Industrial Cybersecurity
Experts Share 14 of Their
Biggest Tips and Predictions
Are You Prepared for the Future of ICS Cybersecurity?

Introduction

The task of building and running an effective cybersecurity program is a major challenge for any
complex organization, but those in charge of industrial control systems (ICS) have their own set ofhurdles to overcome that are entirely different than those of their strictly-IT counterparts.
How can industrial organizations address the cybersecurity skills gap? What about the increasinglydifficult endeavor of bringing the IT and OT sides of the organization together under one unified
cybersecurity mission?
In addition to these concerns, there’s the reality that ICS security is evolving quickly. Whateverchallenges there are today won’t be the challenges of tomorrow. That raises the question: what will
have the greatest impact on ICS security in the next 5–10 years?
We asked a number of security experts how they think these questions should be addressed.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions2

Question #1: How Can Industrial Organizations Strengthen
Their Security Posture Amidst the Ongoing Skills Gap?

Galina Antova
Co-founder, Claroty
Automated technology is a very key part of thatanswer since organizations require integrated
cybersecurity posture across IT and OT networks,
consolidated processes and teams. Therefore,
new technologies that could provide the traditional
cyber defense mechanisms but do so in the context of OT networks (which have different uptime/
availability requirements) will help a lot with thisgrowing gap.

Kristen Poulos
GM of Industrial,
TripwireFirst and foremost, organizations can (and should)
be constantly talking about cybersecurity. Industry
role models have already formed internal committees that regularly meet to discuss how they asan organization can become more cyber-secureand how the threat landscape is evolving. It’s those
discussions where other skills-gap closing topics
come to light, such as treating cybersecurity likea program (not a project) and considering external
resources like managed service providers to further close the gap.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

3

Question #1: How Can Industrial Organizations Strengthen
Their Security Posture Amidst the Ongoing Skills Gap?

Patrick Miller
Managing Partnerof Archer EnergySolutions
I think there is a gap between existing HR/management hiring expectations and the thriving talentpool that is out there. If you have a job posting thatasks for a college degree, five years of experience,
multiple programming languages, professional
certificates and security clearance for a salary of$75k, you won’t get anyone. Some engineers areinterested in security and IT. Some IT people areinterested in engineering and process control.
Many entry-level people are brilliant and thirsty formore knowledge and just need to be paired with asenior to rocket their way up three levels in a year.
Throw out the old hiring models, and the blinders
will be lifted.

Nick Shaw
Senior System
Engineer, Tripwire
Either way, regulated or not, industrial organizations have two ways they could go about solving
the skills gap: 1) hire talent and strategicallydevelop a cybersecurity strategy/policy that aligns
with best practices or 2) hire a reputable thirdparty to augment their staff capabilities and provide managed services. Industrial organizations
will need to identify and strategically align withgood partners that have proven experience in thecybersecurity landscape. The right partner will goa long way to develop a comprehensive plan thatbuilds up cybersecurity posture over time.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

Tripwire Tip
To help industrial organizations close thecybersecurity skills gap, Tripwire offersa range of managed security services.
Learn more here.

4Question #2: How IT and OT Can Collaboratein the Name of ICS Security?

Susan Peterson
Digital Leader Of
Energy Industries,ABB
Over the past 10 years, I’ve been privileged to help
bridge the gap between operations and IT teams.
For operations teams, focusing on finding ways toautomate routine security maintenance tasks andshowing how security monitoring technologies
can help solve operations related challenges are
great ways to build a bridge. For IT teams, helping
them understand the importance of engaging OT
suppliers and the maintenance cycles of OT assets
is key.

Paco Garcia
Director ofCybersecurityand Networking
Digital Plant Line ofBusiness, Schneider
Electric
This convergence is mandatory for those people/
companies who want to adapt to new technologies
and paradigm changes that come with Industry
4.0 and IIoT. As the owner of budget resources for
deploying cybersecurity programs, IT must establish a clear framework and enlist OT personnel tohelp secure the plant. The scope of IT and the OT
involvement must be defined explicitly at the outsetof every project. Both roles should be complementary and should not involve competition betweenthem. In that sense, defining the owner for eachtask helps to avoid conflicts. Lastly, from a topdown approach, each company must promote andenforce the creation of workgroups made up of ITand OT people with the objective of promoting thecompany’s digitalization and strengthening theorganization’s internal cybersecurity culture.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

Gary Difazio
Strategic Marketing
Director, Tripwire
The one word for this is: collaborate. At the endof the day, we all want to do the right thing for ourorganizations. Do what is best through collaboration. Understand the unique needs and directionof the shop floor so that cybersecurity solutions
can be implemented to support availability, safety,
productivity and quality of the operation.
Remember that cybersecurity is a journey thatnever ends. Automation systems continue toevolve, and the threat landscape is always changing. Slow and steady will win the race. We mustall be on this journey through collaboration andteamwork.

5Question #2: How IT and OT Can Collaboratein the Name of ICS Security?

Larry Vandenaweele
Industrial Security Professional
Reducing cybersecurity risks and getting better visibilities across the IT and OT network environments
require involvement and participation of IT, OT, security and management stakeholder groups. Learningfrom each other by means of practical awareness workshops is a first step of educating each other.
The folks on the IT side of your organization should educate their business operation tasks, and illustrate
the risks and challenges they face and how they link to the OT environment. For example, installation ofpatches is a recurring activity in IT environments while in contrast OT environments are seldom patched
due to operational challenges, maintenance windows, etc.
The folks on the OT side of the organization deal with challenges that can be directly related to operational and regulatory requirements, making a simple task such as patching not as simple.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

Tripwire Tip
In order to bring the IT and OT sidesof your organization together under
one cybersecurity program, Tripwire’s
portfolio extends key security controls
such as vulnerability management andchange monitoring into the industrialenvironment. Learn more here.

6Question #3: What Will Have the Greatest Impact onICS Security in the Next 5–10 Years?

Justin Sherman
Cybersecurity Policy Fellow, New America
In the next 5–10 years, industrial systems are going to become increasingly connected to the internet as
the Internet of Things becomes more and more essential to industrial operations and as those systems
are also hooked into 5G cellular networks, which are promising much lower communication delays
between devices. Internet of Things device security is usually terribly weak right out of the box, so thiswill be a serious challenge for industrial systems to manage when IoT devices are deployed at scale.
Add to this the fact that increased connectivity means more actors can attempt to break into systems—
and that more sophisticated actors can have potential visibility into systems—and the cybersecurity
challenges from this growing connectivity are exacerbated even further. It’ll also impact not just thosemanaging and securing industrial systems but also those on the public policy side of things as well giventhat many industrial systems, if manipulated in a certain way, could have physical impacts on human life.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

Kristen Poulos
GM of Industrial,
Tripwire
It’s such a fast-moving industry, even knowing
what’s going to happen in the next 5–10 months
can sometimes be challenging! But in all seriousness, the themes of IT/OT convergence andautomation will continue to substantiate the needfor organizations to have a top-to-bottom cybersecurity plan. This means budget consolidation (likelyto IT teams) and vendor consolidation. Certainly, asignificant industry cyber event could turn any prediction upside down, but our mission as a security
community is to provide the solutions to preventthat from happening.

7Question #3: What Will Have the Greatest Impact on
ICS Security in the Next 5–10 Years?

Patrick Miller
Managing Partner, Archer Energy Solutions
In the next 5–10 years, the biggest impact on industrial cybersecurity will be the unintended consequences of digital transformation. This change is good and necessary, but it comes with risk. As we
introduce more and more digital endpoints, these will become data streams. There will be so many
data streams that we won’t be able to hold or efficiently analyze all of that data on-premise. Further,
we will use that data to drive decisions about the process—or even the process itself. Eventually, probably through AI/ML, we will begin to allow the analytical data-products to become inputs back into theprocess.
In other words, process generates data, that data leaves the process network and goes anywhere/everywhere (e.g. cloud, fog, lake, on-premise, off-premise), gets analyzed, repurposed and fed back into theprocess. All of this introduces new risks to the process data and associated systems outside the control/
process networks in ways we are just now beginning to consider.

Galina Antova
Co-Founder, Claroty
The main topic of conversation 5–10 years ago
was as follows: “Are industrial networks really
air-gapped?” I think we all know by now that thisis not the case. Moreover, the increased connectivity (needed for productivity) is making thischallenge even greater. As companies aggressively
undertake their digital transformations, portionsof the industrial process have already migrated
to the cloud, and in the next 5–10 years, we canreasonably expect that most of the non-criticalapplications will be hosted in a cloud environment.
If this transition is done with the right security
measures in place, then it could have huge positive
impact on productivity. However, for entities that
don’t invest enough time/resources into the cybersecurity angle, this cloud migration could become
significant exposure.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

8Question #3: What Will Have the Greatest Impact onICS Security in the Next 5–10 Years?

Greg Hale
Editor/Founder,
Isssource
A quick and easy answer to what will have the biggest impact on cybersecurity in the coming decadeis two-fold: artificial intelligence and big dataanalytics. Given the fact that these developments
will have a major impact in the coming years, I am
convinced a secure environment in 5-10 years will
come down to how AI and analytics all play intoa resilient and holistic security plan that encompasses the entirety of security, which includes
cyber and physical.
With the Industrial Internet of Things (IIoT)
becoming more pervasive in the manufacturing
enterprise moving forward, security experts musthave a plan that understands and knows what all
the networks should look like and how they shouldbehave. At the same time, all security plans need
to be resilient enough to withstand any kind ofassault coming its way.

Gary Difazio
Strategic Marketing
Director, Tripwire
I think that there will continue to be events impacting many different kinds of industrial environments
no matter what the vertical. These incidents willconsist of either collateral damage from IT-based
malware or ransomware, or will be specificallytargeted against industrial control systems. Theseevents will negatively affect productivity and quality and also have the potential for physical damage.
While malware is a risk, nation-state cyber warfare activities will also be more prevalent. This willbe the new battlefield. Automation vendors will bepressured to create automation systems that are
secure by design, and as plant or line upgrades
happen over time, the next-generation systems
will be more cybersecurity aware to thwart malicious behavior. Cybersecurity capabilities will
become part of control systems’ DNA.

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

Tripwire Tip
Did you know Tripwire has the broadest
library of built-in templates covering
the standards, security policies andregulatory requirements for ICS? Learn
more here.

9You Can Trust Tripwire With ICS Security

Tripwire turns raw ICS data into actionable information. Our holistic tools span the IT/OT landscape,and our large ecosystem of technology integrations and vendor-agnostic solutions give ICS operators
plenty of freedom of choice in the selection of automation systems that are best for their business.
Tripwire provides deep visibility through a comprehensive suite of highly-integrated products to detect
ICS cyber threats and breaches, prevent future incidents by discovering and prioritizing risks, andcontinuous monitoring to help keep your security program on track.

Learn More

Industrial Cybersecurity Experts Share 14 of Their Biggest Tips and Predictions

10

Tripwire
leadingprovidersecurity,complianceandcybersecurity
IT operations solutions
forPartnering
enterprises,withindustrialorganizations,serviceprovidersand govern- andTripwire is
is athetrustedleaderoffor
establishinga strong
foundation.
Fortune500 enterprises,industrialorganizations
ment
agencies.
TripwireTripwire
solutionsare based
high-fidelity
asset visibilitysystems
and deepspanningendpoint physical,
intelligencecombined
context; together
these
government
agencies,
protects
theon
inte­
grity of mission-criticalvirtual,cloudwithand business
DevOps environments.
Tripwire’s
solutions
integrate
and automate
and security
IT operations.
Tripwire’s
portfolio
enterprise-classsolutions includes
configurationand policymanagement
manageaward-winning
portfoliodeliverssecurity
top criticalcontrols,
includingassetofdiscovery,
secure configuration
management,
vulnerability
ment,
file
integrity monitoring,vulnerability
log management,
and reporting
analytics.
Learnat tripwire.com
and logmanagement.
As the pioneersof filemanagement,integrity monitoring(FIM), Tripwire’s
expertiseandis built
on a 20+
yearmorehistoryof innovation helping organizations
discover, minimize and monitor their attack surfaces. Learn more at tripwire.com
The State of Security: Security News, Trends and Insights at tripwire.com/blog
Follow
usof
onSecurity:
Twitter @TripwireInc» Watchusatattripwire.com/blog
youtube.com/TripwireInc
The StateNews, trends andinsights
Connect with us on LinkedIn, Twitter and Facebook©2018 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360 and Tripwire Axon are trademarks or registered trademarks of Tripwire, Inc.
All other product and company names are property of their respective owners. All rights reserved.						BRICETP1a1910