How can you secure legacy control systems?

Now that the Cyber Kill Chain (Sorry Lockheed) is well understood, documented and system'ified into Cyber tools. We have a much stronger ability to protect legacy ICS systems. If the asset is un-patchable or the HMI's Operating system or application code cant be changed, just map the kill chain around the device and mitigate risk in that way. There are even tools that now offer virtual patching around the same problem. Applying the MITRE ATT&CK alongside NIST and IEC on legacy systems is a very strong foundation to your overall industrial cyber posture.

Strengthen authentication mechanisms and ensure that only authorized personnel have access to the control systems. Multi-factor authentication must be used where possible. Data encryption must be deployed to protect sensitive data and prevent unauthorized access to critical information. The state-of-the-art in cyber-security and blockchain must be employed. It is also imperative to regularly backup the control system configurations and data. An agile backup and recovery plan must be developed and rigorusly tested to minimize downtime in the event of a cyber incident.

The approach: 1- Recognize the unique vulnerabilities of these systems. 2- Implementing robust network segmentation is crucial; isolate these systems from broader networks to limit potential breach impacts. 3- Regularly update security protocols and software, balancing stability with protection. 4- Focus on human factors: train staff in cybersecurity awareness and establish strict access controls. 5- Consider gradual system upgrades, replacing outdated components with more secure, modern alternatives.

Network segmentation sounds like such a basic premise but there are customers in Africa (and I am sure other places also) which are still running flat networks and have in some way or form connectivity between their internet facing IT and their OT network. For the customers that have taken the step to segregate IT from OT I normally find Fortinet Industrial firewalls doing this job. My role then as consultant is to showcase lateral movement risk from high value targets like HMI's and shopfloor safety other windows based MES stations from one OT zone to another. Worse even is the threat movement risk to SIS networks. Control networks are well talked about, SIS networks not so much. Networks segmentation is still a key mandatory safety net.

Network segmentatie zou in het industri?le netwerk een basis moeten zijn. Elke dienst of taak zou je moeten segmenteren. Zelfs segmentatie binnen een dienst is iets wat je zou moeten overwegen. Bijna alle diensten binnen de OT zullen legacy worden. Veel van de assets zijn meer dan 20 jaar aanwezig, een goed gescheiden design maakt het mogelijk dit te doen.

Over patchmanagement voor de OT zijn de laatse boeken nog niet geschreven. Maar houdt rekening dat systemen niet gedurende de levenscyclus updates zullen krijgen. Updates toepassen betekend down-time, testen, toepassen en herconfiguratie. Dit is vaak niet werkbaar. Maak je ontwerp zo dat een asset niet kwetsbaar kan zijn. Voeg hardening uit, en minimaliseer het aantal interfaces, fysiek en logisch.

Monitoring Alerts and Logs regularly to catch signs of Incidence. OS logs, Application Logs, Network Devices logs should be checked regularly. Active identification tools including Packet Sniffers, Protocol Analyzers, Intrusion Detectors should be Responded imidiately. in case of incident Alert Incident Handler should Analyze for False negative Alerts and respond for Containment Eradication and Backup Recovery.

Cyber Education for shopfloor and mining operational staff is a major issue. Many have no access to corporate smartphones or laptops/PC's. This means all the major Security Awareness training systems in the market today do not cater for this workforce. Having small video (Shorts) like briefing sessions that can be played before shift starts could be an option but this is very difficult to monitor and report on. The industry should work towards a solution for this problem. For now we have to do the best with what we have.