OT Cybersecurity – Back to Basics
Gary Miles MCIIS ChCSP
Operational Technology Cyber Security Expert, Fortinet
Cybersecurity for OT – Background
Gary Miles is one of Fortinet's UK & Ireland Operational Technology (OT) experts. He is a Chartered Cybersecurity Professional for Governance and Risk Management, and possesses ISA/IEC 62443 Expert, GICSP and NIST practitioner qualifications. Prior to Fortinet, Gary spent three years in a range of OT cybersecurity consultancy roles. This included leading and implementing cybersecurity management systems for OT operators across a broad range of sectors, alongside extensive risk assessment and auditing roles for both IT and OT owners and operators across approximately 40-50 different organisations.
Cybersecurity for OT – Introduction
This short OT Cybersecurity blog piece is designed to draw attention to some of the key areas that organisations struggle with during audits, which often limit the success of a comprehensive cybersecurity strategy. This blog highlights the importance of strong cybersecurity foundations, often overlooked in organisational strategies.
Strong Foundations: Where to Start – Scope
For IT/OT security leaders, asset owners and OT engineers, the first thing you must do is understand the scope for the audit. Simply put, you cannot audit (and effectively protect) what you do not understand.
Despite its apparent simplicity, scope definition is frequently unclear, leading to gaps in security coverage; organisations often struggle with aligning different stakeholder perspectives on critical business functions and do not spend enough time understanding and documenting this important process. This initial scoping problem is an issue I saw commonly whilst auditing a wide array of OT and IT environments across the UK and beyond.
The UK’s Cyber Assessment Framework (CAF) (Figure 1 below) requires organisations to document and agree upon their system scope with regulatory authorities. However, scope-related challenges arise when scoping documentation lacks thorough review, changes to the system occur, or even when areas of lesser maturity are excluded.
Figure 1: The NCSC’s CAF
There are many tools and methods that can assist businesses with understanding what the scope of the essential function should be, including methods such as conducting a Business Impact Analysis exercise, conducting Process Control Mapping, and high-level and detailed risk assessments. These processes link directly into the Govern and Identify elements of the NIST CSF V2.0, as well as all objectives throughout the CAF, alongside identifying the System Under Consideration (SUC) within the ISA/IEC 62443 series of standards.
Strong Foundations: Effective Governance
People remain an organisation's strongest and weakest link. Consider recent cybersecurity incidents, often caused through methods such as social engineering, insecure network configuration controls or insecure / unauthorised device or network changes. Although different attack methods in their own right, people remain at the heart of the business and for each attack type, the human element will always be present. A strong organisation from a cybersecurity perspective will often have the right people, with the right knowledge and experience, in the right place, at the right time.
But it's not all about people; effective governance should recognise that cybersecurity solutions require a holistic approach where people, process, and technological solutions are effectively integrated. When it comes to each of these elements, there is no one-size-fits-all solution; each organisation should recognise this and ensure they do what's right for them, based on the threat landscape, the risk, and importantly business and security objectives. As many are aware, finding the right people (and the right budgets for the right people), particularly in the OT space, is a challenge in itself.
Security Solutions
From an auditing perspective, Objective B within the CAF (protecting against cyber attack) contains the highest number of Principles, Contributing Outcomes (COs) and associated Indicators of Good Practice (IGPs), and for good reason. This is not because it's the most important Objective; they're all equally important, but because protecting a network requires extensive efforts and solutions, which all need to be evaluated. As the CAF is outcomes based, there is no single blueprint for securing a system; systems, threats, risks and the associated consequences vary from business to business and site to site.
What was clear to me as an auditor was organisational reliance on a very broad range of technological solutions, which would often lack effective integration and operational understanding (in other words, having too many different security solutions). More solutions don’t always mean better security. In the same way that an accurate scope and the right people are important, appropriate and mutually supportive technological solutions help with effective security, risk management and the compliance journey. Fortinet’s broad, integrated and automated Security Fabric platform, powered by FortiOS, is a great example of how this can be done well.
Summary
My favourite saying in the cybersecurity space is that "you can be compliant and not secure but being secure usually results in being compliant". I couldn't agree with this statement more. Effective security starts with having strong foundational cybersecurity activities as we’ve discussed here, including ensuring effective governance is in place and understanding what you have and what you need to protect. There are many other activities and actions that need to occur, but my experience is that a wide range of organisations do not understand what they have, and they don't have the right governance structures in place to manage risk. This can negatively affect or lead to a false sense of security in the organisation's ability to secure their environment and meet compliance requirements.
Fortinet's unified OT Security Platform provides a comprehensive suite of solutions all operating under a single management plane and operating system, providing a single pane of glass security view, effectively enabling businesses to manage and reduce risk and achieve their compliance requirements.
