Critical Manufacturing Cyber Security – Kevin L. McLaughlin, PhD

SECURING CORPORATE IoT DEVICES: CHALLENGES, STRATEGIES, AND THE ROLE OF AI AND ML IN CYBERSECURITY

The rapid proliferation of IoT devices within corporate infrastructures has left organizations more vulnerable than ever to cyberattacks. It is essential to adopt a comprehensive approach that incorporates various techniques, tools, and emerging technologies, such as AI and ML, to effectively defend against these evolving threats. – Dr. Kevin Lynn McLaughlin, PhD

As the Internet of Things (IoT) continues to grow and proliferate, it is increasingly clear that IoT devices pose a significant cybersecurity risk to organizations. (Fazel et al., 2022) One of the primary challenges it poses is that it can be difficult to obtain relevant cybersecurity alert data from these devices into a corporate Security Information and Event Management (SIEM) system. As a result, cyberattacks that target IoT devices are often not detected by corporate cybersecurity Security Operations Centers (SOCs) in time for an effective response to be launched early in the attackers’ kill chain. Many IoT devices lack the ability to generate cybersecurity alert data in a format that can be easily consumed by a SIEM. For example, some IoT devices may only provide basic telemetry data that does not include information about cybersecurity events, making it difficult to distinguish normal behavior from malicious activity or abnormal behavior. In addition, many IoT devices are designed to operate independently and may not be able to communicate with a central monitoring system, making it difficult to detect anomalies and respond to threats in real-time.

To address the multifaceted challenges posed by the integration of IoT devices within corporate infrastructures, it is imperative for organizations to adopt a diverse array of techniques, processes, and cybersecurity tools. These measures are designed to prevent, monitor, and detect any abnormal behavior exhibited by the IoT devices operating within their networks. A fundamental technique to consider is the implementation of network segmentation, which necessitates the division of the overarching corporate network into smaller, more manageable subnetworks. This approach effectively limits the potential impact resulting from a compromised IoT device, simultaneously impeding the ability of attackers to move laterally within the network and diminishing the risk of data exfiltration. Furthermore, organizations should prioritize the implementation of security controls at the device level. This can encompass a variety of measures, including the deactivation of unused services and ports, the diligent updating of firmware and software, and the careful configuration of access controls to restrict device access to authorized personnel only. Additionally, organizations can leverage network access control (NAC) technologies as a means of enforcing stringent policies regarding the types of devices permitted to connect to the corporate network, as well as the levels of access granted to each. By adopting this comprehensive strategy, organizations can significantly reduce the likelihood of unauthorized devices appearing in various locations, such as conference rooms, break rooms, and employee offices, which might otherwise be connected to the corporate infrastructure without proper oversight. In doing so, organizations will be better equipped to safeguard their networks and valuable data from the ever-evolving threats targeting IoT devices.

In the pursuit of effectively monitoring and detecting IoT devices within an organization’s network, it is crucial to harness the power of the corporate cybersecurity Security Orchestration, Automation, and Response (SOAR) team. By leveraging the expertise of these professionals, organizations can design and implement strategies and solutions tailored to detecting abnormal behaviors originating from IoT devices, ultimately strengthening their cybersecurity posture. A plethora of cybersecurity tools are available to aid organizations in monitoring and detecting IoT devices, encompassing IoT device discovery and inventory tools, network traffic analysis tools, and endpoint detection and response (EDR) tools. When used effectively, these tools enable organizations to pinpoint IoT devices on the network, scrutinize network traffic for any suspicious activity, and identify as well as respond to security incidents in real-time. The SOAR team in conjunction with your Cybersecurity Architects and Cybersecurity integration engineers can play a crucial role in optimizing the deployment and configuration of these tools, ensuring that they work in concert to provide comprehensive visibility and protection against threats targeting IoT devices.

Artificial intelligence (AI), machine learning (ML) and blockchain technologies (Yu, 2018) (Dey, 2021) are also becoming increasingly indispensable in the defense of corporate IoT devices. These innovative technologies can augment the capabilities of the SOAR team by providing advanced analytics and automation. For instance, ML algorithms can be utilized to analyze network traffic, detecting anomalies that could potentially signify a cybersecurity threat. By incorporating these technologies into the organization’s cybersecurity strategy, the SOAR team can more effectively identify and prioritize potential threats, empowering them to focus their efforts on the most pressing concerns. In addition to bolstering threat detection, monitoring, detection and alerting AI can be harnessed to automate incident response processes, allowing organizations to react more swiftly and efficiently in the face of an attack. The SOAR team can take advantage of AI-driven automation to streamline workflows, reduce response times, and minimize the impact of security incidents on the organization’s operations and reputation. The corporate cybersecurity SOAR team plays a pivotal role in the creation and implementation of strategies aimed at detecting abnormal behaviors originating from IoT devices. By leveraging a diverse array of cybersecurity tools, as well as incorporating AI and ML technologies into their arsenal, the SOAR team can significantly enhance an organization’s ability to identify, monitor, and respond to the growing array of threats targeting IoT devices within their corporate infrastructure.

In conclusion, the proliferation of IoT devices within corporate environments presents an array of complex cybersecurity challenges, rendering organizations increasingly vulnerable to cyberattacks. To counteract these evolving threats, a comprehensive approach is necessary (S. Forsström, 2018), incorporating a diverse range of techniques, processes, and cybersecurity tools, as well as harnessing the power of emerging technologies such as AI and ML. By leveraging the expertise of the corporate cybersecurity SOAR team, Cybersecurity Architects, and Cybersecurity Integration Engineers, organizations can develop and implement tailored strategies to effectively monitor, detect, and respond to abnormal behaviors originating from IoT devices. This collaborative and multifaceted approach is crucial in safeguarding corporate networks and valuable data from the ever-growing threats targeting IoT devices. As I stated at the start of this article, “It is essential to adopt a comprehensive approach that incorporates various techniques, tools, and emerging technologies, such as AI and ML, to effectively defend against these evolving threats.”(Zaman, 2021) By embracing this holistic strategy, organizations can significantly enhance their cybersecurity posture, mitigating the risks associated with the integration of IoT devices within their corporate infrastructures.

References:

Dey, A., Jara, A.J., Al-Jaroodi, J. (2021). Blockchain-based security and privacy in Internet of Things: A survey. Journal of Network and Computer Applications, 173. https://doi.org/https://doi.org/10.1016/j.jnca.2021.102837

Fazel, E., Shayan, A., & Mahmoudi Maymand, M. (2022). Designing a model for the usability of fog computing on the internet of things. Journal of Ambient Intelligence and Humanized Computing. https://doi.org/10.1007/s12652-021-03501-5

S. Forsström, I. B., M. Eldefrawy, U. Jennehag and M. Gidlund. (2018). Challenges of Securing the Industrial Internet of Things Value Chain Workshop on Metrology for Industry 4.0 and IoT, Brescia Italy.

Yu, Y. (2018). Blockchain-Based Solutions to Security and Privacy Issues in the Internet of Things. IEEE Wireless Communications, 25(6), 12-18. https://doi.org/doi: 10.1109/MWC.2017.1800116

Zaman, S. (2021). Security Threats and Artificial Intelligence Based Countermeasures for Internet of Things Networks: A Comprehensive Survey. IEEE Access, 9, 94668-94690. https://doi.org/doi: 10.1109/ACCESS.2021.3089681

ORCID – https://orcid.org/0009-0009-8367-5292

The Office of No, Really?

Successful ransomware attacks are at an all time high, we are losing the cyberwar, cyber criminals are making more money than ever before and it is only going to get worse, a cyber attack could be as damaging as a nuclear war – the headlines abound with comments such as this. Yet, there are still a lot of postings about how information security should not be the office of No. Really? Information security is a security function, as an information security professional are you really going to say – Yes, sure, go ahead and port that un-scanned software code into our production environment? I would hope you are going to say no you cannot port that un-scanned software code into our production environment. No is not a bad word, it is one that the job requires us to say. If you are offended when someone says you are the office of No- don’t be. To be a security professional no is a good response. I train my team members to say “yes, but” in order to soften the perceived impression of the word no ….. (here’s a clue – “yes, but” is still a no – no matter how you spin it).

However, I have yet to sit in a business meeting and see any of my peers simply say no without being willing to engage in dialogue that would lead to a good and secure solution. So for those who don’t like to say no then do it this way – yes you can put that server with 2 catastrophic exploitable vulnerabilities into the environment after we help you remediate the vulnerabilities or work on additional adequate controls that will allow us to use the server in a safe and secure manner. For me, information security professionals can and should say no, but after doing so we need to be helpful and smart enough to engage in conversations that help the business figure out how to do what they want to do in a way that is cost effective, safe and secure.

In many ways with the types and amount of successful attacks we are experiencing across the U.S. infrastructure being the office of Yes is a far more scary response than saying No to items that put your business at risk.

Critical Manufacturing Legacy Systems

One common item that information Security Professionals working in Critical Manufacturing environments have to deal with is that of legacy systems. You see, in Critical Manufacturing environments it is very common for the systems that run and control factory lines to remain in place for a very long time. Some of these systems can be running Operating Systems(OS) that are 10 to 15 years out of date. In many cases these OS are no longer vendor supported and cannot be patched to remediate known exploitable vulnerabilities. These older systems are often used to run production lines and they still do a great job at doing what they were purchased to do. It is difficult, rightly so, to convince the leadership team at a factory to spend money to replace something that is old but that is still doing the job it was purchased to do. It cost money and reduces potential profits to replace these old and outdated systems with new systems. Because they continue to do the job they were purchased to do justifying the new spend can be a difficult thing to do.

From an Information Security point of view these systems pose a large risk to the overall manufacturing environment and if hacked could cause a large scale production outage. In smaller companies this type of major Cyber attack can result in no longer being able to conduct business and permanently closing the doors. Legacy systems that are commonly found on the shop floor are often 3, 4 or even 10 years out-of-date when it comes to standard Information Technology patching. Information Security Professionals look at these systems as attack vectors while the people working in the Critical Manufacturing environment view them as cost effective work horses that are getting the job done. While cyber attacks on networks at Sony, Target, Home Depot and the US Government are getting all the press, the greatest cyber vulnerability is in manufacturing. “By raw numbers, and by the numerous manners of attacks, manufacturing is the most targeted area now, even compared to financial services,” Chet Namboodri, senior director of Global Private Sector Industries at Cisco, told Design News. “Financial services gets more press, but industrial networks get more attacks.” Attacks and warnings such as Stuxnet, Armaco, SolarWorld and U.S., Steel to U.S. regulators and security experts sending out an official warning that hackers could now access critical medical equipment including pacemakers and insulin pumps with potentially deadly results make the threat to Critical Manufacturing a real one. Determining what to do in order to lock down and protect the Legacy systems while at the same time allowing them to continue doing the work they have been doing is a major part of an Information Security professionals job.

“You can’t scan that system (or you can’t put AV on that system) because it is old and fragile and if you bring it down we will not be able to produce our product” Is way too common of a phrase in the Critical Manufacturing environment. In many cases Information Security Professionals are asked/told to please just leave the systems alone, do not run vulnerability scans, do not put antivirus on them, do not put a light firewall on them, do not patch them, do not put updates on them, etc. This type of thinking by Information Technology and Factory leadership teams is shortsighted and is putting their entire production capability at huge risk of catastrophic failure. As these legacy systems are outdated and no longer being supported by the vendor they are hugely exploitable to any blackhat or hacker that wants to take advantage of their exploitability. The reality is that the risk is real, the risk is great and from past events we know that these systems pose easy to use attack vectors for blackhats, fraudsters and competitors seeking to cause negative business impact to the company.

Information Security professionals working in Critical Manufacturing should take the approach shown in Table 1 for dealing with the Computer Systems residing in the factory environment and that are on the plant floor. By following this methodology the legacy systems will be protected while at the same time be able to continue doing the job they are good at and that they were purchased to do. In most cases this approach will also reduce the overall risk that these systems pose to an acceptable level.

Legacy Table Table 1

This approach when combined with the network segmentation and smart firewall approach discussed in my previous blog on Critical Manufacturing is the start of a successful recipe in securing a Critical Manufacturing environment.

Critical Manufacturing Cyber Security Defense Program – A Starting Look

Cyber security professionals are often tasked with trying to defend more than they have the resources to defend. This is especially true in the area of Critical Manufacturing as there tends to be a strong desire to protect everything. In many cases when we try to protect everything we end up protecting nothing. A Cyber Security Defense Program (CSDP) needs to be very focused and strategically deployed to protect the systems and areas which need protected.

Critical Manufacturing as defined by the Department of Homeland Security(DHS) is primary metal, machinery, medical, electrical and transportation. Primary metal is Iron, Steel, Aluminum non-Feros metals; medical includes facilities and devices, machinery is engines, turbines and power transmission, within electrical is electrical equipment manufacturing, transportation is : vehicle, aviation and aerospace parts and vehicle manufacturing and railroad rolling stock. Products made by these are essential to critical infrastructure sectors. The Critical Manufacturing sector focuses identification, assessment, prioritization and protection of nationally significant manufacturing industries within the given sector that may be susceptible to manmade or natural disasters. This area is one that is critically in need of a strong CSDP. The discipline for CSDP must not be twisted to taint what should be a strategic approach to the industrial base (“Critical Capabilities At Risk,” 2009).

One critical component to the protection of a Critical Manufacturing environment is that of using next generation, aka smart, firewalls with intrusion prevention and with some form of malware prevention and detection, updated via global feeds, enabled. This firewall environment should be set up in such a way as to segment the Critical Manufacturing infrastructure. Each individual plant or factory within the Critical Manufacturing environment should be on their own local area network (LAN) segment. A very basic way of thinking about this is captured in Figure 1 below.

Manufacturing Network Segmentation

Figure 1

Because of the method in which business decisions are made for factory systems it is critical that organizations involved in Critical Manufacturing use strongly firewalled network segmentation methods to ensure that each of their factory sites sit behind their own firewalls and on their own network segment (DHS, 2009). This allows better control of the environment and enables the isolation of one factory without impacting the rest of the factories owned by the organization. In this way if one factory is compromised by a hacker or group of hackers it can be removed and isolated from the organization’s global IT infrastructure. Network segmentation, also called Network Control (NC) is a primary bastion for a defense in depth strategy and it can also be used to help prevent a blackhat from pivoting from a relatively unsecure factory system to a core business system. Combining an Intrusion Prevention Appliance (IPS) or functionality with the firewall inside of a network segment provides a strong front line of perimeter defense for factories involved in Critical Manufacturing. These IPS’ do not have to be overly tweaked and analyzed to be effective, running them in default signature mode is an adequate layer of defense for the network segment protecting and controlling a factory environment (DHS, 2009).