This month marks the primary anniversary of the Colonial Pipeline shutdown — a vastly impactful ransomware assault towards important US infrastructure that has had important diplomatic and legislative penalties. Among the many quite a few speaking factors the assault raised was the difficulty of IT/OT convergence.
The assault, orchestrated by ransomware group DarkSide, focused the pipeline’s IT billing methods moderately than its operation know-how (OT), however Colonial was nonetheless pressured to close down bodily operations for a number of days. Regardless of its oil-pumping methods retaining performance, Colonial believed the chance of constant operations with an IT compromise was too nice. This was largely because of the proximity of its IT and OT methods: Had the attackers moved laterally to the corporate’s operational networks, they might have imposed an extended and extra expensive shutdown, doubtlessly tampering with security mechanisms and damaging gear — even endangering the pipeline’s staff.
The chance of IT assaults spilling over into OT has grown because the organizations working these methods look to realize an edge over their rivals. IT/OT convergence makes industrial management methods (ICS) cheaper, simpler to handle, and extra quickly out there to totally different directors. On the similar time, because the Colonial Pipeline occasion confirmed us, it presents new dangers and avenues for cyber disruption.
That is partly as a result of most OT safety instruments at the moment take a look at industrial methods in isolation — as a disconnected silo, separate to the remainder of the enterprise. The identical is true of community safety, electronic mail methods, and the cloud. And when many of those instruments had been being developed, there was nothing unsuitable with this method. However as these digital environments converge, counting on disjointed level options to cease cyberattacks is not efficient, particularly as a result of a single assault can now goal and traverse a number of fields of operation.
By unifying their safety stack, defenders can use IT/OT convergence to their benefit and switch vulnerability into power.
This requires a transfer away from instruments educated on historic assaults and towards self-learning know-how that may study its digital environment from scratch, with none prior assumptions. By understanding the distinctive conduct of each IT and OT system — irrespective of how bespoke or advanced the know-how — this method allows the detection of novel threats. By definition, a cyberattack causes a machine or person account to behave in a means it usually doesn’t, and these deviations may be picked up, irrespective of the place they seem.
How Ransomware Teams Exploit IT/OT Convergence
The chance of connecting cloud platforms to ICS was demonstrated in an assault towards a European OT R&D funding agency final 12 months.
Two of the agency’s Industrial Web of Issues (IIoT) units, which ran Home windows OS and made common connections to an industrial cloud platform, had been compromised after they used the server message block (SMB) protocol to hook up with an contaminated area controller and browse a malicious executable file. Safety groups are sometimes stymied by IIoT units, which may lack CPUs, conventional working methods, or adequate disk area for placing safety measures in place.
A malicious payload lay dormant for nearly a month throughout the two IIoT units, one among which was a human-machine interface (HMI) and the opposite an ICS historian. Darktrace’s investigation confirmed that, whereas community segregation was adequate to cease the assault’s command-and-control (C2) communications on the HMI system, connections from the ICS historian reached round 40 distinctive exterior endpoints.
Each units then wrote suspicious shell scripts to community servers and, lastly, used SMB to encrypt information saved in community shares. A ransomware notice was written by the ICS to focused units, and the assault was full. This sort of assault life cycle, which demonstrates the constraints of community segregation and air-gapping, has been the premise for widespread issues round IT/OT convergence.
No signatures or menace intelligence had been related to this assault, and so it flew beneath the radar of the corporate’s conventional safety instruments. Solely by self-learning know-how from Darktrace was the safety crew capable of achieve full visibility into the assault.
Using the Altering Tides
Reference architectures that depend on air-gapping ICS from IT are more and more incompatible with the technological developments many organizations are making with a purpose to stay aggressive. If attackers not view IT and OT as distinct, partitioned areas, neither ought to safety groups.
It’s potential for companies to soundly embrace interconnectivity, with all of its benefits, by adopting safety that learns the enterprise from the bottom as much as tackle refined threats throughout each their IT and OT environments.
Unified safety efforts mirror the fact of converging methods and make sure that no gaps are left for attackers to use. When the whole digital setting may be considered by a single pane of glass and no single, exploitable system is left with out safety, organizations will be capable of interconnect methods with out taking up undue threat.
