Defending Singapore's critical infrastructure
by Teck Wee Lim, Regional Director, ASEAN at CyberArk
 |
| Source: CyberArk. Lim. |
Singapore also rolled out the Operational Technology (OT) Cybersecurity Masterplan in 2019 as part of its continuous efforts to enhance the security and resilience of its CII sectors in delivering essential services. The country recognises nine critical sectors, namely, energy, water, Banking and Finance, Healthcare, Transport , infocomm, Media, security and Emergency services, and Government.
All these critical sectors heavily rely on computerised OT to function.
OT systems were designed to have a long lifespan, with a focus on reliability and safety rather than security. These systems run on proprietary control protocols using specialised hardware and software and are often isolated from business networks and the Internet. Therefore, OT systems were traditionally “secure through obscurity” as they were typically air-gapped from other systems.
Today, however, the extensive links among enterprise IT and OT networks, businesses, operators, vendors, and other third-party systems have greatly increased the operational footprint of networks, putting them on the map as attractive targets for cybercriminals. As such, we need to ensure that cybersecurity measures safeguard our OT systems as they become exposed to evolving cyberthreats.
The convergence of technologies increases surface attack areas
As OT is fast converging with IT, critical industrial control system (ICS) endpoints and other assets are becoming exposed to aggressive cyberthreats, making CIIs vulnerable to attacks.
With the addition of remote access, the Internet of Things (IoT) and the cloud, the attack surface increases significantly, allowing more opportunities for attackers to get into IT and OT systems. A successful attack on critical infrastructure could disable or destroy production lines and industrial processes, leave cities in the dark or shut off critical life-saving technologies. The repercussions are grave and difficult to bounce back from.
Corporate IT executives are aware of the hazards. In 2020, the Ponemon Institute conducted an Industrial Security Survey and worked with more than 2,500 cybersecurity experts on OT systems worldwide. It found that 57% of the respondents believed that they will face one or more attacks, and almost half (48%) think that the risks are higher for OT systems than IT systems.
Nearly half also said that the threat to OT systems is increasing. One-third even admitted that their companies suffered the loss of OT-related intellectual property as a result of previous attacks. On the whole, the cybersecurity practitioners identified the three biggest threats as phishing, ransomware and denial-of-service (DoS) attacks.
In addition, most critical infrastructure companies operating with legacy security measures are in a position of relative blindness. As it is near impossible to defend against threats they cannot see, these companies only know if they have been attacked after the damage is done. It could take weeks, months or even years of suffering an initial intrusion before an attack gets detected.
One of the most significant concerns right now is the sharp rise of ransomware attacks targeting the critical infrastructure space. According to a report from The Institute for Critical Infrastructure Technology (ICIT), “if a Supervisory Control and Data Acquisition (SCADA) or ICS system in an energy, utilities or manufacturing organisation becomes infected with ransomware, then lives could be jeopardised in the time it takes to investigate the incident and return the systems to operation.”
A Zero Trust playbook for Ransomware protection
Just recently, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued guidance on protecting critical infrastructure from ransomware. Attacks on ICS often begin with identity compromise at the endpoint and subsequent abuse of privileged credentials. As such, the two organisations recommend CII owners to take the necessary precautions to mitigate or prevent risks should they ever be targeted by ransomware attackers.
The CISA and the FBI recommend that user and process accounts be limited through account use policies, user account control and privileged account management. Further, they advise organising access rights based on the principles of least privilege and separation of duties. Local businesses can also follow the guidance for defence-in-depth ransomware protection.
Moreover, unusual user activity or unauthorised credentials used to access an ICS asset could also indicate signs of an attack. Understanding the context of a user’s actions helps add another layer of security. Users will typically interact with the company system at the usual time, accessing the usual files. Anything that breaks the pattern can be flagged, logged and blocked.
It’s one thing to be logging on from Singapore at 12 noon on your usual laptop to begin work. It’s another to be logging on at midnight from a foreign country using a desktop PC. It is crucial to detect and identify all actions that are done beyond the par for the course.
Following the Zero Trust cybersecurity model of “never trust, always verify” helps organisations to secure individual identities throughout the cycle of accessing critical OT and IT assets. When identities can be authenticated accurately, authorised with the proper permissions and given access to privileged assets in a structured manner, organisations are better equipped to find attackers as they move throughout a network and stop them before they can disrupt critical systems, threaten uptime, compromise sensitive data and jeopardise consumer safety.
While we are fortunate to have escaped relatively unscathed so far, we have already seen our fair share of cyberattacks. Singapore’s resilience against cyberthreats will also attract opportunities offered by new digital technologies that appeal to investors as a strategic and secure location for their business.
Comments
Post a Comment