Enhancing the Cybersecurity of ICS/SCADA Systems

Industry Perspectives

A large number of government agencies and private organizations have supervisory control and data acquisition (SCADA) or industrial control systems (ICS). While they offer several benefits, these technologies also come with significant security challenges. In a  Forrester survey commissioned by Fortinet, nearly six in 10 surveyed organizations using SCADA or ICS indicated that they experienced a breach in those systems in the past year.

Part of the challenge is that these systems are being used to manage not only their traditional OT (operational technology) infrastructures but also a host of new Industrial Internet of Things (IIoT) devices. What's more, many of those organizations are adding to their risk by providing new technologies and partners with a high level of access into their systems. In addition, most organizations now report developing connections between their traditional IT systems and their ICS/SCADA, introducing the potential for outside hackers to penetrate into these control systems.

What is ICS/SCADA?

Though ICS/SCADA systems were once primarily used by electric and water utilities, many organizations have begun using these technologies to automate data collection and related equipment. Transparency Market Research predicts the global ICS market alone will grow to $81 billion in 2021. This is not surprising when considering how industrial control systems have become widely used in manufacturing, at seaports, in water treatment plans, in oil pipelines, in energy companies, and in building environmental control systems. At the same time, SCADA systems, which serve as the graphical user interface into ICS, are growing at an annual growth rate of 6.6%.

ICS/SCADA Is Becoming a Priority Target for Cyber Attacks

Consequently, ICS/SCADA technologies and related IIoT devices have become high-value targets for hackers looking to disrupt business operations, collect ransom, or compromise a rival nation's critical infrastructure. Per the Forrester study noted above, while a staggering 56% of organizations using ICS/SCADA reported a breach in the past year, what’s even more astonishing is that only 11% indicate that they have never been breached.

Easy access to ICS/SCADA by third parties is a major part of the problem. Many organizations place a lot of trust in the security of their technology vendors and other outside organizations by giving them wide access to their internal systems. In fact, more than six in 10 organizations surveyed by Forrester give either complete or high-level access to partner or government organizations. As a result of this trust, ICS/SCADA operators face serious risks, many of their own design.

The Forrester survey also asked organizations operating ICS/SCADA about their most serious security threats. More than three-quarters of organizations acknowledge being very or extremely concerned about outside malware. Seven in 10 are very or extremely concerned about internal hackers, the leakage of sensitive data and external hackers.

Not only are ICS/SCADA breaches common, but they also have serious repercussions. Unlike traditional IT networks, OT networks often manage and control systems where a compromise can have potentially devastating consequences. A compromised IoT device that monitors inventory represents a very different threat than an IIoT device monitoring or managing a temperature control system on a 50,000-gallon boiler at a chemical plant.

As a result, 63% of organizations say the safety of their employees was highly or critically affected by a ICS/SCADA security breach. Another 58% report major impacts to their organization's financial stability, and 63% note a serious drag on their ability to operate at a sufficient level.

Addressing ICS/SCADA Cybersecurity and Compliance

There are a variety of responses to these security issues. Nearly half of surveyed organizations see a full business or operational risk assessment as the top way to improve their risk posture as OT and IT systems converge. Other common approaches for mitigating risk include implementing common standards, increasing the centralization of device management, and consulting government bodies such as the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Compliance with industry and security standards is another top concern.

Four Steps Toward Greater ICS/SCADA Cybersecurity

ICS/SCADA operators can take several steps to protect their assets, even as they consider what security measures to spend their budget on. These include:

1. Securing the network infrastructure, including switches, routers, wireless networks, and IoT/IIoT devices, as well as appropriately hardening devices by turning off or disabling unused ports and/or features.
2. Segmenting networks by, where possible, separating connected wireless and IoT/IIoT technologies from the SCADA/ICS deployment.
3. Applying identity and access management policies to control and monitor outsiders who may need to access the network, to prevent employees from accessing parts of the network they don't need to access, and to control and manage IoT/IIoT devices being connected to the network.
4. Deploying endpoint protections to IoT and other devices to establish visibility into threats.

Security considerations for ICS/SCADA take on a higher priority than those for traditional IT systems due to the potential impact of an attack on the physical safety of employees, customers, or communities. Because the potential repercussions of a breach are so serious, the need to maintain compliance is also high. Fortunately, organizations can significantly improve their security posture and thereby reduce their risks by taking a multilayered approach to ICS/SCADA security.

This byline originally appeared in Dark Reading.

Access or download the full “Independent Study Pinpoints Significant SCADA/ICS Cybersecurity Risks” 

Read more about the unique challenges of securing Operational Control (OT) environments and how Fortinet can help.