IoT Cybersecurity Startup Landscape Part 3: Critical Infrastructure
By: Dennis Chang
Tags: Startup, Critical Infrastructure, Cybersecurity, Venture Capital, Silicon Valley

Advances in the market

Operational Technology (OT) and Industrial Control Systems (ICS) are used to support mission-critical infrastructures across a wide range of industries. OT is the computing systems that manage industrial operations, and ICS is a sub-segment within the OT sector referring to systems that control, operate and automate many industrial processes. Industrial sectors rely on ICS systems to continuously deliver essential services including transportation, power utilities, communication systems, water monitoring, among others.

Historically, Information Technology (IT), which is the application of computers to process and data, hasn’t overlapped with OT and has been managed separately as siloes. However, the disconnect between these technologies has generated unreliable outputs. OT and IT has increasingly converged in the last few years to enhance performance, reduce costs and enable automation across a wide range of fields. With this, many organizations have achieved more efficient monitoring of critical processes and improved ability to leverage sensor-enabled data through the Industrial Internet of Things (IIoT).

So what’s the problem?

As OT systems grow more connected to IT systems or directly to the internet, a new realm of cybersecurity risks are created. The new OT/IT convergence environment has an added layer of complexity as it has to cater to traditional security requirements while preserving the reliability and safety of critical infrastructure systems. If these systems are vulnerable to cybersecurity attacks, then there’s a chance this might result in catastrophic events.

The need for OT enterprise security and ICS systems is of utmost importance, as it protects the safety of operations for a wide range of fields, from transportation infrastructure to industrials and utilities. Since OT is deployed within critical infrastructure that deliver a wide range of services that people use on a day-to-day basis, compromising these systems puts the lives of countless people in danger.

Threat actors in cyber warfare, industrial espionage and terrorism are becoming more sophisticated with their attacks, hence are more likely to succeed at organizations without appropriate security defenses. In recent years, another source of cybersecurity risk has been associated to the added exposure of infrastructure to business partners, hence granting privileged access to appropriate parties is crucial for security purposes and data protection.

Has anything bad happened?

Attacks on OT and ICS assets increased over 2000% since 2018. Most of the observed attacks were centered around using a combination of known vulnerabilities within ICS hardware components, as well as password-spraying attacks using brute force login tactics against ICS targets. With more than 200 new ICS-related CVEs released in 2019, threats to ICS will likely continue to grow in 2020.

Furthermore, CyberX reported that ICS continue to have outdated systems with old cybersecurity protection in place. 57% of them have weak anti-virus protection and 69% of ICS has security gaps. Additionally, 20% of vulnerable ICS devices have vulnerabilities considered to be “critical” (Kaspersky Labs). Attacks here can cause major damage — an example is the 2015 Ukraine Power Grid hack, where the blackout affected 200,000+ people.

What have regulators done so far?

In recent years, there has been increased pressure for regulatory compliance, as governments and other organizations globally look at new guidelines to enhance critical infrastructure cybersecurity.

Compliance has become an increasing concern for organizations looking to better manage their OT systems. Several regulations that are making the most impact include EU’s GDPR. International Society Standards (ISA) and the Federal information security management act (FISMA). Some important standards to know are:

The 62443 series of standards for securing industrial systems. These provide guidance and requirements for all participants and stakeholders in the life cycle of industrial automation and controls systems (IACS), including component and system suppliers, system integrators, asset owners and service providers. This life cycle begins with the development of single components, such as an embedded controller, or a group of components working together as a system or subsystem.

The new NERC CIP 013–1 standard by the North American Electric Reliability Corporation (NERC), which requires utilities to perform firmware vulnerability analysis to improve supply chain security with deep visibility and transparency into the authenticity and integrity of the software running on the grid. Mandatory elements of the plan focus on software integrity and authenticity, vendor remote access to BES cyber systems, information system planning and procurement, and vendor risk management and procurement controls. NERC is authorized to penalize Utilities up to $1 million per day per outstanding violation.

What are the solutions offered by startups?

The implementation of new industrial security initiatives has traditionally fallen short as there is a lack of specialized personnel in OT security and lack of data visibility within organizations. To help combat this problem, many startups have risen up to the challenge to improve the security of IIoT. The startup offerings in the space can be categorized into the following types: