Cybersecurity

Encryption and the CIA Triad

The core of cybersecurity is defined by three intertwining goals: confidentiality, integrity, and availability, commonly known as the CIA triad.

Confidentiality is the idea that information can be kept secret and known only to those people or systems who need that information to perform their duties. Integrity is the idea the information is valid and verifiably correct. Availability is the idea that a system or data are running or available when needed. Each of these core concepts are required when designing a secure ICS or OT network, but the priority of each shifts based on the security zone.

Generally, these security zones are broken up into levels based on the Purdue diagram for ICS security. SEL defines six levels: Perimeter (level 5), SCADA (level 4), Access (level 3), Automation (level 2), Control (level 1), and Physical (level 0). Protocols like Transport Layer Security (TLS) and IPsec are powerful encryption tools for Levels 4 and 5, which focus more on the confidentiality of data. But these off-the-shelf IT protocols are often misapplied in ICS/OT networks, making it more difficult to detect intrusions and to perform forensic investigations into cyber attacks.

Encryption at Levels 1 and 0 should be limited and specialized, like Media Access Control Security (MACsec) or Secure Shell (SSH), which don’t overload protection and control devices with unnecessary code.  

From our knowledge base

• Do IT Cryptographic Security Controls Work for Energy Systems?
• Defense-in-Depth Security for Industrial Control Systems

Attack Surface Reduction

Keeping up with ever-changing cybersecurity threats can seem daunting, but there are several practical steps that all owners of critical infrastructure systems can begin taking immediately to mitigate the risk of a damaging cyber attack.

These steps include knowing all the communications paths to your assets, using the appropriate encryption and authentication tools, practicing need-to-know policies, incorporating multiple layers of defense, developing an incident response plan, and using and managing strong passwords. 

These practical steps do not directly address regulatory requirements or any particular cybersecurity framework. For help meeting regulatory requirements and implementing risk mitigation solutions, please contact SEL Cyber Services.

From our knowledge base

• Ukraine Cyber-Induced Power Outage: Analysis and Practical Mitigation Strategies

Deny-by-Default Cybersecurity

Deny-by-default is the strongest approach to designing communications paths in an OT zero-trust network architecture. We achieve this through our OT software-defined networking (SDN) solution, which is part of the Department of Defense Information Network’s Approved Product List. Products in this list are tested, validated, and certified to the cybersecurity and interoperability standards of Defense Information Systems Networks.  

OT SDN takes the decision-making control out of the switch and puts it with the operator. The operator defines all the primary and backup flows, decides what is and isn’t allowed on the network, and determines what actions to take when a rogue packet is identified.

Anything that doesn’t match the predefined set of rules is identified, denied by default, and either dropped or sent to an intrusion detection system. This eliminates the network technologies that lead to spoofing, MAC flooding and table poisoning, Bridge Protocol Data Unit (BPDU) attacks, ransomware attacks, and more.  

From our knowledge base

• OT SDN Is Certified on the Department of Defense Information Network Approved Products List
• Optimize Your Network For IEC 61850 Systems With OT SDN