GrayMatter Cyber Best Practices
March 9, 2022
Episode 20: How GE Proficy Historian Updates Bring Value to Multi-Plant Manufacturers, Utilities & More
March 15, 20222022 OT Cybersecurity Snapshot
GrayMatter surveyed industrial professionals about the common challenges we see when assessing an industrial organization's cybersecurity strategy to secure its operational technology.
We heard from pros in water/wastewater, manufacturing, energy, food & beverage, energy and a few other industries.
Q: If your organization had a cybersecurity event today, do you have an incident response plan that identifies the people to notify and what to do?
More than 1 in 3 respondents (36%) said they lack this key part of a cybersecurity strategy.
1 in 3
Why it Matters
Cybersecurity threats evolve over time. An attack can spread as an adversary moves laterally through a network in search of sensitive client data, intellectual property and administrator-level credentials.
The more efficiently your team executes a response plan, the more quickly it can isolate affected systems and reduce the cost of a breach. The average cost of a data breach in 2021 topped $4.24 million, an amount that could be cut by 50% or more with the right mitigation measures in place, the Ponemon Institute reports.
What You Can Do
A third-party cybersecurity assessment can map out a response plan — a combination of automated and in-person interventions — that’s appropriate for your organization and aligns with your industry’s best practices and regulatory requirements. Learn more about GrayMatter's cyber assessments in a one-on-one cyber briefing.
Q: When is the last time your organization mapped its network of connected assets and how they communicate?
The Good: Most said (60%) they’ve inventoried their assets in the past year.
The Bad: About 21% said it’s been 3+ years, never or they’re unsure.
21%
Why it Matters
Organizations should be analyzing network maps and connections, or topology, regularly. It’s hard to protect what you can’t see.
“Without a proper network topology, you can’t place the right controls and protections around your most critical and vulnerable OT assets, which might be unpatched PLCs or sensors on Level 1 of your network, but could also be legacy operating systems running on workstations,” says GrayMatter Cybersecurity Practice Director Scott Christensen.
What You Can Do
Network segmentation based on the responsibilities of network assets mapped during an assessment allows organizations to calibrate their protections and make it difficult for a vulnerability that impacts one network level to affect other levels. Solutions like deception technology offer more protection by creating decoy assets and preventing IP addresses, nations and apps from interacting with a company’s ICS environment.
Q: Do you have documentation of the cybersecurity tools your company uses, potential vulnerabilities and overall risk profile?
Documentation is a big challenge for the 42% of respondents, who said they don’t have info about their current cybersecurity tools or a sense of their risks.
42%
Why it Matters
Government regulation is changing OT cybersecurity. There’s a constellation of rules that already require (or could soon require) industrial organizations to conduct a cybersecurity assessment, report “significant” cybersecurity incidents or implement protections.
For example, the Strengthening American Cybersecurity Act, which passed unanimously in the Senate in March 2022, proposes to require companies to report cyber incidents within 72 hours and ransomware payments within 24 hours to CISA, the Cybersecurity Infrastructure Security Administration.
What You Can Do
Documentation of a company’s cybersecurity tools, remote access points and users and potential threat vectors is crucial to meeting reporting requirements in a timely manner, and they’re a key part of an assessment from GrayMatter.
“If you’re in one of the critical categories — critical manufacturing, critical infrastructure, water power, all those — some level of regulation is either on you or coming your way,” said Scott Christensen, GrayMatter’s Cyber Practice Lead.
GET STARTED
As industrial companies and utilities connect more systems through digital transformation, they introduce new risks to their environments. GrayMatter’s Cyber offering is built around mitigating those risks. Schedule a customized cyber briefing to get started.