Hydrocarbon Processing - February 2022 - 12

Business Trends
lenge with these systems is false positives.
Humans cannot react properly to floods
of spurious alerts. The operator must
build trust in the alert part of the system
for that to become part of a good incident
response process.
Central to any incident response process
is visibility into OT assets. If you do
not have a trusted picture and understanding
of the actual composition of the
equipment in the OT environment, effective
incident response is challenging.
Responding to, stabilizing and recovering
from an incident requires a detailed asset
inventory. This way, you have high confidence
of predictability and assurance that
if you take a particular action to remediate
equipment or software impairment, you
know what the result will be.
Restoring an OT system to a known
good state is different from restoring an IT
system from a backup. In the OT world,
you do not always have mature frameworks
for backing up and restoring like you have
in IT. Some OT systems are embedded in
a way that prevents you from performing
image backups. You must rely on configuration
backups, yet configurations change.
Plants typically have a change management
process. It is necessary to find a balance
between the efforts you spend backing up
configurations of every component in the
system and the fidelity of configuration
data you need to restore to an operational
state. A good OT asset and configuration
management solution can help with this.
Both IT and OT must be involved in
incident response. Effective incident response
requires a blended skillset, but
there is a necessary division of roles and
responsibilities. The IT side understands
network architectures, backup strategies at
scale and how to create accessible repositories
of backup artifacts. However, when it
comes to actual intervention in a process,
that can only be done safely by operations.
Intervention on OT systems can be
risky if done by pure enterprise IT or an
enterprise IT cyber organization because
they often do not know what the cascading
impact will be of any action they take.
With the potential for serious damage to
the physical plant and the possibility of
increasing the risk profile, actions taken
to mitigate and restore must be managed
by OT people who understand how the
OT systems work, how they interact with
the process and why they are designed to
work that way.
12 FEBRUARY 2022 | HydrocarbonProcessing.com
ONE CHALLENGE IS
KNOWING IF SOMETHING
IS AN ACTUAL COMPROMISE
J. Laas, PNM Resources
You must do three things to be ready
for a targeted attack. These include:
1. Be aware of threats. You need a
level of threat intelligence specific
to your industry and where you
operate. An important source of
threat information is an ISAC.
There are a number of industryspecific
ISACs. In oil and gas, we
have the ONG-ISAC.
2. Segregate your systems. It is
important to layer your systems
so that you can quickly unplug
and isolate islands of functionality.
For example, I was involved in a
response to the NotPetya attack.
When we first learned of this
attack, we quickly shut down all
PCs and servers, but we had a
highly segmented environment
that enabled us to do this without
disrupting production systems
because those systems were fully
isolated. This kind of segmentation
also helps when restoring to
normal operations. Restarting and
reconnecting things is often tricky
because it is always a big question
about when it is safe to restart
those systems. With a layered
approach, you can do your testing
on one segment, and when you are
comfortable plugging in that part
of the system, you can do that and
move on to the next one. That is
why it is important to have these
separate island modes.
3. Know what you have.
Maintaining detailed
documentation and inventory
of your systems are key. This
information must be kept updated.
System inventory is often part of
a crisis management plan. There
are technologies that can scan
production systems, but you have
to be careful with those kinds of
tools on control networks because
scanning can interfere with the
performance of some systems.
Segregating your environment can
help with this, as well. It enables
you to limit access of scanning
to those systems that are safe to
scan and block access to sensitive
control systems.
One challenge in protecting against
attacks on OT systems is determining if
unusual activity is actually an attack. For
instance, you may have a situation where a
control system is not operating the way it
should, or it is reporting unexpected values
on a process. In that case, you should
isolate the system, and you may have to
call in vendor representatives to have
them look at it or install a backup system.
For critical systems, you can have test setups
that duplicate production systems.
This enables you to install a backup and
test it. If there is something that should
not be there, you must track the change
history on that system to see how the
change came about and if it was approved.
Sometimes, it can take a few days to determine
if there has been a compromise.
Collaboration with IT team members
is helpful because they can see what
is happening in the network through
monitoring systems, and they can assist
with backups. However, when something
needs to be restored on the control system
side, only industrial engineers and
the vendor can access those systems.
A RECOVERY SOLUTION IS
KEY TO OT SECURITY AND
AVAILABILITY
V. Ajayi, Ernst & Young
When it comes to attacks on critical
infrastructure industries, the stakes are
high. These are attractive targets for attackers.
Many attacks on these installations
involve meticulous planning on the
attackers' part and may require collaboration
with a malicious insider or a disgruntled
employee. To defend against sophisticated
attacks, organizations must adopt
a multilayered approach to OT network
security through strategic implementation
of controls across the three domains
of people, processes and technology.
For the people strategy, organizations
must ensure that anyone who interfaces
with the OT network has a baseline
awareness of OT cybersecurity. This
should include regular refresher training,
not just the one-time training for those
who work in the OT network. To implement
the process strategy, organizations
should leverage relevant and applicable
industry frameworks and standards to
ensure that they have robust processes in
http://www.HydrocarbonProcessing.com
Hydrocarbon Processing - February 2022

Table of Contents for the Digital Edition of Hydrocarbon Processing - February 2022
