Chapter 9. Real-World Case Studies in IIoT Security

"It's not that we use technology; we live technology."                                                                                   - Godfrey Reggio

The acceleration of IIoT adoption depends on many enabling factors. Of those, safety and security are the foremost. Many technology vendors have started to recognize security as the elephant in the room for IIoT business cases. However, there are still a large number of industrial enterprises who are yet to prioritize security in their IoT adoption strategies, deterred mainly by its associated cost, complexity, and resource implications. Oftentimes, IT security controls are perceived as impediments in highly reliable and deterministic OT environments.

As more and more industrial organizations digitally connect their control systems and OT infrastructures, IIoT security countermeasures are no longer a matter of choice. The Stuxnet incident has already proved the inadequacy of the security...

Analysis of a real-world cyber-physical attack

On December 23, 2015, three Ukrainian heat and electricity distribution companies (oblenergos) underwent a concurrent cyberattack that caused 225,000 customers to lose their power (ISAC-SANS). The cyber adversary remotely sabotaged the SCADA distribution management system (DMS), maliciously took control of the HMIs, and subsequently launched destructive attacks to disable communications with the field. At least 27 substations were reported to have been taken offline.

This Ukrainian incident is a good example to understand the dynamics of a bold and successful cyber attack. The attack was the first of its kind, considering that it targeted a nation's critical infrastructure. It impacted physical assets, people, reliability, and reputation. Although third-party cloud providers (a typical component of IIoT architectures) were not involved in this use case, this study still showcases how the adversaries remotely hijacked the grid's operations; and...

Case study 2 – Building a successful IIoT security program

This section has been adapted from https://www.sans.org/webcasts/case-study-developing-innovative-ics-security-program-real-time-ot-monitoring-capability-oil-gas-infrastructures-103562.

 In Chapter 7, Secure Processes and Governance, we discussed the various components of an IIoT security program. This case study presents how an offshore drilling company implemented a security program from the ground up, for their connected offshore platforms. The security program for their automated fleet and industrial automation control system (IACS) was operationalized to protect valuable assets and ensure the safety of rig personnel.

Background

The drilling company had an automated fleet, spread at offshore locations around the globe, with 700 million USD worth of connected assets. The senior business leadership recognized the safety and reliability risks associated with a fleet IACS, as well as the business imperative to protect customer assets...

Case study 3 – ISA/IEC 62443 based industrial endpoint protection

Multiple security breach reports have highlighted the inadequacy of perimeter-based protection in connected industries and critical infrastructures. Security defenses need to extend beyond the perimeter, all the way to the field devices, and the endpoints should be protected, as well.

In March 2016, in a recorded cyber incident, a water utility's control system was infiltrated, and the levels of chemicals used to treat tap water were altered to unsafe levels (WAT-CAS). The water utility's operational control system was connected to the internet. The control system managed the programmable logic controllers (PLCs) to regulate the valves and ducts controlling the flow of water and chemicals to treat the water. Using SQL injection and phishing, the attackers could obtain the login credentials of the control system, gain access to the PLCs, and alter the level of chemicals. Fortunately, the system was equipped with an alert functionality...

Summary

In this chapter, three case studies were presented to highlight a few foundational IIoT security concepts in a real-world context. The first case study described (based on publicly available forensic reports) the anatomy of a successful cyberattack on a nation's critical infrastructure. It analyzed the trail of activities that led to the attack of impact, and it discussed countermeasures that could have averted the attack.

The second case study presented the business drivers and technical solutions used by an industrial enterprise to develop a security program to protect its connected OT environment. The security program was grounded on several practical considerations, discussed in earlier chapters of this book.

The third case study highlighted an industrial security standard-based approach to extend robust security defenses up to the endpoints.

In Chapter 10, The Road Ahead, we will sum up our discussions by focusing on the road ahead, to build a secure and connected brave new world...