Enhancing Your Operational Technology Resiliency

Maintaining cyber resilience across your ecosystem is a significant challenge that must not be brushed aside as the likelihood of experiencing a cyber incident increases year after year. For example, in 2021 alone, there were multiple attacks on Critical National Infrastructure (CNI) such as Colonial Pipeline and against the Oldsmar, Fla. water treatment plant.

Based on this and the potential global impacts of CNI and other types of attacks, we believe it is vital to share Trustwave's Cyber Advisory perspective to offer prioritized actions that you can take to improve their OT cyber resiliency. 

For CNI, digital transformations, cloud migrations and the convergence of information technology (IT) and operational technology (OT) exacerbate the problem. This transformation means modern enterprise networks and infrastructures are more complex and vulnerable than the previously isolated industrial control system (ICS) networks. 

The well-publicized nation-state attack on Colonial Pipeline in May 2021; emphasized the fact that unidentified and unmitigated vulnerabilities, especially within OT and CNI continue to challenge organizations' cyber resilience. 

In response, President Joe Biden issued Executive Order 14028 in May 2021, shortly after the Colonial Pipeline event, to improve consistencies and protection across the U.S. CNI. Similarly, in Europe, the European Union Agency for Cybersecurity (ENISA) issued the Network and Information Systems Directive (NISD), a specific cybersecurity legislation with a monetary fine structure similar to GDPR for organizations with poor security. 

So, what do all these new measures mean for your organizations, and how can you improve OT resilience? 

The Colonial Pipeline ransomware attack can be considered the most serious, real-world nation-state espionage attack on CNI. Assessing and remediating the impacts of those attacks and preparing enterprises for similar incidents is challenging given the complexities involved. Still, there are approaches that can help you prioritize and prepare. 

Your Systems Will Be Breached

These recent attacks provide a powerful reminder that companies in every country are at risk and need protection.

Given the nature of such attacks, such as the Colonial Pipeline attack and the Oldsmar attack, we recommend that all organizations look to build resilience and develop a layered defense based on the principle that an attacker will someday breach your system. 

When one starts from the premise that a breach is inevitable, it changes mindsets to being cyber prepared and starts to build cyber resiliency through establishing a strong security culture. Then, the question becomes how to prevent a breach and how to mitigate or deter an attacker's ability to exploit the information they have accessed and how to recover from the breach. 

Organizations Continue to Tolerate Known Weaknesses

The 2021 CNI attacks, along with the massively destructive 2017 NotPetya ransomware attack, all had one thing in common. In each case, the attacker exploited weaknesses that were tolerated by the affected organizations. 

Unfortunately, this tolerance has led the cybersecurity industry to describe such supply chain intrusions as "extremely sophisticated," indicating "nation-state capability."

This over-used terminology essentially helps cover up the industry's collective embarrassment and implies that there is little we can do to prevent such attacks. But this is not true.

Whilst preventing such attacks may well be challenging, preparing for such events are well within your control. Visibility into your OT estate is key; without understanding what you have, identifying your vulnerabilities and thus being able to secure your critical assets will be near impossible. Therefore, your IT and OT security maturity baselines, including governance, risk management, and security programs, must be aligned. 

The Board Can Help Drive Change 

An organization's Board of Directors can promote and inspire cultural shifts within your organization to ensure cyber resilience occurs in every business unit by asking the right questions and having the proper level of community collaboration. The board is ultimately responsible for the oversight of cyber risk and enterprise cyber resilience, so these people need to understand that basic resilience planning, business continuity, and disaster recovery are crucial to building cyber resilience for both your IT and OT estate. 

What Can You Do? 

As organizations upgrade infrastructure, incorporate new technologies and bring together OT and IT networks, highly vulnerable OT and ICS systems must be maintained and protected within modern, heterogeneous network environments. As a result, challenges are emerging for security and operations teams. 

Ultimately, cyber resilience can only be obtained through large-scale and continual collaboration and partnership. To accomplish this task requires that a variety of stakeholders together across the enterprise as well as with your peers and suppliers. To achieve an adequate level of resilience across the ecosystem, businesses must embed the concept of cyber resilience within their business-resilience planning. 

Here are some prioritized actions that Trustwave advises you take now: 

• Effective oversight of cyber risk and resilience. Boards must take ownership of primary oversight of cyber risk and resilience. The directors must establish risk or cybersecurity committees that will help support this ownership and accountability. This ownership should also be combined with an established program of continuing education on cybersecurity and resilience for the entire board, as well as hosting a cyber resilience orientation program for all newly promoted directors. Communicating these best practices regularly through training, communication awareness, and tests across the organization will, in turn help promote a proper cyber-hygiene culture.
• Having the proper organizational governance in place. Assign accountability for cyber resilience to a senior corporate officer or Chief Information Security Officer (CISO) who manages and owns all aspects of cyber resilience. It is imperative that this person have direct access to the board to discuss cyber resilience on a regular cadence on issues like; your security organizational structure, IT and OT risks, and incident response preparedness.
• Conducting regular cybersecurity preparedness exercises at the board level. The organization must hold preparedness exercises in conjunction with providers and vendors, including systemic failure and recovery. In addition, the security team must schedule regular internal or external reviews of the organization's cyber preparedness and maturity baselining for reporting to and interactive discussions with the board. Ensure that the organization's cyber-resiliency mechanisms are subject to independent pen-testing regularly and that the results of and recommendations from these reviews are incorporated into the board's strategic and tactical cyber-resilience planning and roadmaps.
• Assess and prioritize. Provide and maintain a list of critical/high strategic cyber and financial risk exposures related to corporate IT, OT and Internet of Things (IoT) environments and supplier/business partners with cyber loss reduction measures and investments. Define and quantify the business risk tolerance relative to cyber resilience in collaboration with other business units. 

Without a shared understanding and visibility of your OT risks, public and private sector leaders will struggle to implement appropriate countermeasures to mitigate them. Therefore, it is crucial for all stakeholders in the value chain to embrace a collaborative and risk-informed cybersecurity approach to adapt and ensure a secure ecosystem.