In 1982, long before a cyber security threat to control system networks was widely recognized, a Trojan horse attack on control system software reportedly caused a huge explosion in a Siberian gas pipeline. Even now, many systems that have been retrofitted for compatibility with the Industrial Internet of Things (IIoT) are not well protected.

Connected devices have led to an increased value on data from real-time monitoring, as well as the creation of initiatives, such as the smart grid, digital oilfields and smart asset management in the water industry. However, these new technologies and applications have also led to a rise in potential security risks within a plant’s network. 

Threat

Because very few companies find themselves able to build a new facility from scratch, many plant managers and engineers are choosing to retrofit existing systems with smart sensors and communication packages to take full advantage of the benefits of IIoT.

Many systems such as motor control centers (MCCs) and programmable logic controllers (PLCs) have an expected lifespan of decades and were originally designed to operate in isolation during a time of low cyber-attack risk. Connected devices can create vulnerabilities if substantial security systems aren’t in place.

Just one weak spot in a plant, such as an unprotected PLC can leave an entire network vulnerable to cyber-attack, especially as there are currently no regulations or clear rules about how these networks should be protected.

Research agency Gartner estimates that more than 20 percent of enterprise security attacks will involve Internet of Things (IoT) connections by 2020 and it is safe to assume that many of these attacks will use weak points such as improperly secured MCCs and PLCs to gain network access.

The Siberian pipeline attack is just one example of the devastating effects of control system vulnerabilities.

Attack

If a vulnerability is present, an insecure network can allow a threat such as a self-replicating worm to quickly become widespread throughout the facility. 

Legacy systems typically worked on closed, proprietary communication protocols and the migration to open protocols including TCP/IP means security flaws are likely to be found quickly and patched before potential attackers discover the risk. When connecting a legacy system to an open protocol security, patches can be vital in reducing potential cyber-attacks, however many manufacturers forgo their roll out due to high costs and concerns about potential downtime.

Just one missed patch can make it impossible to ensure a legacy system is protected.

Preventing vulnerabilities

Retrofitting existing equipment is the ideal way for many plants to take advantage of IIoT, but care must be taken when implementing older technologies into networks. Continual risk assessments are essential to determine potential points of attack and take all connections into account, predicting the worst-case scenario of a security breach. 

For a few plants, a complete overhaul of network security may be necessary, for example updating a protocol to one with continued security patches. However, the majority of plants will find that installation of additional software, security patch updates or a top down study of network connections will be sufficient to bring cyber security to the necessary levels.

Cyber security is an ongoing concern for any plant as the threat of cyberattack is growing year-on-year and is now significantly higher than during the Siberian pipeline attack in 1982. Additional care must be taken when integrating legacy systems into existing networks.

Robin Whitehead is solutions manager at Boulting Technology