Defining Industrial/Control Security

“The beginning of wisdom is the definition of terms.”  - Socrates (470 – 399 B.C.)

Definitions are important - good ones shape our understanding of concepts while poor ones impair that understanding. Consider the definition:

pen: a tube of ink with a tiny ball bearing at the tip

How useful is that definition? If we give the definition to a non-English-speaker, would it seem like a word worth remembering? Consider a different definition:

pen: a tool for writing or drawing with ink

Someone new to the language would likely hear this second definition and say “ahh - so that's what those things are called,” because she sees people using pens every day.

Now consider the definitions of “cybersecurity” and “information security”. NIST for example, gives the two terms subtly different and lengthy definitions [1] that can be paraphrased:

cybersecurity = information security = protecting the confidentiality, integrity and availability of information

How useful is this definition and understanding of cybersecurity in the world of industrial control systems? At Waterfall Security we see that our customers care enormously about the safe and reliable operation of their powerful, physical industrial processes. Our customers see that assuring correct and authorized control of physical operations is vital to safety and reliability, and that in modern operations, such control occurs most often through computers. The security of those computers is therefore vital to safe, reliable and correct control of physical industrial processes.

New Definition

The problem is that the common, short definition of “cybersecurity” above says nothing about safety, reliability or control. Security practitioners have for nearly two decades worked around this problem. Rather than continue the workaround, I propose a new definition for a new term:

Industrial cybersecurity = control security = protecting safe and reliable physical operations by assuring correct and authorized control of physical and cyber assets

The two definitions are equivalent, even though the former says nothing about control and the latter says nothing about information. The information-security work-around for control points out that control signals are short pieces of information whose availability, integrity and confidentiality must be protected. The control-security work-around for information points out that information is stored in cyber assets, and the only way to breach the confidentiality, integrity or availability of that information is to mis-control the cyber asset. The advantage of the control-security perspective is that it focusses attention on what is important to industrial sites.

Applying The Definition

Consider the Industrial Internet of Things for example - edge devices in control networks connect directly to Internet-based cloud systems for big data analysis and optimization benefits. If we look at this architecture from the information-security perspective, then the first thing we observe is that we are sending data straight out to the Internet from the deepest parts of our control systems. The first question many practitioners ask, then, is “how are we going to protect all that data?” If we look at the situation from the control-security perspective, and the first thing we observe is that every message coming from the Internet back into the edge device, even the smallest acknowledgement message, is changing the instructions that the CPU in that device executes. Every such message is therefore a kind of control. The first question we should be asking is “how do we assure that those controls are correct?” The next one we ask is “Where do those control signals come from, and how do we know that those Internet-exposed computers, and the computers that control them, have been correctly controlled?”

Which perspective obscures the real issue? Which one brings it into sharp relief?

Another example - consider encrypted remote access. I sit in a hotel lobby, using a VPN on the hotel WiFi to reach across the Internet and reconfigure a control system component behind a firewall or three. The information-security perspective suggests again “how do we protect the data crossing the Internet?” We protect it with encryption of course, ignoring the fact that cryptosystems encrypt attacks from compromised endpoints just as happily as they encrypt legitimate instructions. The control-security perspective asks “How many machines on the Internet should be permitted to reprogram my control computers? And how have random attackers on the Internet controlled the laptop that I am using to reprogram by control computers right now?” There is no good answer.

Which perspective highlights the most important issues?

Conclusion

The time has come to stop applying the information security definition of cyber security to control system networks. “Protect the data” obscures our need to protect safe and reliable operations by assuring correct and authorized control. I propose that “control security” is a term whose time has come, and one we all need to start using routinely.

Note: this article was first published in the US DHS ICSJWG June Newsletter at https://ics-cert.us-cert.gov/sites/default/files/ICSJWG-Archive/QNL_JUN_18/ICSJWG_QNL_June2018_Final_S508C.pdf

References

[1] National Institute of Standards and Technology, Information Technology Laboratory, Computer Security Resource Center Glossary, [accessed 2018], https://csrc.nist.gov/glossary

Top 20 CyberAttacks on ICS

For a deeper look at how control-centric organizations design protections and asses ICS security risks and design security programs, see “The Top 20 CyberAttacks on Industrial Control Systems” at https://www.waterfall-security.com/20-attacks

About Waterfall Security Solutions

Waterfall Security Solutions is the global leader in industrial cybersecurity technology. Waterfall products, based on its innovative Unidirectional Security Gateway technology, represent an evolutionary alternative to firewalls. The company’s growing list of customers includes national infrastructures, power plants, nuclear plants, off-shore oil and gas platforms, refineries, manufacturing plants, utility companies, and many more. Deployed throughout North America, Europe, the Middle East and Asia, Waterfall products support the widest range of leading industrial remote monitoring platforms, applications, databases and protocols in the market. For more information, visit www.waterfall-security.com

# # #