How to Achieve Industrial Visibility

When it comes to cyber security, Belden and Tripwire recommend a three step progression that can help any industrial environment evolve from highly vulnerable to strongly protected against these inevitable threats. Of vital note, these steps protect networks from any cyber event - everything from malicious external or internal hacker attacks to human error and unexpected component failure—the latter events are far more common and often just as damaging, if not more damaging.

Step 1: Achieving Visibility

Step 2: Establishing Protective Controls

Step 3: Ongoing Continuous Monitoring

If you are a “newbie” to industrial cyber security and aware of how extraordinarily important it is to move away from being in a highly vulnerable environment with little or no protections in place, but unsure how to proceed, you are not alone. However, don’t let uncertainty lead to ongoing vulnerability that can and almost certainly will lead to downtime and lost productivity, if it hasn’t done so already. The steps are manageable.

Industrial Visibility: Starting at Ground Zero

As I noted, the first step in any cyber security strategy is creating Visibility. As we often say, “How can you protect something if you don’t know what you have or what it does, or what ‘normal operation’ even looks like?” The obvious answer is “you can’t,” and I find that just asking the question often leads to a lot of head nodding, since most network operators will freely admit that their network is not mapped out anywhere. With things so frequently added to the network over the years and no methods in place to keep tabs, it is an extremely common situation to have little to no idea what you have.

This is especially true as networks add more and more productivity-enhancing outside data connections, are combined through acquisitions, add segments with new production and automation capabilities, and so on. But you must have these insights in order to move forward, and, for example, know where to place firewalls and other kinds of protective control solutions, and accurately ensure that every single point is optimally protected. After all, it only takes one “missed” unprotected point to allow a hacker malicious access into your industrial control system.

The Six Components of Complete industrial Visibility 

There are a half dozen aspects of visibility that, together, provide a complete picture into the state of your network. They are:

1.  Asset Inventory—taking stock of every piece of hardware and software on the network and capturing all relevant information– vendor, make, model, firmware version, installed software, etc. This is a vitally important step. In fact, many people equate “Visibility” with asset inventory, and although it is a vital part of it, it is only one component. Keep reading.
   
   
2. Configurations—a snapshot of how each device on the network, such as controllers, switches, routers, firewalls, databases, HMIs, engineering workstations, etc., is currently configured, so that any changes to those configurations can be quickly flagged.
   
   
3. Log Information—log files can be a treasure trove of information: who is logging on and when? Where are they maneuvering to? Are they changing something? And what is the password behavior? Was it correct the first time, or did it take 20 failed attempts in ten seconds to log on? Obviously, this is the fingerprint of a brute force attack to break the password.
   
   
4. Known Vulnerabilities and Defined Weaknesses—these are tracked and correlated against the hardware and software that have been identified as being on your network, with corrective action prioritized with a risk rating. Most vendors publish alerts if a security issue is uncovered with their products, and make new firmware or patches available. Also, organizations such as Homeland Security alert users by subscription. Large networks may receive many of these announcements; this aspect automates this vital process to help you stay on top of it.
   
   
5. Communication Pattern Changes—a snapshot of “what is talking to what” is taken. If, down the road, a controller is suddenly talking to a different IP address, or a communication that used to occur once a day is now transmitted several times in an hour, or a VFD is being directed by another source, it can be flagged for attention.
   
   
6. Network Topology—a snapshot of how the constituent parts of a network are arranged and interconnected. Once you know, you can readily identify changes and determine their legitimacy. 

A complete Visibility solution encompasses all of these six dimensions. All are interconnected and often inform each other to give a more complete picture, and all must be covered to avoid leaving a gaping hole in the armor. For example, a log entry confirms that Joe Jones, a legitimate user, logged on at 12:00. However, it would be dangerous to assume that just because Joe has the proper credentials that everything he does is fine—what if Joe is distracted and makes an error, or he is disgruntled, or what if his password keystrokes had been captured and emulated by an imposter? Therefore you have to correlate that with the actions that Joe performed. Did he change a configuration? Did he maneuver to an area with a known vulnerability? Looking at multiple aspects and their relationships enables you to fully understand the situation. 

How Visibility can Turn into Vulnerability

It may sound like a lot, and it is. That is, there is lot to be covered, but fortunately, there is not a lot that an operator needs to do to cover it all. In fact, this complete holistic Visibility - gaining insight into every point and not leaving any one of them invisible and therefore unprotectable - is fairly readily attainable. For example, Belden subsidiary Tripwire has an all-in-one product, Tripwire Industrial Visibility, that performs all six of these functions automatically. And there are other quality products out there that can do one or several functions and can be mixed and matched to achieve the results you desire and give you this strong Step 1 foundation for your cyber security efforts.

The most important thing is not to be frozen in place, and to move forward decisively, taking the first step to gain Visibility into your environment. Once that’s done, you can identify and implement the right protective controls, and lock your network down tight against threats of all kinds. And then, with continuous monitoring, get all this actionable data generated on an ongoing basis.

If you have any questions, feel free to contact us. Or, if you want to find out more about Tripwire Industrial Visibility, we’re glad to provide information, quotes, or arrange a no-cost demo. Call us anytime to discuss the possibilities. We want to be your cyber security resource.