The Importance of ICS Security

Industrial control systems (ICS) are at the core of modern critical infrastructure. In our increasingly digitized and interconnected world, industrial processes and critical infrastructure systems rely on ICS, making ICS security crucial to the normal functioning of society.

However, ICS security poses unique performance and reliability challenges, typically relying on unconventional operating systems and applications. What’s more, the operational requirements of ICS are often at odds with security needs; as a result, ICS security is a remarkably complex discipline. This article will examine what ICS security is and why it’s important.

What are Industrial Control Systems? 

ICS is the umbrella term for integrated computer systems that monitor and control the operation of industrial processes, typically for critical infrastructure sectors such as energy, manufacturing, or transportation. Consisting of Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCS), Programmable Logic Controllers (PLC), and various sensors and actuators, ICS systems facilitate industrial operation control and automation.

Threats to Industrial Control Systems

Over the past two decades, ICS has become increasingly interconnected. While this increased connection with corporate networks and the internet has undoubtedly realized operational efficiencies, it has also increased ICS’s vulnerability to cyber threats.

Industrial control systems are a desirable target for cybercriminals. From the lowliest have-a-go-hacker to sophisticated, state-sponsored threat groups, the potentially disastrous consequences of downtime and vast resources inherent in industrial organizations are too much for cybercriminals to pass up.

Similarly, organizations that use ICS typically have high availability requirements. Any downtime could have vast financial and competitive consequences, meaning security teams often lack the time or resources to take down systems and install security updates. Security teams typically set ICS security to detect attacks rather than prevent them for this exact reason; potential false positives and subsequent downtime are not an option.

It’s also worth noting here that many of the proprietary controls used in ICS are decades old and support long-life components, and, as such, security teams cannot update them to include basic security features such as encryption and access controls.

Why is Industrial Control System Security Important? 

Organizations that utilize ICS typically fall in the critical infrastructure sector, industries essential to the normal functioning of a country’s economy and society. As such, a cyberattack on ICS can bring an entire nation to its knees.

We’ve already seen indicators of the disruption a successful attack on critical infrastructure can cause. In May 2021, the DarkSide ransomware gang attacked the United States Colonial Pipeline, which carries gasoline and jet fuel from Texas to the Southeastern United States. Colonial Pipeline could not bill customers for their purchases and closed the pipeline as a precautionary measure. Panic buying began almost immediately, fuel prices rocketed, and President Biden quickly declared a state of emergency. While the Colonial Pipeline incident didn’t stem from an attack on ICS, it is a sobering reminder of the chaos that can ensue from an attack on critical infrastructure.

Protecting Industrial Control Systems

Organizations seeking to protect ICS should implement a comprehensive security framework tailored to their specific requirements. Some best practices for achieving ICS security include:

• Risk management and cybersecurity governance:
  • Identify any possible threats.
  • Create and maintain asset inventories.
  • Develop and maintain incident response procedures.
  • Develop policies and training relevant to ICS security protocols.
• Security monitoring:
  • Establish what normal behavior and traffic look like
  • Configure Intrusion Detection Systems (IDS) and Data Loss Prevention (DLP) solutions to flag any possible intrusions and prevent attackers from exfiltrating data.
  • Track and monitor audit trails.
  • Set up Security Incident and Event Monitoring to identify intrusion attempts.
• Supply chain management:
• Prioritize cybersecurity as part of the ICS procurement process.
• Establish contractual agreements that ensure proper incident handling and reporting, security of interconnections, and remote access specifications and processes.
• Consider ICS security when selecting a cloud services provider.
• ICS network architecture:
• Segment networks where possible
• Implement a layered network topology for ICS that hosts the most critical communications in the most secure and reliable layer.
• Use one-way communication diodes to prevent external access.
• ICS perimeter security:
• Configure firewalls to control traffic between the ICS and corporate IT networks.
• Implement IP geo-blocking where appropriate.
• Harden remote access
• Prevent persistent vendor or employee connections to the control network.
• Host security:
• Promote a culture of patching and vulnerability management.
• Test all patches in offline testing environments before implementation.
• Replace out-of-date computer systems.
• Human element:
• Develop a collaborative culture between security, IT, and OT teams.
• Train IT and OT teams to identify potential threats.
• Develop protocols that govern how personnel should manage ICS.
• Issue policies that outline ICS rules.

To conclude, ICS security is essential because the organizations that utilize ICS are typically in the critical infrastructure sector. Critical infrastructure organizations are incredibly high-value targets for cybercriminals due to the consequences inherent in downtime and the vast resources at their disposal. Organizations must develop and maintain a comprehensive, tailored cybersecurity framework to protect themselves against cyber threats to ICS.

Josh is a Content writer at Bora. He graduated with a degree in Journalism in 2021 and has a background in cybersecurity PR. He’s written on a wide range of topics, from AI to Zero Trust, and is particularly interested in the impacts of cybersecurity on the wider economy.