Page 123 - Cyber Defense eMagazine Special RSA Conference Annual Edition for 2022

Protecting Converged Systems Requires Visibility, Auditing and Least Privilege

Visibility is key to any advanced, secure remote access system. It is imperative that system operators
can monitor who is accessing the network, what they are doing, and for how long they are connected to
the network. “Always-on” VPNs provide little to no visibility or control over individual user activity.
Alternatively, by restricting unapproved protocols and directing approved sessions to a predefined route,
the potential attack surface is reduced.

A thorough understanding of a system’s data makes it easy to detect anomalous events. This visibility
enables informed analysis. The ability to capture detailed session data for all remote access sessions,
and to review that data in real time, is paramount to securing an OT network. Capturing detailed session
logs creates an audit trail that enables accountability and compliance.

Of note, auditing is a primary example of how the differences between OT and IT systems management
can cause friction. To assess an IT system, operators typically use a technique known as scanning, but
OT systems do not respond well to scanning. In fact, an entire OT system could be disrupted if they were
scanned in typical IT fashion. Instead, OT systems should be queried in their native language.

Understanding how to safely remedy different practices between IT and OT systems is critical in the
process of convergence and is one of the many reasons IT and OT professionals should better educate
on another.

Converged networks should also follow the principle of least privilege (PoLP), a core component of any
zero trust architecture (ZTA). PoLP is the idea that any user, program, or process should only have the
bare minimum privileges necessary to perform its function. PoLP dramatically mitigates the risk of a
cyberattack by restricting a bad actor's ability to move laterally within a system.

Zero trust has become profoundly relevant for OT industrial control systems, as modern cloud-based
technologies have blurred or dissolved the idea of traditional firewalls and network-zoned perimeters.

VPNs permit unnecessary access for operators, suppliers, and vendors, meaning that they do not adhere
to the PoLP or zero trust. Troublingly, VPNs often store privileged credentials insecurely. To protect our
nation’s most valuable resources, role-specific access and individual accountability for shared accounts
must be implemented.

Converged systems are often more exploitable because of the challenges inherent in auditing them,
meaning that when remotely accessing OT infrastructure, a zero trust mindset is critical.

Ensure Security Without Compromising Business Goals

Converging two unique systems will always present challenges, so when bringing disparate environments
together, it is imperative to be diligent about segmentation and engineering throughout the network.

Comprehensive IT protections and secure remote access protocols should be implemented before
attaching a network to an OT system, otherwise that OT system will inherit all those same vulnerabilities,
an exploitation of which could yield seismic consequences.

123