Lack of visibility in ICS systems
One of the main problems in an industrial network is a lack of network visibility. In other words, very often the devices connected to it are not known. If you ask a maintenance technician who is responsible for a plant whether they know about all the devices (PCs, PLCs, routers, cameras, webcams, etc.) connected to the network, the answer will probably be no.
Which devices are connected
The devices that make up an ICS network can be many, and they differ in type and function:
- PLCs, RTUs, etc.
- SCADA servers
- Cameras
- IP phones
- SIS systems
- PCs
- IoT systems
- Routers (xDSL, 4G, etc.)
- Firewalls
- Switches
- Data acquisition and statistics devices
Many of these devices interact frequently with one another, while others are self-contained but sit on the same network.
Why it is hard to know how many devices there are and which ones
An industrial plant is typically a harsh environment. In some cases the spaces are cramped; in others they are enormous and spread over areas that are hard to monitor.
Keeping track of all the installed devices is difficult because:
- Several suppliers install devices on the network
- Needs change over time and the number of devices grows
- Installers often do not provide documentation or a list of the equipment
- Some installers/suppliers take the liberty of adding devices without telling anyone
What are the risks of a lack of visibility?
The risks associated with poor network visibility are potentially very serious: not knowing what types of device are on the network could expose systems to security weaknesses.
Imagine, for example, a supplier/installer configuring a 4G router on the network to reach their own cloud service in order to manage a sensor or piece of equipment. This kind of action would be a “bypass” of all the plant’s security policies.
In other cases there may be devices with serious vulnerabilities, with a high risk of exposing the entire network to security problems. A Raspberry Pi installed and forgotten on the NASA network was recently discovered; it was compromised and important information about the Mars project was stolen.
How to solve the visibility problem
To keep the state of the network under control at all times, there are specific products able to maintain an accurate inventory and topology of the entire network.
Thanks to these tools it is always possible to know how many devices, and of what type, are on the network, and to find the associated vulnerabilities.
Conclusions
Knowing which devices are connected to the plant network is a fundamental step in maintaining the security of the entire process chain.
