Hydrocarbon Processing - February 2022 - 13

Business Trends
place for every aspect of the OT operation,
including inventory management,
patch management, events management
and incident management. In addition, it
is important for organizations to leverage
technologies. Many industry leading tools
provide real-time information about the
landscape of the OT network. The need
to have good visibility of all assets and applications
domiciled in the OT or process
control network cannot be overemphasized.
Inventory management is critical.
It is imperative to have an account of everything
that resides in your OT network.
It is critical to have functional backups
and a well-defined disaster recovery process
in place. This cannot be overemphasized.
It is vital for organizations to have
robust backup infrastructure in place, not
just onsite, but offsite too, because, in a
worst-case scenario, onsite systems and
backups can be lost. You must be able to
return to operation as soon as possible
within your defined recovery time objective.
Backup and recovery are key parts
of any change management process in
an OT network. For example, to install a
patch, you should confirm that you have
a reliable backup that is updated so that if
the patch breaks something, you are able
to roll back to a known good state. Having
a reliable backup and recovery solution is
critical to the security and availability of
OT network assets.
Both the IT team and the OT team
must work together to achieve a reliable
backup and recovery process for the OT
network. In fact, they are working toward
the same objective, which is to ensure
that you can return to production as soon
as possible. IT helps provide the connectivity
for offline backups, and they play
an essential role in saving forensic information
and investigating what happened
to help prevent those kinds of attacks
from happening again. It is vital that the
IT team be part of OT incident response
planning and testing exercises so they can
leverage their understanding of enterprise
network dynamics to support any
incident that occurs in the OT network.
IT should be part of regular drills for incident
response so that IT and OT personnel
clearly understand their roles and how
they should act in case of an incident.
IT and OT teams also must share alert
information to fully understand the nature
of activities in the OT environment.
For example, there can be unusual activity
in the IT network that OT should know
about. Also, sometimes when you troubleshoot
in the OT network, you generate
unusual traffic that can raise a flag in
the IT network. Open channels of communication
should be always maintained
between OT and IT teams so that deviations
on either side are not normalized.
The importance of this close relationship
grows as more OT process control
applications move to the cloud. Cloud
technology provides many benefits, but it
must be adopted with caution in the OT
network. To manage risk associated with
these new control technologies, testing
must be done in a lab environment before
deploying anything to production environments.
This is another area where IT
and OT should work closely together. I
see a future where there is no real distinction
between IT and OT teams because
that is when you can achieve the synergy
you need to better protect all the assets in
the OT environment.
HAVING A VALID
CONFIGURATION
BACKUP IS CRITICAL
A. V. Gil-Ortega, Fortinet
The best way to protect against sophisticated
targeted attacks is to have
strong defenses, but also the ability to
recover quickly when an attack happens.
To do this, you must have good cooperation
between IT and OT teams so you
can see activity that is coming from the
outside and understand its impact on the
OT environment.
For defenses, you need both prevention
and detection strategies that reduce
the probability and impact of an attack.
Prevention includes IT cybersecurity
practices designed to keep bad actors out;
it also relies on segmentation of the industrial
environment. With segmentation, if
an attack penetrates, you can isolate it before
it affects the whole site. Monitoring
and detection are important for recognizing
the first signs of an attack on an OT
environment. Prevention and detection
must work together to meet this kind of
threat. With only one or the other, you
can easily miss the start of an attack.
If an attack happens, you must identify
and isolate it, and then you must restore
systems. This requires having data that forensics
can use to understand the attack,
as well as recent snapshots of the systems
you are going to recover. It is important
to have valid backups of all operational
data and configurations. It is also a good
practice to have a separate configuration
backup that shows the history of the data
and all system changes. Those configurations
become the basis for restoring systems
and restarting safely.
Without a valid backup, successfully
restoring a compromised system is difficult.
When backing up OT configurations,
you normally run periodic backups
and one-time backups whenever there is
a significant change. We take a two-step
approach that involves backing up system
configurations close to the systems so
that we can quickly restore them. However,
we also have a second backup out
of the network in case the entire site is
compromised. In this way, once an attack
has been mitigated, we can restore proper
configurations and restart the systems.
To recover compromised systems after
an attack is mitigated, you need access to
the last valid backup. This begins by verifying
that the source of the backup has
not been compromised. You start with
local configuration backups and then fall
back on the offsite backups. If you cannot
verify that the backup is uncompromised,
you risk restarting the system in a compromised
state. In that case, you must stop
all automatic processes and begin manual
checks of everything.
To have effective prevention, detection
and recovery capabilities, you must have
clear knowledge of your control systems
inventory. You cannot monitor, detect or
restore something if you do not know that
it exists. That is only possible with a complete
inventory. Additionally, IT and OT
must recognize that they need each other
to ensure secure operations. IT and OT
have different practices, and you cannot
pretend they are going to work the same
way. In certain areas, they need each other.
For example, given the importance of
configuration backups on the OT side,
OT engineers can work with IT to make
sure there are secure copies in different
locations where the OT people can access
them. The key is to make backups
when significant changes are performed
in control systems, and this data cannot
be known by IT without proper coordination.
Each side must recognize the
things that are important to one team
are important to the people in the other
room, too.
Hydrocarbon Processing | FEBRUARY 2022 13
Hydrocarbon Processing - February 2022

Table of Contents for the Digital Edition of Hydrocarbon Processing - February 2022
