Today the term Cybersecurity It is everywhere, both in our professional environment and in our staff. Cybersecurity permeates everything, from our relationship with our banking entities to the management of social media at a family level; let’s remember, for example, the privacy clauses that we are forced to accept every so often in order to continue using the most widely used instant messaging applications.
Terms such as phishing, malware or ransomware They have become commonplace for all of us, and television news broadcasts routinely report on news related to attacks by more or less organized groups that seek to profit economically or strategically from their malicious incursions.
In an increasingly connected industry, there are a number of specific, scalable, and context-adapted cybersecurity solutions.
However, it is not so common to focus on the peculiarities of this type of malicious actions when their target is Industrial plants. Currently, any installation that we may consider relevant for the management of any critical resource or service, such as a gas pipeline, a water treatment plant, a traffic control center, or a thermal power plant, manages its internal processes in a highly automated way and they use for such management, in addition to conventional network elements such as servers, routers, firewalls or distributed control stations, other more specific systems from the production field such as PLCs, SCADA systems or robots.
These elements are connected through widely used industrial communication buses such as ModBus or ProfiBus, buses that, since the beginning of the current century, have ceased to be isolated systems in the industrial plants where they are deployed and have begun to be compatible with Ethernet protocols and, therefore, to be also susceptible to being accessed from the outside. The special vulnerability of these installations appears when, in addition to the value itself of the data that is managed, the danger posed to people by the presence of unauthorized persons is also introduced into the equation. malfunctioning of its physical assets. Of course, there are different degrees of categorizing that malfunction; it is not the same thing to cause a temporary power outage or the traffic lights in the center of our city to go out than to distribute into the city’s water supply system water unfit for human consumption due to an excessive dose of chlorine or to have a serious cooling problem in a nuclear power plant.
These complex industrial facilities are very expensive infrastructure which generally take several years to be built and put into service and are designed to serve the population for several decades so that the investments made are profitable. The problem arises when in recent years the attacks by organized groups through the network on facilities that were initially designed and prepared to respond to physical attacks with perimeter fences, closed-circuit television systems or armed personnel have increased exponentially and From one day to the next they find themselves in need of responding to logical attacks as well..
Therefore, the main problem of the Industry is How to recycle systems that were not designed for sophisticated attacks during their development many years ago that can endanger not only the industrial property or the business reputation of an organization but the integrity of services essential to the population.
In response to these threats, several have emerged. specific tools for the industrial environment developed by both public institutions and private companies. This specificity stems from the difficulty of applying the same strategies used in IT networks conventional Data and version updates are necessary to combat known threats, since, on the one hand, the inability to repeatedly stop the industrial processes of these critical infrastructures to upgrade them is a handicap, but on the other hand, the difficulty of incorporating new code updates into hardware components with many limitations due to their age is also a handicap.
Another common strategy to prevent unwanted access in conventional networks, or at least mitigate it, consists of implementing both logical and physical segmentation Data networks based on complex architectures that prevent external access to a specific device or service from allowing malicious actors to roam freely throughout the entire attacked network. In an industrial network where it is necessary for all controllers, sensors, and actuators to operate in a coordinated manner in closed-loop structures with continuous feedback from the outputs of the processes, it becomes more complicated to apply these same segmentation techniques.
Considering all these premises, The cybersecurity sector has worked hard over the past few years To offer the industry increasingly advanced solutions tailored to its specific needs, for example by developing monitoring probes that are virtually deployed in industrial communication networks to monitor plant activity without slowing down or blocking the readings received or the commands sent by the physical elements that make up the network. These probes are capable of detecting different types of anomalies in real time in a barely intrusive way, alerting almost immediately of any operation outside the nominal situation in so-called Industrial Control Systems (ICS).
The concern is such regarding the consequences of this type of attacks on critical facilities that the IEC (International Electrotechnical Commission) has developed a specific standard called IEC-62443 that includes a series of recommendations to address, with a holistic approach, the Industrial protection throughout the entire life cycle of processes from the initial risk audit to the actual deployment of operations and NIST (National Institute of Standards and Technology) the American has recently published a draft for the management of attack ransom where it specifically incorporates several references to the specificity of the ICS.
Fully aligned with these international initiatives but on a national level, the CCN (National Cryptologic Center) has launched the SAT-ICS service for Real-time detection of threats and incidents existing in the traffic in industrial control and monitoring networks.
