Search

The article discusses the threats posed by vendor and version lock to industrial cybersecurity. It highlights the overreliance on original equipment manufacturers (OEMs) and outdated software in operational technology industrial control system (OT/ICS) environments, which can lead to vulnerabilities and uniform risks across systems. To mitigate these risks, organizations are advised to prioritize vendor-neutral solutions, open standards, and alternative cybersecurity controls. The article also emphasizes the need to bridge the gap between IT and OT and to adopt a collaborative, OT-centric approach to cybersecurity. [Extracted from the article]

When establishing and testing a brand new cybersecurity program, it can be difficult to know exactly which steps are reasonable to take and when to take them. In this blog, we will talk about when to begin thinking about a penetration test, and considerations to make when you've decided it's time to order one for your industrial control systems (ICS) and operational technology (OT) environments. [Extracted from the article]

Creating an incident response plan for OT systems They concluded by talking about creating an incident response plan for OT. Hindman and Golden then walked RSA attendees through the basics of protecting OT/ICS systems. The pair finished by imploring attendees that they too can: Automate OT asset inventory and vulnerability correlation Adopt an OT patch management strategy Implement mitigating controls supporting a defense-in-depth strategy Develop an OT incident response plan. [Extracted from the article]

The article discusses the concept of "secure by design" in the context of industrial cybersecurity. The author argues that while there is existing guidance on how to implement secure by design development programs, there is a need to define a minimum set of security parameters, processes, and controls that are required to meet regulations and avoid liability. The article also highlights the relationship between secure by design and software liability, suggesting that if the U.S. government can establish a security floor for products, it would be a significant step forward for product liability caused by cyber incidents. The author concludes by emphasizing the importance of requiring authentication in industrial control system protocols to prevent unauthorized access and potential physical damage. [Extracted from the article]

The article discusses the increasing threat of foreign and hidden cyber attacks on industrial operations and infrastructure. It highlights the unique vulnerabilities of operational technology (OT) networks on plant floors, which often lack monitoring and defenses found in corporate IT systems. The article emphasizes that businesses should prioritize threats to their operational environments and take steps to protect themselves, such as gaining visibility of assets and activity on OT networks, implementing strict remote access controls, patching or replacing vulnerable systems, and incorporating cyber risks into operational risk management frameworks. The article concludes by urging organizations to be proactive in addressing cybersecurity threats rather than reactive. [Extracted from the article]

The holiday season is a prime time for cyberattacks on manufacturing and critical infrastructure. With employees on vacation and businesses winding down, cybercriminals take advantage of the low staffing and limited oversight. This puts industrial control systems (ICS) and operational technology (OT) environments at risk. Ransomware gangs seek financial gain by exploiting vulnerable critical infrastructure, while nation-state actors infiltrate networks for future disruption. To mitigate these risks, organizations should implement continuous monitoring solutions for 24/7 visibility, require multifactor authentication (MFA) and access controls for third-party access, and ensure the security of backup power systems. Cybersecurity is essential year-round, and by taking these precautions, organizations can protect their operations, employees, and communities during the holiday season. [Extracted from the article]

Industrial Cybersecurity Pulse's top 5 articles from September 2023 covered how to cut through cybersecurity marketing speak, why most organizations aren't prepared for cyberattacks and why security testing should be part of your cyber strategy. Security Testing as a Cyber Strategy: ICS Pulse Podcast, Mike Nelson, CyberCX By Tyler Wall, CFE Media and Technology Nobody should be just sitting around and waiting for a cyberattack to occur. [Extracted from the article]

One of the greatest challenges is the selection of the right security controls compliant with ICS/OT industry regulations, standards and frameworks. ICS/OT are complex environments, and adding inadequately designed security controls within these environments can be ineffective in achieving the security objectives and could bring numerous challenges for ICS/OT asset owners and operators. In recent years, the industrial automation and control systems/industrial control systems/operational technology (IACS/ICS/OT) on which much of our critical infrastructure (CI) and related industries depend, have frequently become the target of cyberattacks. [Extracted from the article]

The article focuses on the introduction of the InterEdge standard by PCI Industrial Computer Manufacturers Group (PICMG), it aims to create open, modular process control systems compatible with existing industry standards, such as International Electrotechnical Commission (IEC) 61499 and IEC 61131. It reports that InterEdge offers a vendor-neutral approach to edge computing and input/output (I/O) module hardware, allowing easy customization and expansion of industrial automation functions.

IT/OT DEPARTMENT OF ENERGY The U.S. Department of Energy (DOE), in collaboration withthe Cybersecurity Manufacturing Innovation Institute(CyManII), announced a new request for proposals (RFP) forup to $4.7 million to enhance the cybersecurity landscapewithin American manufacturing. Industrial additive manufacturing: Projects will demonstratehow additive manufacturers can secure product integrity andsupply chain traceability, reducing costs by securely trackingtheir product's digital history. [Extracted from the article]

Furthermore, OT managed service providers bring specialized knowledge and experience in OT security, allowing organizations to tap into their expertise and stay ahead of evolving cyber threats. The ever-evolving landscape of cyber threats poses a significant risk to businesses operating control systems critical to production, which can jeopardize both safety and operations. [Extracted from the article]

Stuxnet and Pipedream: a nation-state attack case study Stuxnet was a malicious computer worm that was first identified in 2010 and was considered to be one of the most sophisticated pieces of malware ever created. Since Stuxnet, cyber threat actors began to focus more on malware designed to target industrial control systems (ICS). [Extracted from the article]

IT/OT In February 2023, Industrial Cybersecurity Pulse traveled to theS4 show in Miami to learn about the major trends in our field. Byres: Certainly machine learning, AI (artificial intelligence),trying to take [care of] some of the workload problems. [Extracted from the article]

Cybersecurity company Dragos released their annual Year in Review report on the state of industrial cybersecurity and critical infrastructure. The report highlights an increase in attacks on industrial control systems and the emergence of a new malware called PIPEDREAM, which is scalable and cross-industry. The report also discusses the rise of ransomware targeting industrial customers and the unique characteristics of PIPEDREAM, which targets software CodeAssist deployed on multiple programmable logic controllers. The report emphasizes the need for data-driven analysis in understanding industrial security threats and the importance of sharing information to improve defenses. [Extracted from the article]

The article discusses that industrial control systems (ICSs) will always need to provide functionality, getting actionable data from automation platforms is increasingly important. It mentions that most new industrial automation devices are Ethernet-compatible, but this does not guarantee it will be easy or convenient to get at the data they gather and contain.

This blog will walk you through the key components of using threat intelligence to better secure OT environments and to develop a more mature industrial control systems (ICS) and operational technology (OT) cyber defense. Understanding how to use threat intelligence reporting for visibility into threats to your operational technology (OT) network and how to implement defensive recommendations is a critical step in building a mature OT network defense. [Extracted from the article]

The article focuses on use of IEC 61131-3 programming languages and modern programming tools for integrating simulation to development workflow. It mentions information on use of simulation in applications like industrial controls (IC) manufacturing, electronic printed circuit board design, and field programmable gate array design. It presents information on characteristics of a good IC simulation environment like versatile programming languages and built-in human-machine interface (HMI).

The article focuses on how no secret information technology (IT) infrastructure and operational technology (OT) networks are converging, creating conditions that require industrial control systems (ICS) to become part of an overall cybersecurity program. Topics include the incumbent upon business leaders and decision makers to understand this collision, and the foundational place to begin is vulnerability management.

The article informs that Information Technology (IT) strategies can help combat new cybersecurity vulnerabilities. It mentions that IT deploy a solid cybersecurity program for operational technology use for industrial control systems including Remote Terminal Units (RTUs) and Supervisory Control and Data Acquisition (SCADA), as Industrial Internet of Things (IIoT) deployments increase.

MITRE released an ATT&CK knowledge base of the tactics and techniques that cyber adversaries use when attacking the industrial control systems (ICS) that operate some of the nation's most critical infrastructures, including energy transmission and distribution plants, oil refineries, wastewater treatment facilities, transportation systems and more. ATT&CK for ICS builds on the foundation of the MITRE ATT&CK™ knowledge base, which has been widely adopted by sophisticated cybersecurity teams around the world to understand adversary behavior and systematically advance defensive capabilities. [Extracted from the article]

The article discusses the session titled "You Too Can Secure OT" conducted at the RSA Conference 2023 in San Francisco, U.S. on April 24, 2023. Topics include the differences between Operational Technology (OT) and Information Technology (IT) systems, a proactive approach to industrial cybersecurity, asset inventory, and risk assessment. The conference featured various attendees including Diane Golden and Ahmik Hindman of Rockwell Automation.

The article discusses mixing automation from different manufacturers often took too much integration. Efforts from Open Process Automation Forum are adding interoperability among controls vendors. Efforts to create interoperable control systems are working, according to updates at the 26th Annual ARC Industry Forum, June 6-9, from The Open Group's Open Process Automation Forum (OPAF).

The article discusses the updated IEC 61131-3 international industrial control programming standard for industrial control system (ICS) users. Topics include the features of the revised standard, its benefits and flexibility, and the importance of testing the ICS design before installation and implementation begins in the plant. Several charts are also presented.

The article looks at advances in automation software and hardware that help reduce programming tasks in machine controls. It explores advances that make automation hardware and software to be no longer stand-alone functions, including integrated vision, automated data reports, managing machine variants, and improved simulation. The importance of advances in automation software for delivering digital business models for interconnected manufacturing environment is noted.

The article offers information on the importance of cyber security in process facilities. Topics include the vulnerability of the industrial control system (ICS) of manufacturing plants, the need for the development of security policies and procedures, and security breach of Stuxnet on the uranium enrichment plant of Iran. It also discusses the need for risk understanding, audits and assessments, and the installation of secure architecture.

The article focuses on the lessons learned from the industrial control systems (ICSs). Topics included the vulnerability of ICSs to cyberattacks, the damage caused by a security incident to competitive advantage loss and brand reputation, and the considerable financial damage of ICSs in organizations.

The article discusses the benefits of manufacturing firms from alarm management programs. Topics covered include the impact of the programs on the productivity of plants as well as importance to avoid workplace accidents and injuries. Also mentioned is the advantages of implementing a distributed control system (DCS) alarm system.

The article focuses on the variations of controller designers of proportional-integral-derivative (PID) control algorithm in the U.S. It notes that some commercial controllers use the series or serial form of PID algorithm which depends on a third set of tuning parameters. It points out that enhancements were developed to improve the performance of a PID controller.

The article offers multiple news briefs. Topics discussed include PC-BASED CONTROLS and integrated machine vision are among technologies helping Aixemtec GmbH in Herzogenrath, Germany, to develop automated solutions for the precision assembly of electro-optical systems; and TIME-SENSITIVE NETWORKING (TSN) is one of the most transformational developments in standard Ethernet technology.

The article focuses on a basic risk analysis technique that can help in understanding the cyber threats to industrial control systems and supervisory control and data acquisition systems. The two important elements of risk assessment are quantifying the likelihood of a cyber security event occurring and determining the severity of resulting consequences if the event is successful. According to the article, identifying the probability of receiving an attack is the responsibility of a company but it is a very complex judgement call.

The author discusses her research which determined the forces driving adoption of embedded systems by developers of industrial control systems. She notes the increasing trend towards 32-bit architectures to support the upgradeability of industrial support applications. She also notes the need for software and systems designers to evaluate the cost of porting their applications to 16-bit architecture. She discusses the benefits of ethernet to industrial networks.

The article offers information on operational technology (OT) and information technology (IT) were demarcated as separate functional area and the digital transformation initiatives are fast blurring the lines between them. Topics include increasing number of businesses deploy IIoT devices such as sensors, smart energy management systems, and the remote temperature monitors to optimize productivity and improve efficiency the cybersecurity risks facing the OT environment continues to grow.

The article focuses on dynamic and intuitive machines are transforming the way businesses function in every industry and control solutions have traditionally not been known for easy adaptation or inexpensive changes. Topics include the technology monolith has dramatically improved overall performance but has also added a complexity that needs to be managed, and the control systems have played a crucial role in manufacturing, providing advancements in mechanical and or pneumatic systems.

The article looks at the use of a Profinet to improve industrial network communication for automation devices. Topics include conformance classes for automation systems and their advantages, real-time requirements in communication with Profinet, and the benefits of time-sensitive networking and Profinet. The required plan of action and expenditure for hardware and software design is discussed.

The article looks at capabilities that should be considered when specifying controllers for industrial automation applications, such as data handling, communications, and high-speed control. Topics include data handling functionality of modern controllers, like built-in data logging, use of multiple Ethernet and serial communication ports to provide easy integration with human-machine interfaces, and high-speed applications of controller.

Did the pandemic help IT and OT to understand needs, concerns? Secure remote connections: Industrial control systems need secure remote connections. [Extracted from the article]