ICS Security: Using PAM for Industrial Control Systems Security

Industrial control systems (ICS) are critical to numerous industry operations and have become high-profile targets for cybercriminals who may infiltrate ICS to cause damage to the systems themselves or use the systems to gain access to other parts of a corporate IT infrastructure.

Industrial control systems (ICS) are critical to numerous industry operations. They are utilized in industrial enterprises like electricity, water, oil, gas, and data, but are also used in other verticals like financial services and retail. These central systems have become high-profile targets for cybercriminals who may infiltrate ICS to cause damage to the systems themselves or use the systems to gain access to other parts of a corporate IT infrastructure.

Cybercriminals directly infiltrate ICS to cause damage or use them as Trojan horses to gain access to other systems and data within the corporate infrastructure.

Improving identity and access control to your organization’s most important systems and data using a privileged access management (PAM) solution is key to improving ICS security and preventing breaches.

The Evolution of ICS

ICS has developed separately from traditional corporate IT infrastructure and operating technology (OT). When ICS was originally developed, they were designed to operate in a similar manner to other mechanical systems:

• Easy to use, configure, and manage
• Last 10-15 years without any major modifications
• Isolated from other corporate infrastructure

Since original ICS were created as isolated systems, security was often an afterthought. Even as these systems have become more interconnected with OT, this low-security philosophy is still in place. In fact, there have been cases where an organization knew there was malware on a system, but just left it if it didn’t impact day-to-day operations and if they didn’t think there was a chance the malicious software could spread.

Since ICS were originally designed as isolated systems, ensuring security has become an afterthought.

ICS Integration

With the evolution of technology, more and more organizations are looking to connect their ICS to their main IT architecture in hopes to:

• Maximize efficiency
• Reduce waste
• Analyze data flows
• Understand operations
• Increase productivity

Unfortunately, many organizations are connecting these systems to their IT mainframes, without considering the vulnerabilities that these systems create. In some cases, security teams may not even understand the additional security these newer technologies require. Many organizations quickly begin utilizing various tools to simplify operations without thinking about the potential consequences:

• Connected applications are easy to hack and infiltrate, giving cybercriminals a window into the rest of the organization’s systems.
• Organizations often use default IP addresses and factory-set passwords to reduce operating costs, decrease downtime, and avoid calls to support, but failing to change these settings makes it even easier for cybercriminals to attack.
• Remote logins simplify maintenance and operations, but without identity and access management, these credentials can be used maliciously.
• The decreasing costs of sensors that allow machines and systems to be connected to the Internet of Things (IoT) make it easy for organizations to create interconnections between systems, but each sensor adds additional risk.

The integration of ICS into corporate IT infrastructure creates additional vulnerabilities that organizations must make an effort to secure.

ICS Security Challenges

ICS security is challenging as there are so many vulnerabilities to consider and the implementation of a new solution can be complicated. Since ICS are huge and intricate systems, organizations are reluctant to halt operations to install the security solutions they desperately need. Organizations must find a way to implement security solutions without significantly impacting or halting operations.

ICS Security and PAM

In the case of ICS, access and identity management are the heart of security.

In the most successful ICS attacks, cybercriminals gained access to systems through stolen or hacked privileged accounts. Since privileged accounts have permission to do almost anything within a system, once infiltrated the hacker can move throughout the entire infrastructure unnoticed. Therefore, in order to prevent breaches, organizations must heighten security measures related to access and identity management using a privileged access management (PAM) solution.

The most successful ICS attacks utilize privileged accounts to infiltrate the systems and wreak havoc undetected.

Privileged Access Management (PAM)

Privileged access management (PAM) is the process of controlling and monitoring all privileged access to a system through a centralized platform. Having a PAM solution in place, organizations gain a comprehensive understanding of who is accessing what within their systems and what activities are being completed. PAM solutions typically consist of three main components:

• Access Manager: The Access Manager monitors and handles all access for privileged accounts. Privileged users can request access to various systems through the access manager, which knows which systems each user is allowed to access and with what level of privilege. This ensures that only privileged users can access critical systems and data, and in the case of compromised credentials can help limit hacker access. Super admins can add, modify, or delete privileged user accounts from a centralized system, significantly improving efficiency and compliance.
• Session Manager: The Session Manager tracks all actions that were taken during a privileged session in a secure log, which can be used for future review and auditing. It also provides real-time monitoring and allows super administrators to immediately terminate sessions if they detect any suspicious activity.
• Password Vault/Manager: The Password Manager prevents users from knowing the actual root passwords of any critical systems and helps enforce password best practices. The passwords themselves are stored in an encrypted vault to help reduce risk exposure.

PAM provides organizations with complete control and visibility over which users have access to systems and the types of actions they can take.

PAM can help secure all of the vulnerabilities that interconnected ICS create. It controls and limits the access of critical systems to only the users who need them. The WALLIX Bastion PAM solution provides organizations with the advanced tools they need to ensure complete ICS security. It includes searchable audit logs and enables the discovery of user accounts, which helps organizations explore the depths of their infrastructure to uncover vulnerabilities they might not even be aware of. Plus, its scalable, agentless architecture makes it easy to install without causing any significant operational downtime.

By maintaining control and visibility over ICS and an entire corporate infrastructure using the WALLIX Bastion, organizations can ensure that they are meeting compliance regulations and protecting themselves from attacks.

Interested in learning more about how you can improve ICS security? Click below or contact us for more information.