mind. These older systems often have outdated protocols, limited patching capabilities, and weak authentication, making them prime targets for attackers. Securing legacy SCADA implementations requires careful risk assessment, network segmentation, and compensating controls that protect industrial operations without interrupting critical processes.

SCADA Components and Security Considerations

SCADA systems consist of multiple interconnected components—HMIs, PLCs, RTUs, data acquisition servers, and communication networks—that collectively monitor and control industrial processes. Each component presents unique security considerations, from physical access control to software vulnerabilities and network exposure. Ensuring the security of SCADA requires a holistic approach that addresses both cyber and physical threats while maintaining operational continuity.

Human-Machine Interface (HMI) security vulnerabilities

HMIs provide operators with a visual interface to monitor and control industrial processes, but they can also be a target for cyberattacks. Vulnerabilities include weak authentication, unpatched software, and susceptibility to malware, which can allow attackers to manipulate displayed data, issue unauthorized commands, or gain a foothold in the broader SCADA network. Securing HMIs involves strong authentication, regular updates, and network isolation to reduce exposure.

Programmable Logic Controllers (PLCs) attack vectors
PLCs are responsible for executing automated control logic and directly interacting with machinery. Attack vectors targeting PLCs include unauthorized access via default credentials, firmware vulnerabilities, and malicious commands injected through network connections. Compromising a PLC can result in process disruption, equipment damage, or unsafe operating conditions. Protecting PLCs requires strict access controls, firmware management, and monitoring for anomalous activity.

Remote Terminal Units (RTUs) security challenges
RTUs collect data from field devices and relay commands between the central system and industrial processes. Because they are often deployed in remote or exposed locations, RTUs face both physical and cyber threats. Challenges include unsecured communication links, outdated firmware, and tampering risk. Mitigation strategies include encrypted communications, physical protection, and secure configuration management.

Data acquisition servers and historian security
Data acquisition servers and historians store and manage process data from SCADA systems, providing analytics and historical records. These servers are attractive targets for attackers seeking operational intelligence or the ability to manipulate data. Security considerations include regular software updates, strong authentication, network segmentation, and continuous monitoring to ensure data integrity and prevent unauthorized access.

Communication protocols security weaknesses
SCADA systems often use specialized protocols like Modbus, DNP3, and OPC, which were designed for reliability and performance rather than security. Many lack built-in encryption or authentication, making them susceptible to interception, spoofing, or replay attacks. Securing communication protocols involves implementing encryption where possible, network segmentation, intrusion detection, and monitoring for unusual traffic patterns to protect data integrity and operational reliability.

The Threat Landscape for SCADA Environments

Nation-state actors targeting critical infrastructure
Nation-state actors often target SCADA systems as part of strategic cyber operations aimed at critical infrastructure. By exploiting vulnerabilities in industrial control systems, these attackers can disrupt power grids, water treatment facilities, or manufacturing operations, potentially causing widespread economic and societal impact. Protecting SCADA from such threats requires advanced threat intelligence, continuous monitoring, and collaboration with government and industry partners to detect and respond to sophisticated, state-sponsored attacks.

Cybercriminal motivations for attacking SCADA systems
Cybercriminals may target SCADA systems for financial gain, such as demanding ransom through ransomware attacks, stealing sensitive operational data, or manipulating industrial processes for profit. Unlike nation-state attacks, these intrusions are often opportunistic, taking advantage of weak security measures or unpatched systems. Strengthening SCADA security against cybercriminals involves implementing strict access controls, patch management, network segmentation, and continuous monitoring to prevent unauthorized access and operational disruptions.

Hacktivism and SCADA systems as political targets
Hacktivists may target SCADA systems to make a political statement, raise awareness of social causes, or disrupt public services to attract attention. These attacks often aim to demonstrate vulnerability rather than achieve financial gain, but they can still have serious operational and safety consequences. Protecting SCADA from hacktivism requires both robust cybersecurity measures—such as intrusion detection, secure remote access, and anomaly monitoring—and proactive communication and incident response planning to minimize impact.

Notable SCADA Security Incidents

Over the past decade, several high-profile cyberattacks have highlighted the vulnerabilities of SCADA systems and the potentially severe consequences of a breach. From malware targeting industrial equipment to coordinated attacks on national infrastructure, these incidents demonstrate why securing SCADA environments is critical for operational safety, public welfare, and national security.

Stuxnet and its implications for industrial security
Stuxnet, discovered in 2010, was a sophisticated malware specifically designed to target Iranian nuclear enrichment facilities. It exploited vulnerabilities in PLCs to manipulate centrifuge operations while hiding its activity from operators. Stuxnet demonstrated that cyberattacks could cause physical damage to industrial equipment, marking a turning point in awareness of ICS and SCADA security. Its legacy emphasizes the need for strong network segmentation, rigorous patch management, and monitoring of operational anomalies to detect and prevent similar attacks.

Ukrainian power grid attacks
In 2015 and 2016, Ukraine experienced cyberattacks that targeted its power grid, leading to widespread blackouts affecting hundreds of thousands of people. Attackers compromised SCADA systems to manipulate breakers and disrupt electricity distribution, highlighting the vulnerability of critical infrastructure to coordinated cyber operations. These incidents underscore the importance of access controls, real-time monitoring, incident response planning, and collaboration with national security authorities to protect industrial operations from both cybercriminals and nation-state actors.

Water treatment facility breaches
Water treatment facilities have also been targeted by attackers seeking to manipulate chemical dosing or disrupt water supply systems. These breaches demonstrate how SCADA vulnerabilities can have direct public health consequences. Security measures such as robust authentication, network segmentation, physical security, and continuous monitoring are essential to safeguard water treatment operations and prevent potentially life-threatening outcomes from cyber intrusions.

SCADA Security Architecture and Controls

Defense-in-Depth Strategies for SCADA
Securing SCADA systems requires a defense-in-depth approach, which layers multiple security measures to protect industrial control systems from both cyber and physical threats. By combining preventive, detective, and responsive controls across all components, organizations can reduce the risk of compromise and minimize the impact of any potential breach.

Multi-Layered Security Approach for Industrial Control Systems
A multi-layered security strategy ensures that if one control fails, others continue to protect critical operations. This approach includes endpoint security for devices, network protections, access controls, monitoring systems, and incident response procedures. Layering defenses helps address diverse threats, from malware and insider attacks to physical tampering, while maintaining operational continuity.

Network Segmentation and Security Zones Implementation
Segmenting SCADA networks into distinct zones—such as separating field devices from corporate IT networks—reduces the attack surface and limits the spread of malware or unauthorized access. Security zones allow organizations to apply tailored policies and monitoring based on the criticality and risk profile of each segment, enhancing both operational safety and cybersecurity resilience.

Air Gap Considerations and Limitations in Modern Environments
Air-gapping—physically isolating SCADA networks from external connections—can provide strong protection against remote attacks. However, in modern industrial environments, remote monitoring, cloud analytics, and third-party integrations often make strict air-gaps impractical. Organizations must balance isolation with operational needs, supplementing partial air-gaps with strong authentication, encrypted communications, and rigorous monitoring.

Demilitarized Zones (DMZ) for SCADA Networks
DMZs act as buffer zones between SCADA networks and external systems, such as corporate IT networks or the internet. By placing intermediary servers and firewalls in the DMZ, organizations can control and inspect data flow, preventing direct access to critical industrial systems while still allowing necessary information exchange. DMZs are a key component of layered defense, reducing exposure to external threats.

Security Monitoring Across Defense Layers
Continuous monitoring is essential for detecting anomalies, intrusions, or unauthorized activity across all layers of SCADA defense. This includes monitoring network traffic, device behavior, access logs, and operational metrics. Effective monitoring enables rapid detection and response, ensuring that threats are mitigated before they can disrupt critical processes or cause physical damage.

Access Control and Authentication

Role-Based Access Control for SCADA Operations
Role-based access control (RBAC) assigns permissions based on job functions, ensuring that operators, engineers, and administrators only access the SCADA functions necessary for their roles. Implementing RBAC reduces the likelihood of human error, limits exposure of sensitive controls, and simplifies auditing and compliance. Regular review of role assignments is essential to maintain security as personnel and responsibilities change.

Multi-Factor Authentication Implementation Challenges
Multi-factor authentication (MFA) strengthens SCADA security by requiring additional verification beyond passwords, such as tokens or biometrics. However, implementing MFA in industrial environments can be challenging due to legacy systems, operational uptime requirements, and remote access needs. Balancing usability with security is critical to ensure that MFA does not disrupt time-sensitive control processes.

Privileged Access Management for Critical SCADA Functions
Privileged accounts control key SCADA operations and present significant risk if mismanaged. Effective privileged access management involves monitoring account activity, limiting the number of privileged users, enforcing strong password policies, and conducting regular audits. These practices prevent unauthorized changes to control logic and reduce the risk of insider threats or credential compromise.

Authentication Mechanisms for Field Devices
Field devices like PLCs, RTUs, and sensors require secure authentication to prevent unauthorized command injection or manipulation. Strong authentication mechanisms—including unique credentials, device certificates, and secure firmware—ensure that only trusted devices can communicate with the SCADA network, protecting the integrity of industrial processes.

Managing Vendor and Contractor Access to SCADA Systems
Vendors and contractors often need temporary access for maintenance, updates, or troubleshooting. Proper access management includes time-limited accounts, supervised sessions, detailed logging, and adherence to organizational security policies. Controlling third-party access is essential to prevent external breaches and maintain overall SCADA security.

Managing Vendor and Contractor Access to SCADA Systems
Vendors and contractors often need temporary access for maintenance, updates, or troubleshooting. Proper access management includes time-limited accounts, supervised sessions, detailed logging, and adherence to organizational security policies. Controlling third-party access is essential to prevent external breaches and maintain overall SCADA security.

Encryption and Data Protection

Protecting data in SCADA systems is essential for maintaining operational integrity and preventing unauthorized access or manipulation. Encryption and other data protection measures help ensure that sensitive information—whether in transit, at rest, or within device configurations—remains confidential and trustworthy.

Protocol Encryption Considerations for SCADA Communications
SCADA systems often rely on specialized protocols like Modbus, DNP3, or OPC, which were not designed with security in mind. Encrypting communications between devices, servers, and HMIs is critical to prevent interception, tampering, or replay attacks. Implementing encryption must balance security with real-time performance, as delays can affect operational processes.

Key Management Challenges in Distributed Environments
Managing cryptographic keys across distributed SCADA networks is complex. Field devices may have limited processing capabilities, and remote locations can make key distribution or rotation difficult. Secure key management practices—including automated key provisioning, rotation policies, and secure storage—are vital to maintaining the effectiveness of encryption across the network.

Data Integrity Verification Mechanisms
Ensuring that SCADA data remains accurate and unaltered is critical for operational safety. Mechanisms like checksums, digital signatures, and hash functions can detect tampering or corruption in sensor readings, command instructions, and historical records. Implementing integrity verification helps prevent attackers from manipulating operational data to cause unsafe conditions.

Secure Storage of SCADA Configuration and Historical Data
SCADA systems rely on configuration files, control logic, and historical process data to operate effectively. Protecting this data through encryption, access controls, and regular backups ensures that it cannot be tampered with or lost. Secure storage also supports disaster recovery and forensic investigations in the event of a security incident.

Cryptographic Controls Appropriate for Resource-Constrained Devices
Many SCADA field devices have limited computational resources, which can make standard cryptographic algorithms impractical. Lightweight cryptographic controls, optimized for low-power and low-memory environments, allow these devices to maintain data confidentiality and integrity without degrading performance or responsiveness. Choosing the right cryptography for resource-constrained devices is a key consideration in SCADA security.

Security Monitoring and Incident Response

Continuous monitoring and proactive incident response are essential for protecting SCADA systems from cyber threats. By observing system behavior in real time, organizations can quickly detect anomalies, identify potential attacks, and respond before operational disruptions occur. A structured approach to monitoring and incident response helps ensure the reliability, safety, and integrity of industrial control operations.

Security Information and Event Management (SIEM) for SCADA
SIEM solutions collect and analyze logs and events from SCADA devices, networks, and applications to provide centralized visibility into potential security incidents. By correlating data across multiple sources, SIEM systems can detect unusual patterns, alert operators to suspicious activity, and support forensic investigations. Integrating SIEM with SCADA networks enhances threat detection and accelerates incident response.

Operational Technology-Specific Monitoring Requirements
Monitoring SCADA systems requires OT-specific strategies that account for real-time processes, legacy devices, and specialized protocols. Unlike traditional IT environments, SCADA monitoring must minimize disruption to operations while detecting both cyber and physical anomalies. This includes tracking device behavior, network traffic, command sequences, and environmental data to identify potential threats.

Baseline Establishment for Normal SCADA Operations
Establishing a baseline of normal SCADA activity is critical for identifying deviations that may indicate cyberattacks or operational issues. This baseline includes typical network traffic patterns, device communication behavior, command sequences, and process metrics. Continuous comparison against the baseline allows security teams to quickly detect and investigate anomalies, improving both threat detection and operational reliability.

Security Governance for Industrial Control Systems

Effective governance ensures that SCADA security is not an afterthought but an integral part of industrial operations. By defining clear policies, roles, and processes, organizations can systematically manage risk, maintain compliance, and embed security throughout the SCADA lifecycle.

Security Policies Specific to SCADA Environments
SCADA-specific security policies provide guidelines for protecting industrial control systems, covering areas such as access control, network segmentation, patch management, and incident response. These policies establish consistent expectations for staff, vendors, and contractors, ensuring that operational and cybersecurity requirements are aligned.

Roles and Responsibilities in SCADA Security Management
Clearly defined roles and responsibilities are critical to prevent gaps in SCADA security. Operators, engineers, IT/OT security teams, and management must understand their specific duties—ranging from system monitoring to vulnerability remediation—to maintain the integrity and safety of industrial processes. Accountability and communication across teams strengthen overall security posture.

Change Management Procedures for Control Systems
SCADA systems require controlled and documented changes to hardware, software, and configurations to prevent unintended disruptions or security vulnerabilities. Formal change management procedures ensure that updates, patches, or system modifications are reviewed, tested, and approved before implementation, reducing operational risks and maintaining compliance.

Security Metrics and Key Performance Indicators
Tracking security metrics and KPIs allows organizations to measure the effectiveness of SCADA security programs. Metrics may include incident response times, patch deployment rates, access violations, and anomaly detection frequency. Regularly reviewing these indicators helps identify weaknesses, prioritize improvements, and demonstrate regulatory compliance.

Integration of Security into SCADA Lifecycle Management
Security should be integrated at every stage of the SCADA lifecycle, from design and procurement to operation and decommissioning. Incorporating security considerations early—such as secure device selection, network architecture planning, and ongoing monitoring—ensures that protection is embedded rather than retrofitted, enhancing resilience against cyber and operational threats.

Compliance and Standards

Adhering to industry standards and regulatory requirements is critical for ensuring SCADA security, operational reliability, and legal compliance. These frameworks provide guidance for risk management, access control, monitoring, and incident response, helping organizations protect industrial control systems against evolving threats.

IEC 62443 (Formerly ISA99) for Industrial Automation
IEC 62443 is a widely recognized international standard for the cybersecurity of industrial automation and control systems. It covers the entire lifecycle of SCADA systems, including secure design, development, operation, and maintenance. IEC 62443 provides guidelines for risk assessment, network segmentation, access control, and supplier security, offering a comprehensive framework for securing industrial environments.

NERC CIP Requirements for Energy Sector SCADA
The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards establish mandatory cybersecurity requirements for the energy sector. These standards focus on protecting bulk electric systems, including SCADA networks, by enforcing strict controls over access, monitoring, incident response, and system recovery. Compliance with NERC CIP is essential for energy providers to ensure reliable and secure power delivery.

NIST Special Publication 800-82 Implementation
NIST SP 800-82 provides guidance on applying the NIST Cybersecurity Framework to industrial control systems, including SCADA. It outlines strategies for protecting OT environments, integrating IT and OT security practices, and managing risk in operational contexts. Organizations can use this publication to develop security policies, deploy appropriate controls, and strengthen resilience against cyber threats.

Industry-Specific Regulatory Requirements
Beyond international and national standards, many industries have sector-specific regulations that impact SCADA security. For example, water utilities may need to comply with EPA regulations, healthcare facilities must adhere to HIPAA requirements, and manufacturing plants may follow ISO 27001 for information security. Understanding and implementing these requirements ensures both compliance and the protection of critical infrastructure.

Security Awareness and Training

Human factors play a critical role in SCADA security. Even the most advanced technical controls can be undermined by untrained personnel or poor security practices. Building awareness and providing targeted training ensures that all staff understand the risks and act in ways that protect industrial control systems.

Operator Training for Security-Conscious Operations
Operators are on the front lines of SCADA system management, monitoring processes and responding to alerts. Security-focused training helps them recognize suspicious activity, understand secure operational procedures, and respond effectively to potential incidents without compromising operational continuity. Well-trained operators are a key line of defense against both accidental and malicious threats.

Engineering Staff Security Awareness Programs
Engineering teams design, maintain, and update SCADA systems, making them critical to overall security. Awareness programs for engineers emphasize secure coding, configuration best practices, vulnerability management, and compliance with relevant standards. By embedding security knowledge into engineering practices, organizations reduce the risk of exploitable system weaknesses.

Security Culture Development in Operational Technology Environments
A strong security culture in OT environments promotes shared responsibility, proactive risk management, and consistent adherence to policies. Encouraging collaboration between IT, OT, and operational staff fosters an environment where security considerations are integrated into daily decision-making, helping prevent breaches and maintain resilient SCADA operations.

Some Final Thoughts

Securing SCADA systems is no longer optional—it’s a critical requirement for protecting industrial operations, critical infrastructure, and public safety. From access control and encryption to monitoring, governance, and regulatory compliance, a layered and proactive approach is essential to defend against evolving cyber threats. By implementing best practices and leveraging advanced solutions, organizations can safeguard their SCADA environments while maintaining operational continuity.

To see how Waterfall Security’s specialized SCADA protection solutions can help defend your industrial control systems, contact us today.

About the author
Picture of Waterfall team

Waterfall team

FAQs About SCADA Security

SCADA security refers to the measures and practices used to protect Supervisory Control and Data Acquisition (SCADA) systems, which control and monitor industrial processes in critical infrastructure like power plants, water treatment facilities, manufacturing plants, and transportation networks.

The goal of SCADA security is to ensure the confidentiality, integrity, and availability of these systems while maintaining safe, continuous operations. Unlike traditional IT security, SCADA security must balance cybersecurity with operational requirements, since disruptions can directly affect physical processes and safety.

Key aspects of SCADA security include:

  • Access control and authentication for operators, engineers, and field devices

  • Encryption and data protection for communications and stored data

  • Network segmentation and monitoring to detect and respond to threats

  • Compliance with standards and regulations like IEC 62443 and NIST SP 800-82

  • Security awareness and training for personnel interacting with SCADA systems

In short, SCADA security safeguards the systems that keep critical industrial operations running reliably and safely.

SCADA systems are essential to the operation and safety of multiple critical infrastructure sectors, including:

  • Energy: Power generation, electrical grids, and oil & gas refineries rely on SCADA to monitor and control equipment, maintain grid stability, and manage production processes.

  • Water and Wastewater Utilities: Treatment plants use SCADA to regulate chemical dosing, flow rates, and overall system performance, ensuring safe water supply.

  • Manufacturing and Industrial Production: Automated production lines, robotics, and process controls depend on SCADA for efficiency and quality management.

  • Transportation and Logistics: Rail networks, ports, traffic systems, and pipelines use SCADA to coordinate operations safely and reliably.

  • Healthcare and Life-Critical Systems: SCADA supports facilities that require precise monitoring of medical gases, HVAC systems, and other critical operational infrastructure.

These sectors rely on SCADA because any disruption can have wide-reaching operational, safety, or economic consequences, making SCADA security a top priority.

Share

Trending posts

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

Tags

The post SCADA Security Fundamentals appeared first on Waterfall Security Solutions.

]]> Andrew Ginter’s Top 3 Webinars of 2024 https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/andrew-ginters-top-3-webinars-of-2024/ Tue, 17 Dec 2024 11:38:14 +0000 https://waterfall-security.com/?p=29379 Get up to speed on key trends and strategies in industrial security with Andrew Ginter’s favorite webinars of 2024,

The post Andrew Ginter’s Top 3 Webinars of 2024 appeared first on Waterfall Security Solutions.

]]>
OT Insights CenterOT security standardsAndrew Ginter’s Top 3 Webinars of 2024

Andrew Ginter’s Top 3 Webinars of 2024

Discover Andrew Ginter’s top picks for the most insightful and engaging webinars of 2024, covering key trends and strategies in industrial security.
Picture of Andrew Ginter

Andrew Ginter

As 2024 comes to a close, it’s traditional to reflect on the and maybe catch up on bits of reading and events that we missed throughout the year because of our busy schedules. To this end, I recommend to you three of this year’s Waterfall webinars, each an overview of Waterfall or other authors’ reports that read faster when we’ve seen an overview, so each of us can skip faster to the material we find most potentially useful.

My Top Three Webinars of 2024:

1) Cyber Attacks with Physical Consequences – 2024 Threat Report

By the numbers –Waterfall & ICS Strive produce the world’s most conservative and most credible OT / industrial security threat report. In this webinar the authors review the numbers – public disclosures of attacks with physical consequences. And we look at what the numbers mean for the practice and future of industrial cybersecurity.

To read further, the threat report is available here.

2) IEC 62443 for Power Generation

The IEC 62443 standards are cross industry, somewhat out of date, and deliberately vague in many areas – and so need to be interpreted to apply them successfully. In this webinar, Dr. Jesus Molina provides an overview of his report that shows how to interpret and apply the standards to conventional electric power plants.

To read further, the IEC 62443 for Power Generation report is available here.

3) Evolving Global OT Cyber Guidelines

This webinar is a favorite of mine because of big turnout and the thoughtful questions and comments from the audience. In this webinar, we explore the latest developments in OT cybersecurity regulations, standards and guidance worldwide and what these developments mean for industries navigating this complex landscape.

If you would like to read more, I recommend the brand new, multi-national Principles of OT Security – it’s good, and with only 9 pages of payload, it’s an easy read over the holidays.

These are my top 3. If you would like to see even more of our videos, I encourage you to subscribe to the Waterfall Youtube channel where we upload new videos regularly.

Share

Trending posts

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

Tags

The post Andrew Ginter’s Top 3 Webinars of 2024 appeared first on Waterfall Security Solutions.

]]> Andrew Ginter’s Top 3 Podcast Episodes of 2024 https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/andrew-ginters-top-3-podcast-episodes-of-2024/ Mon, 16 Dec 2024 15:12:04 +0000 https://waterfall-security.com/?p=29337 Sit back and enjoy Andrew Ginter's top 3 picks from 2024's Industrial Security Podcast series.

The post Andrew Ginter’s Top 3 Podcast Episodes of 2024 appeared first on Waterfall Security Solutions.

]]>
OT Insights CenterOT security standardsAndrew Ginter’s Top 3 Podcast Episodes of 2024

Andrew Ginter’s Top 3 Podcast Episodes of 2024

As 2024 winds down, kick back and enjoy some of Andrew Ginter's best podcast picks

Andrew GinterOver the past 12 months, it has been a pleasure and a privilege to co-host the Industrial Security Podcast. When I started the podcast 5-ish years ago, bluntly, I did not know if there was enough industrial security content in the world for more than a year or two of episodes. It turns out the OT security space is much broader and deeper than I knew, and I’ve both learned something in every episode and become aware of how much more that I don’t know that every one of my guests do know and give us a few insights based on that knowledge in every episode.

Choosing three from this year’s episodes was hard, but here are three that stood out for me. If you ask me for a theme for these episodes, I’d have to say all three provide insights into high-consequence attacks, risk blind spots, and of course defenses against these attacks. This is all consistent with the perspective of the Cyber-Informed Engineering initiative and with the themes I explore in my latest book, Engineering-Grade OT Security: A Manager’s Guide.

I hope you enjoy listening to these podcasts as much as I enjoyed the interviews and discussions. And stay tuned, we are working on many more guests and discussions in 2025!

My Top Three Episodes of 2024:

Episode #134: Insights into Nation State Threats with Joseph Price

In this episode, Joseph Price nation-state threats and attacks. Nation states are often held up as “bogeymen,” able to do anything to anyone for reasons that are opaque to mere mortals. Joseph peels back a couple layers for us, explaining how to interpret the data is available in the public domain. He walks us through what to expect in terms of attack capabilities, how the world’s superpowers routinely test each other’s defenses, responses and capabilities in both physical and cyber domains, and looks at what this means for both small and large infrastructure sites and defensive programs.

Episode #123: Tractors to Table Industrial Security in the Industry of Human Consumables with Marc Sachs

In this episode, Marc Sachs, Senior Vice President and Chief Engineer at the Center for internet Security, Chief Security Officer for Pattern Computer, and a former White House National Security Council Presidential Appointee, takes a deep dive into the cybersecurity challenges facing the food production industry.

He examines the industry’s growing reliance on automation, from farmers leveraging GPS, drones and self-driving equipment to large-scale food production facilities dependent on interconnected systems. While these advancements have dramatically improved efficiency and productivity, automation has also created important new vulnerabilities. Marc walks us through real-world examples of cyber threats targeting this critical industry, the potential consequences of a future attacks, and practical measures that organizations can take to bolster their defenses.

This episode provides an eye-opening look at how completely automated the high end of agriculture and food production has become, and how this is a problem as more and more operations deploy this kind of automation.

Episode #131: Hitting Tens of Thousands of Vehicles At Once with Matt MacKinnon

In this episode, Matt MacKinnon, Head of Global Strategic Alliances at Upstream Security, looks at a cybersecurity niche in the automotive industry that I did not know existed: protecting the cloud systems that vehicle manufacturers rely on to manage and interact with the vehicles they produce. From passenger cars to 18-wheelers and massive mining equipment, connected vehicles enable everything from diagnostics and updates to real-time remote control.

Matt explains how digital transformation and the pervasive use of cloud systems in automotive and heavy equipment industries has introduced new attack opportunities, with potential consequences ranging from unauthorized manipulation of vehicular systems, data breaches, and potential threats to safe and reliable operations.

How to manage these risks and protect cloud systems connected to vehicles? Matt walks us through protective technology and how it works – technology I did not know existed.

Share

Trending posts

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

Tags

The post Andrew Ginter’s Top 3 Podcast Episodes of 2024 appeared first on Waterfall Security Solutions.

]]> Cybersecurity Approaches Unique to OT Security https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/cybersecurity-approaches-unique-to-ot-security/ Thu, 15 Aug 2024 09:08:28 +0000 https://waterfall-security.com/?p=25884 The engineering profession has powerful tools to address physical risk, tools that should be applied to OT cyber risks much more routinely than they are today. For example: mechanical over-pressure relief valves prevent boilers from exploding for any reason, cyber attack or otherwise. These powerful tools are too often neglected for cyber threats because they have no analogue in IT security – they not even mentioned in most cybersecurity standards, regulations and advice.

The post Cybersecurity Approaches Unique to OT Security appeared first on Waterfall Security Solutions.

]]>
OT Insights CenterOT security standardsCybersecurity Approaches Unique to OT Security

Cybersecurity Approaches Unique to OT Security

The engineering profession has powerful tools to address physical risk, tools that should be applied to OT cyber risks much more routinely than they are today. For example: mechanical over-pressure relief valves prevent boilers from exploding for any reason, cyber attack or otherwise. These powerful tools are too often neglected for cyber threats because they have no analogue in IT security – they not even mentioned in most cybersecurity standards, regulations and advice.
Picture of Andrew Ginter

Andrew Ginter

Cybersecurity approaches unique to OT security

The engineering profession has powerful tools that address physical risk, tools that should be applied to OT cyber risks much more widely than they are today.  For example, mechanical over-pressure valves prevent pressure vessels from exploding. These valves contain no Safety valveCPUs and are therefore un-hackable.  Torque-limiting clutches prevent turbines from disintegrating, contain no CPUs, and are thus un-hackable. Unidirectional gateways are physically able to send information in only one direction and are physically unable to send attack information in the other direction. Today, these powerful tools are too often neglected because they have no analogue in the IT security space, and are not mentioned in almost all cybersecurity standards, regulations and advice published over the last two decades.

Digging deeper, the engineering profession has managed risks to public safety for over a century. It is because poor engineering poses risks to public safety that the engineering profession is a legislated, self-regulating profession in many jurisdictions, similar to the medical and legal professions. The engineering profession has an enormous contribution to make to managing OT cyber risks, but this is poorly understood both inside and outside the profession.

Engineering Obligations for Cybersecurity

Why? In part, this is because are perhaps fifty times as many IT security practitioners in the world as OT security practitioners, thus IT experts are often the first people consulted when we need industrial cybersecurity solutions. Most IT security experts, however, are not engineers and so are not aware of the responsibilities of, nor the contributions that can be made by, the engineering profession.

The profession itself is not much better off. If cyber attacks with physical consequences continue doubling annually, then the OT cyber problem will reach crisis proportions before the end of the decade. In most jurisdictions however, the engineering profession has not yet come to grips with these risks to public safety. At this writing, it is unclear whether there has ever been a case of an engineer being disciplined or losing their license for failing to apply robust cyber risk management to industrial designs that involve public safety or national security. While some jurisdictions, such as the United Kingdom, have added “cybersecurity and data protection” to their code of ethics, most engineers are still not aware of the rapidly changing societal expectations for industrial cybersecurity in their practices.

Engineering Approaches to OT Security

There is progress though. In the last half decade, several approaches to robust security engineering have emerged:

  • Process engineering: The ISA’s Security PHA Review textbook documents an approach for using routine Process Hazard Analysis engineering outputs to help design unhackable physical mitigations for cyber threats to worker, environmental and public safety,
  • Automation engineering: The Countering Cyber Sabotage – Introducing Consequence-driven Cyber-informed Engineering (CCE) textbook is primarily about risk assessment, but includes several chapters on unhackable mitigations for cyber threats, including unhackable digital mitigations for cyber threats to equipment protection, and
  • Network engineering: my own Secure Operations Technology (SEC-OT) Appendix in my latest text Engineering-Grade OT Security – A manager’s guide describes the engineering perspective of protecting correct physical operations from cyber-sabotage attacks embedded in incoming online and offline information flows.

In this theme, the US Department of Energy (DOE) also released a National Cyber-Informed Engineering Strategy (CIE) in 2022, and CIE Implementation Guide in 2023. These developments, the CIE initiative and the CIE perspective are arguably the most important advances in OT Security since the Gartner Group coined the phrase “OT Security” in 2005. The CIE initiative is developing an engineering body of knowledge to, among other things, “use design decisions and engineering controls to mitigate or even eliminate avenues for cyber-enabled attack or reduce the consequences when an attack occurs.”

“This makes so much sense. Why is this new? This shouldn’t be new. Why have we not been looking at the problem this way since the beginning?”

Why Is This New?

All these initiatives are long overdue. When I explain these opportunities, perspectives and opportunities to stakeholders from engineering teams to enterprise security teams and boards of directors, the single most common response is something like:

“This makes so much sense. Why is this new? This shouldn’t be new. Why have we not been looking at the problem this way since the beginning?”

Now, to be fair, many of the actual engineering techniques we’re talking about are not new – they are very old. Safety engineering has been with us for a very long time, as has protection engineering. But using these and other powerful tools universally and systematically to address cyber risk – in addition to other threats to safe and reliable operations – this is new. Applying the perspective of the engineering profession to these problems is new, whether it should be or not.

The future is bright for OT Security seen through the lens of engineering for safety, reliability and critical infrastructure / national security imperatives. I encourage you and all OT security practitioners, engineers or enterprise security, to become aware of and start using CIE, the engineering perspective and engineering-grade defenses to improve and simplify OT security.

For more information on this topic, please request your free copy of this author’s latest textbook Engineering-Grade OT Security – A manager’s guide.

Get your complimentary copy now
About the author
Picture of Andrew Ginter

Andrew Ginter

Andrew Ginter is the most widely-read author in the industrial security space, with over 23,000 copies of his three books in print. He is a trusted advisor to the world's most secure industrial enterprises, and contributes regularly to industrial cybersecurity standards and guidance.
Share

Trending posts

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

Tags

The post Cybersecurity Approaches Unique to OT Security appeared first on Waterfall Security Solutions.

]]> All Time Favorite Podcast Episodes: Andrew Ginter’s Top Picks https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/andrews-favorite-podcasts/ Tue, 26 Dec 2023 14:13:34 +0000 https://waterfall-security.com/?p=14973 Andrew Ginter shares with us his top 5 favorite podcast episodes from the Industrial Security Podcast that he co-hosts

The post All Time Favorite Podcast Episodes: Andrew Ginter’s Top Picks appeared first on Waterfall Security Solutions.

]]>
OT Insights CenterOT security standardsAll Time Favorite Podcast Episodes: Andrew Ginter’s Top Picks

All Time Favorite Podcast Episodes: Andrew Ginter’s Top Picks

Five of Andrew's favorite podcasts to enjoy as 2023 comes to an end, and 2024 begins.
Picture of Waterfall team

Waterfall team

Top 5 Podcast Episode - Happy Holidays

I was asked to put a few words together about my favorite Industrial Security Podcast episodes of all time. I scanned the complete list at https://waterfall-security.com/podcast and came up with these five. The first four were episodes that contributed materially my thinking & the formation of sections and chapters in my latest “gold” book Engineering-Grade OT Security: A manager’s guide.

The fifth didn’t really fit the gold book, but I’m mulling the episode over for possible inclusion in my next book, if there is one. The gold book was all about risk in the context of individual organizations. For the future, I’m wondering if the world needs a bigger picture book of where OT cyber risk fits into the context of “all risks” that modern societies face, from nuclear war and EMPs to massive solar storms and global warming. I dunno for sure, please let me know what you think. 

“If you have time over the Christmas break and are looking for a podcast or five to make you think – full of ideas that will challenge your current understanding of the OT/industrial security space – these are the episodes I recommend.”

Get your complimentary copy now

My top five episodes:

Episode #28: Unhackable Safeguards with James McGlone

James is a co-author of Security PHA Review, a brilliantly-written book on using Process Hazard Analysis / HAZOP spreadsheets & concepts to improve cybersecurity with unhackable / engineering-grade mitigations.

 

 

 

Episode #68: Capabilities vs. Probabilities with Mark Fabro
Mark explains capabilities-based risk vs. older and murkier likelihood-based models, and uses capabilities to introduce cyber Design-Basis Threat (cDBT) – a way to eliminate “risk-based” hand waving.

 

Episode #85: Cyber Insurance is Changing Fast with Georgina Williams

Georgina walks us through changes in the insurance industry triggered by NotPetya and the $1.4 billion USD Merck Pharma payout. For many, OT cyber insurance is not the “one stop” solution it once was.

 

Episode #100: Engineering-Grade Security in the CIE Strategy with Cheri Caddy
Cheri led the US DOE / INL Cyber-Informed Engineering Strategy. Feedback I’ve heard from practitioners suggests the CIE Strategy might just be the single best thing to happen to OT cybersecurity, ever.

Episode #96: Consequences Matter with Danielle Jablanski
Danielle walks us through the very big picture. It is not just worst-case consequences that determine government policy & regulations, but also society’s ability to respond to different kinds of worst-case attacks.

 

If you have time over the holidays and are looking for a podcast (or five) to make you think – full of ideas that will challenge your current understanding of the OT/industrial security space – these are the episodes I recommend.

Get your complimentary copy now
Share

Trending posts

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

Tags

The post All Time Favorite Podcast Episodes: Andrew Ginter’s Top Picks appeared first on Waterfall Security Solutions.

]]> Engineering Grade Protection for Data Center OT Systems https://waterfall-security.com/ot-insights-center/facilities/engineering-grade-protection-for-data-center-ot-systems/ Thu, 14 Sep 2023 09:15:51 +0000 https://waterfall-security.com/?p=11222 Uptime is a very important Key Performance Indicator (KPI) for data centers, and the physical infrastructures in data centers are essential to uptime – electric power systems, backup power, fire suppression, physical access control, cooling and more.

The post Engineering Grade Protection for Data Center OT Systems appeared first on Waterfall Security Solutions.

]]>
OT Insights CenterFacilitiesEngineering Grade Protection for Data Center OT Systems

Engineering Grade Protection for Data Center OT Systems

Protecting Data Centers From Industrial OT Threats
Picture of Andrew Ginter

Andrew Ginter

Engineering Grade Protection for Data Center OT Systems by Andrew Ginter, VP Industrial Security

Uptime is a very important Key Performance Indicator (KPI) for data centers, and the physical infrastructures in data centers are essential to uptime – electric power systems, backup power, fire suppression, physical access control, cooling and more. Managing cybersecurity for these infrastructures is different from managing security for information systems – while problems with a new software version or security update can be “backed out” to preserve uptime, damaged high-voltage transformers and cavitation damage to cooling systems cannot be restored from backups.

Cyber-Informed Engineering

This means that the physical infrastructure of data centers is more of an engineering domain than an information processing domain. While the engineering profession has been criticized for being slow to embrace cybersecurity risks and solutions, a new initiative is changing that. The Cyber-Informed Engineering (CIE) initiative at the Idaho National Laboratory is (1) working to make the engineering profession much more aware of cybersecurity issues and solutions and (2) working to apply powerful engineering techniques to cyber risks – techniques and technologies that have historically been used to address only physical threats. For example – mechanical vibration sensors electrically connected to a large cooler’s cut-off switch can be used as a last-resort safety system, protecting cooling systems from damage. Large cooling systems that move liquids risk cavitation damage if they are operated at too high a speed. A mechanical fail-safe eliminates the risk of damage to the cooler when a cyber attack both mis-operates the cooler and disables the cyber safeties designed to protect the cooler from damage.

Network Engineering

Network engineering is part of this new CIE initiative. Network engineering uses engineering-grade protections to prevent cyber attacks from entering data center OT networks in the first place. This is important because data centers are all about uptime and reliability. In the cooler example above, what happens when mechanical fail-safes engage to protect the cooler? Things shut down – the infrastructure that is essential to continuous data center operations is shut down to protect it from damage. It is a good thing that engineering-grade measures prevent threats to worker safety and equipment damage. But if we want our uptime preserved, we need more. We need to prevent cyber attacks from entering OT networks in the first place and triggering these fail-safe shut-downs.

While network engineering includes a number of engineering-grade tools for the prevention of cyber attacks from entering OT networks, the most widely-applicable tool is the unidirectional gateway. The gateways are deployed at consequence boundaries – connections between networks with physical consequences vs. networks with only business consequences. In data centers, the gateways are deployed most commonly at IT/OT interfaces. Unlike software firewalls, hardware-enforced unidirectional gateways provide engineering-grade unidirectionality – OT data is copied to IT networks in real time, with zero risk that cyber attacks (like ransomware) from IT can penetrate through the gateways back into OT networks to put uptime at risk, or to put the physical equipment that is essential to uptime at risk.

“…hardware-enforced unidirectional gateways provide engineering-grade unidirectionality – OT data is copied to IT networks in real time, with zero risk that cyber attacks from IT can penetrate through the gateways back into OT networks.”

The World Is Changing

Data centers are changing the world, and the world is changing around data centers. Environmental and climate concerns are driving change to the design of computers, power systems, power supplies, cooling systems and many other aspects of data centers. Concerns about the rapid increase in cyber attacks with OT / physical consequences are driving a push towards engineering-grade protections for worker safety, for equipment protection, and for network protection in OT systems. Data center owners and operators are responding to all of these changes – because reducing environmental impacts and reducing cyber threats to uptime are both essential to competitiveness in a very demanding industry. The increased use of unidirectional gateway technology is a reflection of the latter trend – at the junction of engineering and cybersecurity.
Get your complimentary copy now
Share

Trending posts

Stay up to date

Subscribe to our blog and receive insights straight to your inbox

Tags

The post Engineering Grade Protection for Data Center OT Systems appeared first on Waterfall Security Solutions.

]]>