The process itself is at stake. Instead of trying to protect data like your personal banking information, industrial control systems manage the operation of machines, processes, and protects them if something malfunctions. We focus specifically on the process and the supporting network so we are able to make cyber security a manageable engineering problem.
For instance, if you are running a chemical reactor and it can become unstable in certain scenarios, then we focus on insuring that those scenarios can never be created even if a hacker has complete control and knowledge of the process and control system.
Our cyber security team is comprised of seasoned industrial control system and IT technology experts with many years of experience. We have a deep bench of control system experts in process control, discrete manufacturing, building automation, and IoT technologies.
Vulnerability Assessments & Penetration Testing
A vulnerability assessment evaluates the ICS network design and devices for security weaknesses. We are looking for known and not so known problems that are commonly missed. This type of testing is delicate on industrial control systems because many of the devices, programmable controllers and other forms of logic controllers for example, were built to control a process and not run antivirus software and support inquiries from cybersecurity tools. Consequently, it takes a very capable team to deeply analyze an industrial network.
Additionally, knowing where to gather communications traffic in an industrial control network can be challenging. For instance, in an IT network most traffic is from your desktop to a server or the Internet. Not so in an industrial network. You can have machines talking to machines anywhere in the network based on coordinating motion and product flow. Additionally, communications can look significantly different in an OT environment where unique protocols like UDP are commonly used for timing and control.
In addition, on request, Kenexis also commonly analyzes for performance and reliability during a vulnerability assessment to identify poorly performing devices or networks.
Our final report includes asset inventory, vulnerabilities discovered, severity ratings, recommendations, overview of tools and methods utilized and findings. Once the project is complete, we either destroy or return communications traffic collected for analysis.
While a vulnerability assessment is passive, a penetration test is performed with specific written permission to pursue vulnerabilities further into the system to discover the extent of possible exposure or risk.
Conformance & Gap Assessments
Conformance and gap assessments analyze the a client’s existing policies, procedures, and practices against industry best practices, including, but not limited to appropriate local standards, the ISA/IEC 62443 series, ISO/IEC 27001/2, the NIST Cybersecurity Framework, the NIST SP800-53/82 guidelines, CIS Critical Security Controls, and NESA. We can assess against other standards and regulations as required.
The result of this conformance and gap assessment is a report specifying the gaps that were found in the existing policies, procedures, and practices and a set of recommendations for filling those gaps.
Policy, Procedures, and Training
Often, an independent evaluation of an organization’s industrial control cyber security policy or procedures is requested. More often, organizations ask for assistance in developing them with their team.
We will work with your team to insure agreement across your organization, rollout, and adoption. The established policy, procedures, and training will drive security focused behaviors without compromising performance and connectivity. It will also establish a method for budgeting decisions, and accountability.
While there are several organizations like ISA, SANS, and others that provide ICS cyber security, we provide specific training that is tailored to an organization’s team and appropriate for their industrial control systems.
Design & Migration Planning
Design services are based on solid industrial control system network design with secure communication and reliability as defined in ISA/IEC 62443 and other standards as required by your industry or region of the world. Our design services focus on providing secure and reliable industrial networks including designs to implement SIEM and other cybersecurity monitoring like Nozomi Networks SCADAGuardian that will serve your business well with better visibility, secure remote connectivity, and less unexplained downtime.
Migration planning services will help you document current state and target state and how to procedurally get from one to the other.
Industrial Control System protocols are modified Ethernet protocols. Many of those Ethernet protocols were created originally as serial communications before the wide spread use of Ethernet networking. They support proprietary inter-process communications and were originally built to provide reliable and deterministic communications long before routable protocols and Ethernet security was a consideration.
Today, many devices like MTUs, RTUs, PLCs, building automation, access control systems, Internet of Things (IoT), and other controllers including devices like variable speed drives and instrumentation have routable protocols. The devices and the protocols were created long before cybersecurity concerns of today and the devices do not have the capability to protect themselves. In fact, many even lack means of authentication or integrity checking and are vulnerable to potential attack or just mistakes.
Consequently, it is up to all of us to protect industrial purpose made controllers from attack using solid, proven engineering and security techniques.
- Oil & Gas, Petrochemical, Chemical, Pharmaceutical
- Power Generation including Nuclear, Gas, Coal, and Hydro
- Manufacturing including Automotive, Metal, Food & Beverage
- Transit including Rail, Shipping, and Terminals
- Government & Municipalities including Military, Research, Water & Wastewater
Recently, Jim Gilsinn presented at BSides DC 2016 about cybersecurity [...]
This week, someone attempted to penetrate our systems again. Many of [...]
As a consultant, I travel on a regular basis. When [...]
Make sure to check out the cover article in ISA’s [...]
It is important to note the difference between ‘patching’ and [...]
It appears the US is going to blame Iran (ink to [...]