Defending Operational Technology Environments: Basics Matter

A cybersecurity truism is that by focusing on the basics, defenders can block not only the vast majority of attacks today but also in the future.

See Also: User Entity & Behavior Analytics 101: Strategies to Detect Unusual Security Behaviors

While cybersecurity experts have been repeating that IT mantra for years, experts say it also applies to operational technology environments, including industrial control systems, supervisory control and data acquisition systems, and distributed control systems.

“What happens for most companies, where they get in trouble, is they don’t think about the threats of yesteryear. They only think about the new, emerging threats,” said Robert Lee, CEO and co-founder of OT-focused cybersecurity firm Dragos, in a recent call with reporters.

By focusing on defenses for what’s already been seen, “we can make it very painful for the adversary in their attempts to be successful,” he said.

The latest annual report from Dragos details takeaways from its 2023 investigations, including finding incorrectly configured firewalls in one-third of all manufacturing sector security incidents. In another one-third of incidents, customers’ environments lacked sufficient network segmentation, making them too flat.

“The idea that you’re going to have an air gap or completely segmented or separated OT network is lunacy in this world, outside of nuclear pipelines,” Lee said. “But you still don’t want it to be where you can open up an email and hit a controller on your network.”

One test of whether an organization has an adequate focus on the basics is to see how it would fare against an already-seen threat, such as the Stuxnet malware designed to infect OT environments, which first appeared in 2010. “There are still a significant portion of infrastructure asset owners and operators that could not detect that capability today, 13 years later,” Lee said.

Beyond network segmentation, he said, essential security controls include monitoring ICS networks – less than 5% of which are currently being monitored – as well as requiring multifactor authentication and taking a risk-based approach to managing OT vulnerabilities.

All of this remains age-old advice for protecting against current and future cybersecurity risks. “If you do the knowns, if you actually defend against the things that we know how to defend against, you get a lot of value out of the things you may not know about,” he said.

Even with the best intentions, practitioners face numerous hurdles, including for managing vulnerabilities in control systems.

Last year, Dragos found that 29% of all ICS or OT vulnerability alerts featured incorrect data, such as listing the wrong systems as being affected or unaffected. While 72% of advisories were released with a patch last year, 73% of all advisories included no practical mitigation advice, which is a problem because in some cases, simply deactivating a service can eliminate the vulnerability – no patch required.

Overall, Lee said, “asset owners and operators are getting very poor guidance from the larger vendor community.” Testifying recently before Congress, he called on the U.S. Computer Emergency Response Team and the American government “to take a point of view” – not to pick one product over another but rather “to acknowledge openly when people are not doing a good job” and demand they do better.

Nation-State Threats

Dragos said it’s tracking 21 unique, active cyberthreat groups that are OT-specific, meaning they either develop malicious code specifically for OT environments or they focus on targeting organizations with OT environments. The company said not all of these groups are the A-team; some are the B-team or C-team.

One of the A-team adversaries is a group tracked as Voltzite – aka Volt Typhoon, Bronze Silhouette, Vanguard Panda and UNC3236 – which targets OT networks in multiple critical infrastructure sectors, including electric power generation, emergency services, water treatment, telecommunications and the defense industrial base.

While Dragos doesn’t attribute activity to any given nation-state threat actor, the U.S. and allies have tied the hacking group to China. The U.S. Cybersecurity and Infrastructure Security Agency recently warned that for at least five years, Volt Typhoon has been among the groups tasked by Beijing with “prepositioning for future disruptive or destructive attacks,” potentially to slow an American response to China invading Taiwan (see: Chinese Hackers Preparing ‘Destructive Attacks,’ CISA Warns).

“What is concerning to us is not that they’ve deployed very specific capabilities to do disruption,” Lee said, but rather their strategic target selection. “It’s not a spray-and-pray type of project,” but rather “specifically looking at those sites that would be of strategic value to an adversary trying to hurt or cripple U.S. infrastructure.”

Also concerning are the groups it tracks, such as Kamacite and Electrum, which have been tied to repeat power grid outages in Ukraine, among other incidents. Dragos said Kamacite appears to be focused on gaining initial access and then handing it off to Electrum, which functions as an “ICS effects team.”

These groups currently appear to remain highly focused on Ukraine. “My concern is: They’re developing a lot of expertise in how to do this, and when the Ukraine war ends – whenever that may be – you will likely see these groups pivoting with that expertise to targeting other infrastructure around the world,” Lee said.