With increasing attacks on OT/ICS infrastructure and the rising need to secure industrial output, the focus on ICS security has never been greater. Beyond attacks, manufacturers are also reaping the benefits of higher asset and network visibility and zoning elsewhere.
So how can manufacturers go about putting in place an OT security strategy that is relevant, current, and failproof? Let’s explore the answer.
The need for an ICS security strategy
Many confuse an ICS security strategy with an ICS security policy. The two are quite different from each other.
For starters, an ICS security strategy informs and guides an ICS security policy.
ICS security strategy is also more focused on deriving a framework and structure for managing the ICS security needs of a business.
Also read: The Complete Guide to OT SOC
A well-articulated and clearly defined ICS security strategy will work to establish and extend the overall value of a business from a cybersecurity investments and outcomes standpoint.
Such a strategy should be carefully constructed to respond appropriately to changes in operational environments, network and asset dynamics and compliance requirements. Many components are involved in developing a relevant and useful ICS security strategy. These include vision, objective setting, budgeting, intervention planning and resource allocation and success tracking.
Vision for an ICS security strategy
Defines the direction the organization wishes to take as far as cybersecurity is concerned. A vision can be defined by the organization leadership with the involvement of all stakeholders. The vision should define a vision for ICS security for the organization in the future.
A vision is important for drawing a higher level of commitment and teamwork from all stakeholders and should also consider the evolutionary forces at play that could shape and define ICS security in the future.
A good vision statement inspires confidence and cyber resilience in equal measure.
Objective Setting for an ICS security strategy
This involves developing various aspects of the vision and turning them into security objectives for the company. Objectives for a sound ICS cybersecurity strategy can be drawn from standards such as IEC 62443 or NIST CSF or even NERC CIP.
Sectrio recommends using a combination of these standards to draw the best-of-breed objectives for your corporate strategy.
IEC 62443 standards for example can be used to draw objectives around asset owner responsibilities, supply chain security and risk and gap assessment.
Similarly NIST CSF can be used for risk management while NERC CIP can be (broadly) used for developing asset centric security objectives.
While NERC CIP is focused on energy and utility companies, the following standards and requirements can be considered for guidance for developing strategic ICS objectives
- Physical Security (CIP-006): Protecting physical access to Cyber Systems.
- Systems Security Management (CIP-007): Managing system security through patch management, malware prevention, etc.
- Incident Reporting and Response Planning (CIP-008): Reporting and responding to security incidents.
- Recovery Plans (CIP-009): Creating and maintaining recovery plans.
- Configuration Change Management and Vulnerability Assessments (CIP-010): Monitoring changes and assessing vulnerabilities.
Budgeting, intervention planning, and resource allocation involved in an ICS security strategy
No security strategy can succeed if it does not cover budgets and interventions. It is advisable to have objectives inform interventions that inform budgets and resource allocation. In many organizations, budgets inform interventions and resource allocation.
How can one know if the budgets are adequate? If all the interventions suggested are covered through the budget allocated, then the budget can be considered sufficient.
Also Read: A Buyer’s Guide to OT/ICS Security Solutions
One can also think of spending in a staggered manner starting from covering priority needs first and then leading into the areas needing less attention. Note: a compliance requirement could change the dynamics here.
The following areas should be considered in this phase from an intervention standpoint:
- Asset inventory and management
- Vulnerability and patch management
- Secure remote access
- Risk assessment and mitigation
- Supply chain risk enumeration and mitigation
- Compliance with standards
- Network segmentation
Tracking the success of your ICS security strategy
Tracking the success of the strategy is also essential. Otherwise, a strategy can turn into a corporate document hidden away in a remote stash of files on some unknown server. In an ICS environment, success could be measured based on the following parameters:
- Number of cyber incidents handled, resolved, and prevented
- Security level and Maturity level attained as per IEC 62443
- Number of systems running without the latest patch updates
- The level of zoning and network segmentation adopted
- Number of security controls tested
- The number of false positives generated and handled
- State of security tooling
- Degree of articulation of asset owner responsibility
- The level of employee awareness
- Number of times an incident response and/or disaster recovery plans have been tested
- Number of plants where the strategy has been deployed
Interested in learning how your business can evolve a comprehensive ICS security strategy with the right tools? Talk to us.
Looking at checking your ICS environment for IEC 62443/NIST CSF/NIS2 compliance? Connect with our Compliance and Governance expert.
Talk to us to learn how your crown jewels and assets can be protected through a custom-built ICS security plan. Contact us now!
Reach out to us now.
Conduct an IEC 62443/NIST-CSF based risk assessment and gap analysis now!
Learn more about our ICS security solution and its capabilities around asset inventory, vulnerability management, threat management, and compliance.
Book a consultation with our ICS security experts now. Contact Us
Thinking of an ICS security training program for your employees? Talk to us for a custom package.
