Posted to News on 14th Mar 2019, 15:20
Cyber security: secure architecture challenges for real business
Among the presentations at the forthcoming "Smart way to Industry 4.0 with PROFINET Based Technologies' series of seminars to be held in Coventry and London this March is one entitled "Cyber Security - Secure Architecture Challenges for Real Businesses', by Cliff Martin, Principal Engineer, BAE Systems Submarines.
In 2015, approximately 225,000 Ukrainians suddenly found themselves with no electricity at Christmas as a result of a successful phishing email. It is widely believed that Russian operators were responsible for this in support of their hybrid warfare strategy in Ukraine; further to this, they were also successful in slowing remote remediation efforts (between 3 and 6 hours). These attackers are some of the most capable and well funded in the world, yet they carried out the power-down segments of their attacks with shocking simplicity; they logged into HMIs and pressed soft-buttons using valid user credentials.
There has been much reporting around the Ukraine cyber-attacks, particularly in the Operational Technology space; however, it is important to draw attention away from the fear, uncertainty and doubt, and towards those aspects that can help us learn and better model threats. One lesson we can learn of the Ukraine attacks - that attackers, whilst focussed on effectiveness, will invariably follow the path of least resistance. Operational Technology security has always required a different approach to traditional IT, and whilst technically OT security improves year on year, it is important that security programmes continue to take account of the architecture and people/process aspects that influence their risks; in a complex space of multiple suppliers, contractors, customers and sites, evaluating the path of least resistance can be difficult, and the mobile and reactive nature of third-party support can further compound these issues.
This talk will draw on the path-of-least-resistance considering lessons from the Ukraine and similar types of attacks, discussing, from an introductory level, good practice secure architecture models and the challenges posed to their implementation by emerging technology and support requirements. Attention will be paid to the way real-world support & operations solutions can unintentionally, or invisibly, bridge security enforcement zones, and what this means for your threat model.
Follow the link for more information about the seminars and how to register.
