Businesses Warned Over Cyber Risks from Internet-Connected Industrial Systems

Businesses using industrial control systems and other operational technology are being urged to review their cyber security arrangements following increased targeting of internet-connected equipment across a range of sectors.

The UK’s National Cyber Security Centre has warned that operational technology systems are being targeted by different groups of cyber threat actors, with some attacks resulting in real-world disruption. The warning applies to organisations operating equipment ranging from manufacturing and industrial control systems to building management and other connected operational technologies.

Operational technology, commonly known as OT, differs from conventional business IT because it controls or monitors physical equipment and processes. Systems can include production machinery, heating and ventilation controls, access systems, pumps, sensors and other equipment increasingly connected to corporate networks or the internet.

The NCSC says organisations should not simply assume that operational equipment cannot be reached from outside their networks. Unintended internet exposure can occur because of configuration errors, legacy connections and equipment that is no longer being actively managed.

The development is creating a growing information security challenge for businesses as equipment that was traditionally isolated becomes increasingly connected.

Remote maintenance, monitoring and diagnostics can deliver significant operational benefits, allowing engineers and suppliers to access equipment without travelling to a site. However, cyber security specialists warn that the same connectivity can potentially provide attackers with a route into systems that were never originally designed to withstand internet-based threats.

In its warning, the NCSC said: “Any organisation that uses, deploys or maintains OT systems should treat this development seriously and review their security posture accordingly.”

One concern is the continued operation of older equipment. Industrial machinery and control systems can remain in service considerably longer than conventional computers, meaning organisations may be operating devices developed when cyber security was a much smaller consideration.

Replacing such equipment can be expensive or operationally difficult, while software updates may no longer be available from the original manufacturer.

Businesses can also struggle to maintain an accurate inventory of connected operational equipment. Systems may have been installed by engineering teams, facilities contractors or equipment suppliers without being incorporated fully into conventional IT asset-management arrangements.

The resulting gap between IT and operational management can make vulnerabilities particularly difficult to identify.

The NCSC has highlighted internet exposure as an immediate area requiring attention, encouraging organisations to understand which systems are externally accessible and remove unnecessary connectivity.

The issue has implications beyond information security because successful attacks against operational technology can potentially affect physical business operations.

While a conventional cyber incident may result in unavailable files or business applications, interference with operational technology could stop production equipment, alter industrial processes or disrupt building and infrastructure systems.

This convergence of cyber and operational risk is leading some organisations to reconsider responsibility for industrial cyber security. Information security teams may understand cyber threats but have limited knowledge of industrial processes, while engineering teams understand equipment but may have less experience of managing hostile cyber activity.

Effective protection therefore increasingly requires cooperation between IT, engineering, facilities management and senior leadership.

The latest warning comes as the NCSC reports a wider increase in the cyber threat facing UK organisations. The agency has said that hostile states were linked to around three-quarters of cyber attacks affecting organisations within the UK's critical national infrastructure and supporting ecosystem over a recent 12-month period.

However, operational technology risks are not restricted to nationally important infrastructure. Manufacturers, warehouses, commercial buildings and other businesses increasingly operate connected equipment that could become vulnerable if it is incorrectly configured or inadequately maintained.

Security specialists expect the issue to become more significant as businesses continue adopting smart factories, connected sensors, automated production equipment and remotely managed building systems.

For organisations operating information security management systems such as ISO 27001, the changing threat reinforces the importance of maintaining an accurate understanding of information and technology assets, assessing vulnerabilities and controlling network access.

It also demonstrates how the boundaries between information security and operational management are becoming increasingly difficult to separate.

As industrial businesses become more connected, cyber security is no longer concerned solely with protecting information. For organisations dependent on operational technology, the security of digital systems is increasingly becoming fundamental to keeping physical operations running.

A message from our sponsors, The Ideas Distillery: 

If you would like to look at how to implement an ISO 27001 information security management system, then simply contact us.

Or, if you want to see what's involved in more detail, then get a completely free, no obligation, totally tailored ISO Gap Analysis for your business (only available to UK businesses).