Securing Critical Infrastructure to Reduce OT Cyber Risks and Impacts

Webinar Summary – Securing Critical Infrastructure (OT)

In the webinar about securing critical infrastructure hosted by KMC Controls, the panelists discussed critical infrastructure and the importance of hardening operational technology (OT) against cyber vulnerabilities. The session featured insights from Sandy Kline, Louis Parks, and Paris Stringfellow, who shared their extensive experience in cybersecurity and operational resilience, particularly in the context of the Department of Defense and the manufacturing sector. Sandy Kline highlighted her role at the Department of Defense, focusing on the Cyber Security Resilience Program, where she addresses the unique cybersecurity challenges posed by operational technology used in military installations, which includes various control systems critical for energy, water, HVAC, and transportation. She noted that traditional IT cybersecurity methods often cannot be directly applied to OT systems, necessitating tailored solutions. Paris Stringfellow shared her background in sustainability and her current focus on embedding cybersecurity within technical environments. She emphasized the need for organizations to rethink how cybersecurity is integrated into design, particularly in manufacturing processes. Her work at the Cybersecurity Manufacturing Innovation Institute aimed to ensure that cybersecurity measures are not just add-ons but integrated from the outset. Louis Parks, Co-founder and CEO of Verify Security, discussed the need for specialized tools and strategies to protect OT networks, which often differ significantly from IT standards. He echoed the sentiment that cybersecurity in OT is not simply a matter of applying IT solutions, as there are unique characteristics and challenges involved. The conversation also addressed the definition of critical infrastructure, with panelists noting that it varies between sectors and can include everything from utilities to healthcare systems. They emphasized the importance of risk mitigation and the need for a layered cybersecurity approach that includes physical security, network segmentation, and ongoing monitoring. Additionally, the panelists discussed the often-overlooked cost-benefit analysis of implementing cybersecurity measures, highlighting that the potential costs of cyberattacks on critical infrastructure can far exceed the costs associated with preventive measures.

 

Highlights

• Need for Specialization: Typical IT security measures cannot directly apply to OT, necessitating specialized cybersecurity strategies focused on industry-specific needs.
• Physical vs. Cyber Security: Basic physical security flaws, such as unsecured access to control panels, significantly undermine cybersecurity efforts.
• Integrated Design: Encouraging cyber-informed engineering to integrate security measures directly during the design phase of critical infrastructure.
• Cost of Cyber Attacks: The financial impact of downtime from cyberattacks can range from hundreds of thousands to millions, making preventive measures economically sensible.
• Layered Approach: Employing a defense-in-depth strategy that includes physical security, digital hardening, and employee training is essential for effective protection of critical infrastructure.
• Investment Insights: Organizations must realize that investing in cybersecurity yields a return on investment reflected in the mitigation of potential losses from attacks.
• International Commonality: Critical infrastructure protection needs are universally recognized, showing that cybersecurity is a borderless issue that benefits from shared knowledge and practices.

 

Key Insights

• Operational Technology is Unique: OT systems have distinct characteristics that make traditional IT cybersecurity practices insufficient. This highlights the need for industry-specific cybersecurity strategies that are designed to address the particular risks and vulnerabilities present in OT environments. Organizations that overlook this nuance risk significant operational disruptions and financial losses.
• The Cost of Complacency: The financial ramifications of cyberattacks can be drastically higher than the expenses associated with preventive measures. By evaluating the costs of potential downtime, businesses can better justify investments in cybersecurity infrastructure, ensuring the continuity of essential services and minimizing impacts on society and the economy.
• Regulatory and Compliance Frameworks: While frameworks like NIST offer critical guidance for cybersecurity, they lack enforceability across the board. This creates inconsistencies in how organizations approach compliance versus actual protection. The need for a broader consensus on standards that address both IT and OT environments becomes essential for cohesive security practices.
• Continuous Improvement: Many organizations currently rely on outdated systems and practices. Transitioning to a culture of continuous improvement, with regular assessments of cybersecurity measures and updating of systems, is essential. This approach helps adapt quickly to emerging threats and evolving technologies, thus maintaining an organization’s security resilience.
• Cyber-Informed Engineering: Incorporating cybersecurity into the design phase of systems represents a significant shift needed to combat vulnerabilities from the outset. This proactive approach will help engineer security requirements into the architecture of new systems rather than treating security as an afterthought.
• Importance of Physical Security: Despite advanced cybersecurity protocols, neglecting physical security remains a critical vulnerability. Many cybersecurity breaches are initiated through physical access, underscoring the need for stringent controls on access to infrastructure components that manage operational technologies.
• Human Element Matters: The effectiveness of cybersecurity measures heavily relies on the human factor. Training personnel to recognize potential vulnerabilities, respond to incidents appropriately, and foster a culture of security awareness within organizations is crucial for a comprehensive security strategy.

 

In summary, the webinar underscores the critical importance of recognizing the unique challenges posed by operational technologies in critical infrastructure and the need for organizations to adopt a holistic approach to cybersecurity that integrates best practices from various fields while prioritizing prevention over remediation.

 

Source Video

—
Blog Post Summary – All of our recent posts listed on one page