Engineering Services

Present situation:

Cotemporary standard practice regarding OT security among mainstream companies are typical IT centric steps to protect the OT systems. Followings are few examples. 

• Network Segmentation: Network segmentation is the practice of splitting a computer network into subnetworks, each being a network segment.
• User privileges Policy: Effective user management policy and policy to limit the number of users with specific access level.
• Application remediation: Keep applications updated with secure versions and latest patches
• Incident management: Establish an incident management system including disaster recovery, root cause on certain incidence along with long term solutions, etc.
• Monitoring: Log checks, unusual behavior monitoring and alarms, event trigger and checks, etc. 

Nevertheless, these all are good steps to start with OT security, but this is certainly not the end. Specific approach and thoughts in this landscape is key to define appropriate security policy which are OT explicit. Accordingly, it should be implemented.

Challenges in Legacy OT Systems

Many enterprises still rely on legacy OT infrastructure that are beyond the scope of compliance regulations. Do not assume that these older systems are safe and risk free. Rather these systems become more risky, as with time changes happen and systems get exposed to external world, sometimes without knowledge of the stakeholders. These systems are now in the open, unprotected by the data center, and vulnerable. Legacy systems can range from simple single node terminal systems, to client-server systems to the modern internet-ready systems. Below are some of the common reasons why security weakness got injected in Legacy systems while doing any system or program level changes to make this IOT compatible. Knowledge: There are very niche programing skills required to understand and do changes in legacy systems. These skills are challenging to find in market. This  results in improper handling of the system. 

• Access to other networks:  Business are trying to make systems IOT ready. This is challenge as most of these systems have limited ports available with OEM specific protocols. Most of stakeholders offers this protocol development work to companies without detail analysis of security threats. Incorrect way of writing protocols to get data from the legacy system is major threat for security
• Poor patch management: Most of these systems run in smooth way handling specific intended operations in plant. OEM comes with new patches and system updates. Due to regular production pressure often these patches get ignored and system is not updated to new patches . This is concern a for security.   

There are few others challenges like lack of sufficient protection while opening legacy system data over IOT, cross site scripting, improper access control etc. 

Future of OT Security - Cognitive (Feedforward) Approach

Before explaining the cognitive approach to OT security, I would like to give an analogy of "Feedback" and "Feedforward" controls. A feedback controller responds only after it detects a deviation in the value of the controlled output from its desired set point. On the other hand, a feedforward controller predicts the disturbance directly and takes an appropriate control action in order to eliminate its effect on the process output.

Along similar lines, today's OT security is more like feedback controls. The action happens only if a threat is detected and the focus is on remediation. This limits scalability with the evolving threat landscape, changing trends for overall data flow and resources. A cognitive security approach can be the solution to some of these challenges.   

What is Cognitive approach

Imagine a real life scenario where we are travelling away from our homes. As a safety precaution, we lock the doors, secure the windows, enable electronic security surveillance systems, inform key stakeholders and ensure adequate security measures. We do this intuitively without any formal training and even when there is no imminent threat. 

Can we build such intelligent, responsive and experience based capabilities in security systems? This is nothing but the approach towards defining cognitive security. By definition, Cognitive systems are self-learning systems that use AI, Machine learning and human machine interactions (By Control SCADA commands / trends / history). It is more of intelligent data driven security systems 

How this will help

• Reduce human intervention: Consider a classical scenario where an incident is reported in production. Enterprises assign analysts to diagnose the issue based on its severity and criticality. Analysts would make an assessment based on their prior knowledge, access to automated tools and their understanding of the situation. The delays caused by this approach can further aggravate the problem. An AI based system can diagnose the issue, provide insights on possible root cause and suggest remedies based on AI driven analysis
•  Increase accuracy: A cognitive approach can improve accuracy in multiple ways, some of which include:
• Eliminate human errors
• Reduce dependency on knowledgeable workers
•  Analyze more sources of data, , validate with historical data much faster and provide timely information. These multipoint analytics results in better accuracy.  
• Increase system up-time: The threat landscape is expanding at an unprecedented pace. People with malicious intent are investing on new technologies. In order to safeguard our systems and win the race we need to have cognitive security system in place.. This is still in early stages of enterprise adoption and will improve over time. This will help to increase the overall up-time by predicting well advance, make quicker diagnosis and help human to take quicker remediation thus reduce the down time.  

To conclude, in this blog, we trust a systemic and cognitive approach for OT security which can be represented by a technological ecosystem in combination of OT centric process will be useful. This will be the need of IOT 4.0 and digital systems design.