SHARON BRIZINOV at Claroty explains how cyber-physical systems have given rise to potentially catastrophic security challenges for critical national infrastructure
Thanks to digital transformation, organisations are connecting more and more Extended Internet of Things (XIoT) devices to their corporate networks.
XIoT is a term that encompasses all cyber-physical systems, from operational technology (OT) and Industrial Control Systems (ICS) to Internet of Things (IoT) devices, Industrial IoTs, and Internet of Medical Things (IoMT).
One sector that has seen rapid growth in the number of XIoT devices is Critical National Infrastructure (CNI). XIoT devices can help monitor hospital patient levels, automate industrial production lines, and control chemical levels within water systems – and these are only a few of the tasks that can be supported.
While there are numerous benefits, XIoT devices also come with plenty of cyber-risks. Legacy XIoT devices were not necessarily designed with security and modern threats in mind, making them vulnerable to cyber-criminals.
CNI includes industries such as healthcare, electric utilities, water, and energy, all of which are essential to the functioning of broader society. Any disruptions to these services due to a cyber-attack can impact the national economy, cause fuel or food shortages, stop the functioning of society, and even result in fatalities.
To safeguard CNI from cyber-attacks, it is crucial to understand how connected devices have increased the cyber-threat level and, more importantly, how to secure them.
Increasing cyber threats
How has the connection of cyber-physical systems increased the cyber threat level? Threat actors are shifting their focus from extracting personal information to disrupting business availability for financial gain. As cyber-physical systems are closely linked to business uptime, they are a natural target for attacks.
Cyber-physical systems are especially susceptible to potential threats due to their multiple entry points. Therefore, when more of these devices are connected, the attack surface of an organisation increases. For instance, if medical devices are connected to the main hospital network, an attack on an Internet of Medical Things (IoMT) device could also provide access to the hospital network.
It can also be the other way around. Cyber-criminals could infiltrate an organisation’s network from an IT environment and move laterally to the operational technology (OT) or industrial control side, exploiting security gaps or system vulnerabilities.
For example, employees of a manufacturing company may unintentionally facilitate an attack by clicking on a link or downloading a piece of code. Once an attacker is in the network, they could inject code to affect the logic controller, creating an outage in the distribution system. The organisation would then have to physically restore the environment to make it operational again.
Criminal gangs also have easy access to sophisticated toolsets that can help them exploit these environments by mimicking legitimate activities or gaining entry to engineering workstations. This allows adversaries to carry out covert surveillance while remaining invisible to human operators.
The human impact of cyber-attacks on CNI
An attack on CNI can have devastating impacts on the physical and societal well-being of the people.
In an extreme case, a hacking group dubbed “Predatory Sparrow” hacked a steel factory in Iran and caused the foundry to spill molten steel and fire on the factory floor. This attack, despite being carried out cautiously to not harm the workers, proves that criminal gangs can get a hold of online systems and create damage in the real world.
Apart from causing physical harm, attacks on CNI can lead to devastating data loss still with significant impact to victims. These systems store vast amounts of customer data, such as bank details, credit card information, home addresses, and other sensitive data that can be misused for financial gain.
Last year, South Staffordshire PLC, the parent company of two major water companies, was hit by a ransomware attack. While the water supply was reportedly unaffected, the company did experience disruptions in its corporate IT network. Furthermore, the bank details of some customers were accessed and potentially leaked on the dark web.
This further highlights the need to secure cyber-physical systems of CNI networks as they can be the gateway to sensitive customer information.
Securing cyber-physical systems
The first step any CNI organisation can take is to gain visibility into all cyber-physical systems and assets. By doing so, organisations can understand the risk of vulnerabilities and security gaps, including end-of-life devices, in their networks.
Businesses must bring in automated asset discovery tools to make tasks more manageable and identify connections. After all, the devices are identified, organisations can implement regulatory security updates.
CNI organisations can protect themselves by deploying network segmentation. This breaks the organisation’s network into smaller groups and restricts adversaries from moving across the network.
By deploying network segmentation, businesses can stop the lateral movement of malware across different IT and OT environments, reducing the impact of an attack. Network segmentation is crucial in protecting CNI infrastructure from vulnerability disclosure and is recommended in 29 per cent of cases.
Network segmentation goes hand-in-hand with secure remote access, which is the second most recommended technique (26%) for mitigation. It includes separating critical zones from the rest of the OT and IT networks and securing remote access sessions through additional authorisation, encryption, and authentication.
CNI organisations play an essential role in society and must be protected at all costs. To protect these organisations against cyber-threats, organisations must ensure visibility into their systems and stay ahead of cyber-criminals.
- Brizinov is Director of Security Research at Claroty.
