Modern life depends on the automation of large-scale systems. Almost every time we turn on a faucet, switch on a light, or jump on a train, we are relying on industrial control systems (ICS) or supervisory control and data acquisition (SCADA) systems to manage processes like water purification, electricity generation, and mass transit signaling. But relying on computers for such essential tasks requires absolute trust in their security, since attacks, which disrupt these basic necessities, could trigger catastrophic economic and public health and safety collapse.
Start securing your SCADA systems now with this technical brief "Securing Industrial Control Systems (ICS) with BeyondTrust Solutions" Download now
Industrial control/SCADA systems have traditionally remained ‘air gapped’ to protect their mission-critical functions and to ensure the safety of the surrounding communities and the environment.
As manufacturing technologies have matured, organizations have realized the scalability, centralized management, and cost-savings of streamlining IT operations by connecting ICS endpoints to the corporate network. Additionally, many ICS vendors now use standard IT technologies within their solutions – making them more accessible to attacks. To address such concerns, the ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) provides ICS-CERT alerts to assist owners and operators in monitoring threats and actions that could impact ICS/SCADA systems.
To safeguard SCADA, IT security teams must implement appropriate layers of security technologies and processes, which include:
- Reducing the network attack surface by segmenting and managing traffic flows between the ICS and corporate networks
- Reducing the asset attack surface by proactively identifying vendor vulnerabilities and implementing appropriate remediation and protection
- Reducing the privilege attack surface by implementing least privilege, such as by eliminating the sharing of privileged accounts, and requiring all users to login with only the specific privileges required to perform their job function
- Monitoring privileged user, session, and file activities for unauthorized access and/or changes to key files and directories
- Analyzing asset and user behavior to detect suspect and/or malicious activities of insiders and/or compromised accounts
ICS-CERT encourages sound security practices using “defense-in-depth principles.” Since they are considered fundamental technologies to address security best practices, BeyondTrust has mapped its privileged access management and vulnerability management solutions into ICS-CERT requirements. Specifically, BeyondTrust can help achieve the recommendations in the areas of:
- Removing, disabling, or renaming any default system credentials wherever possible
- Establishing and implementing policies requiring the use of strong passwords
- Implementing account lockout policies to reduce the risk from brute-force attacks
- Implementing network segmentation
- Deploying and appropriately updating remote access solutions, such as VPN, if required
- Monitoring the creation of administrator-level accounts by third-party vendors
- Applying patches in the ICS environment, when possible, to mitigate known vulnerabilities
- Monitoring for suspect activities and reporting findings to ICS-CERT for incident response support and correlation with other similar incidents
Mapping BeyondTrust Solutions into ICS-CERT
How do we improve the security of ICS? You’ll have to download the tech brief for that! The tech brief not only maps BeyondTrust privileged access management and vulnerability management solutions into the ICS-CERT recommendations, but also includes a checklist of required functionality, and an appendix listing the more than 75 SCADA systems that we support.