Logo Header Menu

Operational technology and the need for automation in industrial control systems security

Operational technology faces a cyber threat which it seems ill-prepared for. Is automation in industrial control systems security the answer? Operational technology and the need for automation in industrial control systems security image

For cybersecurity, “Operational technology is different,” says Daniel Lewis, CEO, Awen Collective. The company focuses on reducing the cost of cyber threats to critical infrastructure and manufacturing. It seems there is something of a dichotomy. Within a critical infrastructure system, the IT cyber security procedures can be pretty good. But operation technology, which can consist of multiple devices which are connected, are not so secure. This is why Awen Collective focuses on the automation of industrial control systems security.

Let’s start with an example and move on to some regulation.

The example is the Norsk Hydro cyber attack.  It was back in March 2019, when the Norwegian aluminium supplier was subject to a ransomware attack. This caused an entire system shut down and the workforce had to go back to doing things manually. It took several months to get back to 100% capacity at a cost of 45 million euros and counting.

Operational technology is a quite different

But that was an aluminium plant — suppose an organisation that supplies water or electricity is subjected to the same kind of attack — the consequences for the affected population could be disastrous.

And that takes us to the regulation — NIS directive.  This is an EU directive that came into force at about the same time as GDPR, and which requires critical national infrastructure services across the entire EU, for critical infrastructure organisations to apply a certain minimal level of cyber security that they should have embedded throughout their organisations.

Is cyber security automation a viable solution?

Information Age spoke to three experts in the automation of cyber security — we spoke about the dark web, black boxes and red buttons.

In other words, for critical infrastructure and operations technology, automation in industrial control systems security could be critical.

The challenge here is the pressure on critical infrastructure organisations to provide continuous service. Traditional digital forensics might take weeks and to be effective needs the system to be shut down.

The importance of third-party validation for cyber solutions

The cyber security market has become fragmented and complex. Thanks to aggressive marketing, it’s hard to know what to believe. Both enterprises and vendors require third-party validation

“Key digital forensic data is typically at a very low level. They don’t store data for a particularly long period of time, they don’t have a history capture. And so it’s very important to be able to preserve that data as much as you can and extract as fast as you can.

“The temptation, of course, is always to unplug everything, stop building things back up and bring things back online. If you do, you’ll lose that information.”

Jules Farrow:  Because of industry 4.0, there are new technologies coming into the OT environment, which are providing huge amounts of efficiency, and visibility into production processes, creating cost savings, that are potentially enormous. There has been strong focus on these technologies at the board level of these large organisations. But the cyber security aspect hasn’t really been thought about.

Jules Farrow, CTO of Awen Collective and  a former Head of IT for cyber-security company Darktrace, explained further:

“In critical infrastructure IT systems, are usually well looked after, well configured. Operational technologies, on the other hand, are a lot more distributed. They were set up by engineers rather than IT technicians and IT engineers. And they are made to ensure continuous supply.

“Traditionally, there has been a big separation between those two environments, the IT network, might be quite well serviced both by having a strong cyber security team internally, but also because of the huge wealth of products out on the market to help cyber security on the network.

“Then there’s your OT network on the other side. Because of industry 4.0, there are new technologies coming into the OT environment, which are providing huge amounts of efficiency, and visibility into production processes, creating cost savings, that are potentially enormous. There has been strong focus on these technologies at the board level of these large organisations. But the cyber security aspect hasn’t really been thought about.”

Simulation software: protecting your organisation during a sustained period of cyber war

Organisations and consumers alike are in real threat of falling victim to the ongoing cyber war. Is simulated software a reasonable tactical response?

So, what’s the answer? How can automation in industrial control systems security be provided?

Awen itself has two products:

* In the UK, NCSC, which is GCHQ’s public facing arm, has produced a cyber assessment framework based on the NIS directive. Awen Collective has produced an interactive tool that organisations can use to help them understand where they’re at, collaborate with their colleagues, and make it a lot easier for them to go through the compliance process.

* They have also created an automated asset and risk discovery tool, called DOT. This allows organisations to go into an OT environment and ‘listen’ to the network traffic within.

Farrow explained further:

“The impression that we have so far is that cyber is not really entering into the conversation as it should be. And the temptation obviously will be to rip the offending device off the wall, popping a new one up, hoping for the best. They need to be back up and running immediately.

“And the regulators are on top of critical infrastructure organisations on any downtime.

“So, by having this data it should help inform those plans and processes to ensure that cyber is part of our organisation.”

Awen Collective is part of Tech Nation Cyber — the UK’s first national scaleup programme for the cyber security sector. It is aimed at ambitious tech companies ready for growth.


Related articles

Tech Nation’s cyber security cohort: Awen Collective company profile

Tech Nation’s cyber security cohort: Skurio’s company profile

Tech Nation’s cyber security cohort: XQ Cyber’s company profile

Tech Nation’s cyber security cohort: Assuria’s company profile

Democratising technology for cyber security and the power of AI

Automation is shaping the future of the workplace


Latest news

divider
Education
University of Dundee partners with TechnologyOne

University of Dundee partners with TechnologyOne

16 September 2019 / The University of Dundee today announced it has moved its core financial functions to enterprise [...]

divider
Events
Tech Leaders Awards 2019 – winners revealed

Tech Leaders Awards 2019 – winners revealed

13 September 2019 / The UK’s top tech leaders, innovators and disruptors were revealed last night at the inaugural [...]

divider
Blockchain
Demystifying blockchain to reveal its business benefits

Demystifying blockchain to reveal its business benefits

13 September 2019 / Chief Financial Officers are currently having a hard time. The stresses being imposed by the [...]

divider
AI & Machine Learning
The use of AI in robotics and hardware: what CTOs need to know

The use of AI in robotics and hardware: what CTOs need to know

13 September 2019 / In today’s ultra competitive environment, every business must implement advanced technologies to stay ahead of [...]

divider
Blockchain
Are blockchain regulatory frameworks a necessary safeguard or an inhibitor of growth?

Are blockchain regulatory frameworks a necessary safeguard or an inhibitor of growth?

12 September 2019 / Regulatory frameworks exist for different verticals and technologies. They help in defining the ground rules [...]

divider
AI & Machine Learning
A history of AI; key moments in the story of AI

A history of AI; key moments in the story of AI

12 September 2019 / The history of AI BC: Talos: The history of AI begins with a myth and [...]

divider
AI & Machine Learning
Finding talent for those hard-to-fill AI jobs

Finding talent for those hard-to-fill AI jobs

12 September 2019 / According to research by SnapLogic, the software company, although 93% of IT decision-makers in the [...]

divider
Smart Cities
Why we should dispel the negative image of smart cities

Why we should dispel the negative image of smart cities

12 September 2019 / Whether it’s stories about people being treated like ‘lab rats in a surveillance experiment’ or [...]

divider
AI & Machine Learning
Developing your AI skills: what AI courses are available?

Developing your AI skills: what AI courses are available?

12 September 2019 / As the technology moves across the hype cycle, AI skills will become an increasingly important [...]

Do NOT follow this link or you will be banned from the site!

Pin It on Pinterest