The SANS Strategy Guide: ICS Is the Business by Dean Parsons provides a comprehensive analysis of the importance of securing Industrial Control Systems (ICS) and Operational Technology (OT) environments in 2024. As industrial processes and critical infrastructure become increasingly intertwined with our everyday digital world, ICS security must be viewed as a business-critical function that is distinct from IT security.
The Growing Threat Landscape
The strategy guide outlines the evolving threat landscape in 2024 to date, like never before seen attacks from cyber adversaries, including state-sponsored Advanced Persistent Threat (APT) groups affecting business operations, extorting money, and causing harm and destruction. High Impact Low Frequency (HILF) attacks on utilities such as Ukraine’s power grid plainly reveal the potential for catastrophic outcomes of not only infrastructure damage but also human injury. The number of ICS-targeted ransomware campaigns disrupt industrial operations for financial gain is on the rise as well. And supply chain attacks have emerged as a significant concern as the interconnection of modern industrial control systems amplifying the ability to compromise a vast array of networks through a single vulnerable point.
Distinctive Security Needs of ICS/OT
One of the core themes of the ICS strategy guide is the clear distinction between IT and ICS/OT security. Dean stresses that while both domains share some technology, the missions, skill sets, system designs, and incident response requirements are very different. For instance, while IT security prioritizes data confidentiality, integrity, and availability (CIA), ICS/OT security emphasizes the safety of human life and industrial infrastructure, as well as operational reliability, and the continuous function of industrial processes. Readers of the guide will have a thorough understanding of the need to recognize these differences and to avoid the pitfalls of applying IT security controls to ICS environments.
The Five ICS Cybersecurity Critical Controls
To effectively safeguard ICS environments, Dean speak to the importance of the SANS Five ICS Cybersecurity Critical Controls, which serve as a roadmap for organizations to build a robust ICS/OT security program:
- ICS-Specific Incident Response: Develop and regularly test an engineering-driven incident response plan tailored to the unique requirements of ICS environments.
- Defensible Control System Network Architecture: Create a segmented and defensible network architecture that separates ICS from hostile networks like IT and the internet.
- ICS Network Visibility and Monitoring: Implement continuous monitoring of the ICS environment using protocol-aware tools.
- ICS Secure Remote Access: Inventory and secure all remote access paths to ICS environments and control and monitor through multi-factor authentication and secure network segmentation.
- Risk-Based ICS Vulnerability Management: Prioritize vulnerability management and patching based on ICS-specific risks that could provide control over industrial systems.
The Role of Artificial Intelligence in ICS
While AI can enhance threat detection and incident response, Parsons cautions against over-reliance on AI. It should augment rather than replace skilled ICS/OT professionals and be integrated only after the foundational ICS Cybersecurity Critical Controls are in place.
Driving ICS/OT Security Maturity
To advance ICS/OT security maturity, the guide advises Chief Security Officers (CSOs) to embrace the differences between IT and ICS/OT, implement the Five ICS Cybersecurity Critical Controls, and prioritize network visibility. Additionally, AI should be used to enhance, not replace, the expertise of human ICS defenders.
Moving Your ICS Security Strategy Forward
Organizations must integrate ICS-specific security into their strategic planning and risk management processes. As threats continue to evolve, investing in ICS-specific technology, training, and collaboration across teams is essential to protecting and defending the critical infrastructure that powers and supports modern society. Ensuring the safe and reliable operation of systems in organizations with ICS/OT environments is not just a technical challenge but a fundamental business requirement.
SECURING INDUSTRIAL CONTROL SYSTEMS against today’s evolving cyber threats is not just a technical challenge, it’s a business imperative. The SANS Strategy Guide: ICS Is the Business provides insights into the specialized strategies needed to protect our critical infrastructure. Now is the time for organizations to prioritize proactive security measures that ensure both operational resilience and public safety.
