How a Large Manufacturer is Fighting a New Wave of Cyberattacks

From ARIA Cybersecurity Solutions

Keeping production lines running is the lifeblood of any manufacturing company. Disruption and unplanned downtime can lead to millions of dollars in revenue loss. Unlike in the IT environment, operational technology (OT) that controls production lines is expected to run for prolonged periods — often for several months — without maintenance shutdown windows. And devices aren’t allowed access to the Internet for continuous updating.

In addition, OT devices often are in place for the production line’s entire lifespan, running on legacy operating systems that can be decades old, thus allowing the manufacturer to sustain profitability and production targets.

Prior Mode of Operation (PMO): Production Protection

The manufacturer’s PMO included these protections of their OT infrastructure: human-machine interface (HMI) devices, Engineering WorkStations (EWS) and data historians. It focused on creating limited access to where critical production applications run and are therefore most vulnerable, including:

• Use of passive network security focused on limiting corporate and Internet access to and from the plant floor to make it less accessible to attacks.
• Legacy signature-based antivirus (AV) systems, challenged by limited updates to annual maintenance windows and their lack of ability to stop modern polymorphic malware, which gets past signature detection.

• Vendors and contract services providers use of the Internet to get access during scheduled maintenance windows via virtual private network.
• Vendors and contract services asked to use AV-protected maintenance laptops to provide device application updates and troubleshooting during these windows.
• Limited staff — typically one person — at a plant responsible for keeping the devices and applications working, providing asset management, reporting, and overseeing data security, and often responsible for multiple regional plants.
• Limited time for staff to learn and operate advanced security measures, and no time to continuously monitor and fine-tune cybersecurity tools.

User’s Challenges & Requirements

The PMO didn’t meet the customer’s requirements needed to protect it from increasingly sophisticated attacks, including those that get through via the supply chain. The company identified these new requirements:

• HMIs, EWSs, historians and other devices require their OS platform and applications to be protected from all forms of ransomware and malware, supply-chain attacks, and sophisticated breaches (such as an advanced persistent threat, or APT), under the following constraints:

o   Replace legacy, ineffective signature-based antivirus agents that don’t detect today’s malware.

o   Be able to work fully air-gapped for up to a year and retain efficacy of protection.

o   Stop all attacks automatically without human involvement, before production is impacted.

o   Be able to lock down certain devices so no unapproved application nor existing application updates will run until approved.

o   Run on a variety of platforms, from current Windows server/ Windows desktop OS, back to Windows XP SP2.

o   Provide reports to help verify insurance policy and U.S. Securities Exchange Commission (SEC) rule compliance.

• Environment-related requirements:

o   Deploy factory-wide, coming up fully protected within a four-hour window for all site devices.

o   Be simple to deploy and operate with no need for formal training due to limited time for onboarding.

o   For IT, the ability to automatically export the appropriate reports for compliance purposes, and securely send forensic syslog information formatted for the IT organization’s security information and event management (SIEM).

Selecting the Solution to Meet Requirements

A number of solutions were analyzed for their ability to meet these requirements. Some solutions that were considered lock down systems to assure only approved applications run, but they only run at the time the OS or the applications are started or restarted. They don’t provide protection from attacks to the approved applications while they are running.

To counter this, the vendor recommended continuous patching to mitigate application vulnerabilities. However, this technique requires rebooting the production environment continuously.

The Application Allow Listing didn’t stop fileless malware nor sophisticated attacks by the contracted Red Team, a group of people authorized by the user to pretend to be cyberattackers to expose vulnerabilities.

In addition, some solutions proved difficult to run out-of-the-gate and had to be tuned by skilled, trained staff to allow the applications to continue to run with every patch update, or when rarely run applications were activated for the first time.

Next-Generation Antivirus

The IT side of the organization used the industry’s leading next-generation antivirus (NGAV) and endpoint detection and response (EDR) solutions, and proposed these be deployed for the OT organization.