Beyond the Air Gap: How IT/OT Convergence Changes the Attack Surface - Akash

Good morning everyone. Thank you for joining me today. I look forward to delivering my talk about beyond the how it and IT convergence is changing the platform. So before we begin a bit about myself. My name is Akash. I'm a Brazilist and this national ventures where we look after most of the UK's interconnect portfolio. My experience is actually made within as resilience and cyber resilience. However, um I've gained a real keen interest in how cyber instance real world physical consequences. So, we'll start off with one of the first concepts which come up in OT security, the air gap. So, what is the air gap? Uh traditionally in OT security, the air gap was the kind of

physical gap between our assets and the actual incident. This was one of the strongest methods to protect OTS's as you had no direct kind of attack on the path for any attacker to be able to access or infiltrate any OT systems. The idea behind this is that it kept OT assets safe um reduce the roots into literal systems and therefore um it stopped any process being affected. This was a use idea but not always um practical in modern reality. So why is it IoT and OT converging? It makes sense that uh the having an air gap keeps OT assets secure but because of due to rapid changes in in in modern times the need to have uh a have it and

converging has become an ever so prison. One of the main things is because of the engineer constraints whenever a engineer needs to come down to site and it could potent they could potentially be thousands of miles away having remote access makes it more easier for engineers to come down to do any kind of patches or any kind of um um any kind of like m critical maintenance for the systems. Another very important thing of why ITM is convergent is because of the the very important importance of operational data. We're currently living in unprecedented times. We've seen the amount of um uh changes that we're getting with our worker. Uh just alone with the heat waves we've been

experiencing, the amount of impact it's been having on our transformers, our assets. It's very important that we're able to collect that operational data because that therefore gives us a better idea on like what our asset health is, where do we need to replace it. Therefore, it's important that we're able to iterate these systems to be able to understand where we sit with our asset health. Another very important thing is the centralized security monitoring that we need for these systems. it's more easy to have a central location such as the TNC to be able to see where we are and how and if there's any kind of uh coordinated attack within our network. So in practicality these connections are good

or each kind of connection has a potential attack pattern. [clears throat] So what makes it different compared to it? So one of the main um so with a lot of assets and IT assets the underlying network is prepared fairly similar. However, with OLT, you have uh the main difference between OT and IT is that within IT, we uh tend to look at it as confidentiality, integrity of data and availability. Whereas with OT, it's usually the opposite where availability is the number one important thing. Especially with a lot of these systems, they're safit. So we want to ensure that they're running all the time with especially with OT as well a lot of it control physical processes whereas

comparison to IT systems you don't necessarily see that another difference between between OT and it is that OT has very specific industrial protocols one of the most common ones which is used in OT is mod bus however there is another common one which is used in some stations called goose with a lot of these security decisions are shaped by safety, availability and and any engineering constraints. If we were to make a change with any kind of OT asset, a lot of it relies on a outage. So it's not a case where we could regularly introduce patches or updates to any of our systems. So for the rest of the talk, I'll follow this simple um diagram. So this is

intended to do show a basic kind of network that we commonly see through. A lot of um actual networking uh diagrams that we have in are more nuanced and complicated depending on the system. So this is just a introductory of um what's kind of like the common uh kind of network we have within a operational environment. So starting with step one remote access this is commonly used by engineers. This is where sort of like any kind of urgent fixes or maintenance is used. The risk between this with this is that if any kind of laptop laptop used by any engineering engineers or any anyone who's uh uh coming down to do any kind of maintenance or fixes if there's like

a uh any weak credentials or any shared accounts this runs a risk of um of compromise and also another risk is poor multibactor authentication. The issue is not necessarily remote access itself is how much trust is granted to these users. Step two is the IT boundary. This is where we see a separation between the IT and the OT network. This is where we like to introduce uh stuff like segmentation where we want to physically separate the IT and the LT boundaries within the DMZ which is the DMZ zone. This is where we want to restrict access between anyone who's coming in to connect to the network with their laptop. [clears throat] U the main risk

here is if that there's any black networks or any kind of excessive fiber measures. Um what we want when we cross this um boundary is to reduce the amount of trust that people get and not necessarily increase it. What we also see in in this film as well is the introduction of um IDS and IPS so intrusion detection systems and intrusion prevention systems. One of the key difference between OT and IT is that we don't necessarily use intrusion protection systems because if we want to ensure that um network traffic is essentially running all the time. This is because uh if we stop that network traffic it could potentially start these safety systems. So now on to the human machine interface

and engine workstations. So with a human interface uh this gives operations visib visibility and control of the pulses. This allows us to see what is actually happening inside sensations where the uh kind of like if there's any changes in valves and all kind of processes essentially becoming very important and critical to the operations and kind of running of the day-to-day of these operational assets. This is where um we can also see the kind of like configuration of these assets come into play. Therefore the the risk is that we don't want anyone outside of our networks being able to access this and make any changes. These systems is more closer to the operations as compared to the IT endpoints and then

as we see compromise can affect operations and onto the next one. So PLC's RTUs and and the physical process. So with um the programable logic controllers and remote terminal units, this is where we see uh death equipment and the um the these type of like different kind of assets come into play. Commands automatically affect uh pumps, valve, breakers, other equipment. The consequence is no longer limited to the computer or more or less to physical systems. Um if anyone's had the unfortunate um unfortunately had to use a trains last last week, we can see how any kind of impact on these systems can cause a cascading effect. It just takes maybe one compromise somewhere to be

able to cause a kind of cascading effect down the line. As we saw, if one train is delayed somewhere else, you you'll see therefore elsewhere. The closer an attacker gets moving toward the more physical impact, the more physical the effect becomes. So when does things become real? Um real instance have shown attackers reaching energy sector um and operational environments. As a good example is the Polish grid attack which occurred in December last year where we saw attackers were able to access the RTU. So the remote terminal units of these units and were able to cause actual physical damage. Um another good example but not necessary related to was the Colonial Pipeline incident which happened in 2020. This wasn't

necessarily a compromise. However, we we saw that with a within the IT network which is uh a part of the network with the IT network was compromised by malware. This therefore caused them to shut down their operations due to a uh potential um potential impact on their operational side effects. attackers don't necessarily need highly sophisticated attack or exploit weaknesses combined as as attackers move through the connected environment. So how do we break the attack down? So uh back to like deeper the basics of of anything inside that it's always about the basic hygiene. So whenever a contract or vendor is coming to site, it's ensuring that they have um strong multifactor authentication, strong credentials, no not the case where

they're sharing credential uh credentials with any other person on site. Uh another key thing is IT OT segmentation. A lot of times when we see um any kind of work that's being done on site, it could be done by a vendor. um it could be done by a vendor who's done something and not necessary documented correctly and they've left a switch or kind of a another asset which is live on it. So being able to segment our network as much as possible prevents that one kind of case where there is some a device connected to our network that allows potential attacks come through that our network is actually segmented as much as possible. Another very

important thing is um network visibility. This is why stuff like this are becoming ever so present because it allows us to gain a kind of better visual visibility of what actually sits on our network. Surprisingly with a lot of networks, half the time we actually don't necessarily know what's within our network, what's actually communicating, what's actually connected just maybe because that we've had a substation or a P that's been running for decades and some some assets have been sitting there for maybe 30 40 years which have not been documented. So they could be sitting on the network which is connect connected to the internet as a potential threat or threat path. Um another thing about also that stuff

like Draos and do is offer that monitoring and like c and capability and uh finally another very important thing is um realistic instead of exercise and response. So in when it comes to ulti a lot of a lot of when it comes to rest and recovery it's ensuring that we we have good exercises in place so that we're able to respond and recover whenever there is a operational incident. So some of the key takeaways um connectivity with the increase of connectivity is this does create attack paths in operational technology consequences can become physical and segmentation and control trust breaks the attack path and leads to more secure operations. So thank you for joining us today and

I'm happy to take any questions.

Oh sorry. Um, you mentioned you, um, prefer intrusion detection over in prevention because you don't want to break it. >> Um, when you make those detections sort of within that trust, how do you like know that those detections have happened? Is that something that has done on site or do you have like a separate kind of information out? >> Yeah. >> No, no, thank you for the question and uh some really good ones. So, so usually we so from my understanding and like my experience a lot of so with the interest in the tape systems a lot of that comes through like platform. So they have like these sensors they come down to site and

it's kind of like a black box where we don't actually know what's happening inside of it and then what they're kind of sensing in and actually what's coming in but to my understanding with um with IPS we don't we don't want to like completely shut down our traffic especially with a lot of these things which are kind of safety critical so the the the like we can to like not shut down our networks we would and a lot of it is that ensuring that we have good firewalls in place and they've completed correctly and whatever we're we're allowing in our network is is properly is is sure that we know as much as possible that is is the right traffic

that we want. Um yeah, so you mentioned that the a lot of the underlying um tech is pretty similar with routters, firewalls, all those things. Do you think there is an issue with um IT companies moving into the OT space a proper understanding of what hardening means and what these protocols actually do? Do you find that that's worse with more and more overcome? >> No, that's a great question and um I absolutely agree. Um especially with a lot of like these systems that have been out running for like many years, they could be 20, 30 years old. The original manufacturer maybe not exist may not exist anymore. So essentially it's kind of like a back and we don't really know

our systems ourselves. So, so having that where we introduce these like third party IT kind of companies coming in to be able to work and operate on our same network giving that access kind of like even within like a kind of sensation how it works it's very sensitive. So a good example is if there's like any works going on sites, you kind of see like any kind of like what the network's gone crazy and then it's that where like what do we do to not upset the network? How do we integrate these IT companies into it? How do we kind of keep it safe as safe as possible? >> So how does testing? >> Yeah, that's a really really good

question. And so like um so when it comes to like traditional pen testing so we have to be very careful as possible. So we're not necessarily the case where we could actually come down to site and then kind of like actually physically test on any of our kind of substations but a lot of a lot of the times where I'll notice um a lot of the pent testing is conducted by our kind of like own that we're contracted with. So they'll have their own kind of virtual environments or virtual machine set up where they kind of try and imitate the asset as much as possible. They kind of run a world. >> Yeah. Essentially. Yeah.

>> No, no, no. We try to avoid avoid as much as possible just because how like sensitive our environments can be. Um the it's cuz how if anything and anything can really affect our kind of network. So the idea behind it is that we try to kind of do a lot of our kind of risk aversion pen testing outside of it and then a lot of our sun restoration recovery and ensuring that we are exercising enough have our other kind of restoration backups in place. So I think the worst case isn't happen that we're ready and prepared. >> You mentioned that a lot of the technology is running sort of old and undocumented. How do you ensure that

that sort of stays safe or is it more that before the traffic's even got to that point it know you know it's safe ready if that makes sense? >> Yeah. No, it's an excellent question and um so it's it's a really good point. So even just one we work out it's like nearly over 50 years old. A lot of the special assets we don't have that much documentation. We probably don't know what teeth only is. Um so the idea behind it is that with these type of assets we'd want to limit the amount of network traffic that we can get to it. It's it's the case where like um we want to be as much as risk as much as

possible. Uh and with these these assets like the it could be the case where it's it's really difficult to replace. Um you have to keep it there. Um stuff like patching could take years potentially do only when there's like push out outages. essentially how much there does get there. >> Yeah. >> Any other questions for cash? Can we have a round close?