Besides their obvious threats to networks, processes and personnel, awareness of cyber-probes, -intrusions and -attacks is expanding beyond process security and safety. Cybersecurity is gaining recognition as a business, finance and insurance issue, and generating responses from a wider circle of professionals. For instance, accountant and advisor Wipfli works with its system integrators and mid-level manufacturing clients on cybersecurity challenges, and helps them perform evaluations that often haven’t been addressed yet.

“If an enterprise resource planning (ERP) system locks up due to a cyber-attack, a manufacturer can still produce its product. However, if its operations go offline, production stops, and this immediately becomes a revenue and business-risk situation,” says Tom Wojcinski, cybersecurity and technical management partner at Wipfli, which is a partner member of the Control System Integrators Association (CSIA). “This also jibes with what we do as an auditing organization.”

Follow the IT road

Not only are the cybersecurity capabilities of manufacturing systems less mature than business-level, IT-centric systems, such as banks and other financial institutions, Wojcinski reports that manufacturers must also contend with large amounts of very old equipment. These devices have reliably generated products and profit for decades and longer. However, if they run any software, it’s typically 15-20 years old, and has known vulnerabilities that weren’t addressed because there were few if any applicable cybersecurity requirements at the time.

Consequently, Wipfli’s advisory role has expanded over the years to include helping users conduct vulnerability assessments of their components, processes and networks, and even perform cybersecurity scans. It advises users on offensive and defensive cybersecurity strategies, and can checks their exposure to physical, logical and socially engineered cyber-intrusions.

“We ask clients what is their vulnerable equipment that isn’t patched? And how are they isolating critical machines, work cells and production areas?” explains Wojcinski. “We also ask how are they segmenting their processes and networks? And how are they monitoring these systems and evaluating their network traffic?”

For example, Wojcinski adds that Wipfli recently performed a vulnerability assessment for an electrical components manufacturer, which included scanning its equipment with Nessus Pro software, identifying unpatched software, and evaluating its cybersecurity policies, procedures and rules of engagement.

“We found this client had laptops running specialized testing software for checking motor duty cycles, but it wasn’t patched, didn’t handle vulnerability scans well. It also locked up while motors were running at 100%, which created an overheating situation that almost started a fire,” says Wojcinski. “The client was initially mad at us, but they were violating their own policy about not allowing specialized software to run on an office network. This software was plugged into a network they told us was OK to scan because it was supposedly on their operations technology (OT) network. However, even though they had an OT network, they weren’t using it in this case. Because the testing software on the office network couldn’t handle being scanned, this situation could also have allowed a malicious cyber-attack with life-safety consequences. So, when a user has critical and potentially vulnerable software, they must also know the procedure for monitoring what parameters are running outside that may impact that software.”

Get your subscription to Control's tri-weekly newsletter.

Secure and successful segmentation

Wojcinski reports that Wipfli’s electronics client subsequently relocated its testing software and other functions to its OT network, added a continuous, vulnerability-management system, tightened physical control over what assets could plug in, and properly isolated and segmented its networks. He adds that other users can similarly segment their networks by taking several basic steps:

• Inventory and document all production components, processes and networks to understand what needs to be protected;
• Update that asset inventory to keep it complete and current after devices are added;
• Segment and isolate the OT network from business-level and other IT-based networks with managed Ethernet switches used as firewalls;
• Learn and adopt cybersecurity standards from the Center for Internet Security’s Defense Information Security Agency’s Security Technical Implementation Guides and other applicable organizations;
• Perform a thorough cybersecurity vulnerability scan and evaluation;
• Conduct active penetration testing to further develop appropriate responses to cyber intrusions, and train staff how to use them. This includes preventing intruders from gaining unauthorized access and privileges, and especially stopping them from moving laterally between layers and systems to reach higher-value targets; and
• Develop backup and recovery policies and procedures that can restore production capacity.

“Developing a process map can identify critical equipment, workstations, SCADA systems, PLCs and other controls, and network links. Next, users can ask how each one is backed up, if their data is nearby or elsewhere, and if they’re recoverable,” adds Wojcinski. “Users want to know if they’ll have the right information to get up and running again in a timely fashion. However, not many manufacturers can run redundant systems everywhere, so that puts the responsibility for having logical backup and recovery procedures back on plant-floor staff and whoever can assist them.”