Detecting Cybersecurity Threats in Operational Technology and Industrial Control Systems
One of the most crucial safeguards for operational technology (OT) is the ability to detect cyber threats within OT networks and industrial control systems (ICS) in real time. Given the importance of availability and uptime, the ability to quickly detect potential threats and respond with appropriate measures is highly stressed. Detection and prevention strategies must be carefully crafted for OT networks to avoid excessive false positives and potentially unnecessary disruptions. Let’s look at the key characteristics of a threat detection program: Common Attack Vectors in OT and ICS Operational technology and industrial control systems face unique threats compared to typical IT networks. Understanding how attacks infiltrate these environments is critical to defending against them. Common attack vectors include: Signs Your OT System May Be Compromised Early detection of cybersecurity issues in OT environments is vital. Some common indicators of a compromised system include: Use Your Asset Inventory to Scope Your Detection System Organizations need to first determine what their critical assets are and then prioritize resources accordingly, such as log retention, and frequency of log reviews making informed decisions about which log data should be forwarded to their centralized logging solution. What Logs Should Be Monitored? Not all unusual events point to malicious activity or demand further investigation. Here are some examples of events that should be monitored on a regular basis, according to the NIST 800-82r3 Publication: Information Events Operational Events Networking Events Centralize and Analyze Your Logs Once you’ve determined your key assets and the logs to collect, the next step is to send and collect those logs in a centralized log system or a SIEM (Security Information and Event Management). Logs can then be correlated across different systems. These solutions can also provide additional information to help parse and reduce noise on logs with tactics such as threat intel, … Continued
