Full Report
In this webinar we connect first principles to modern practice: Biba, SEC-OT, CIE mitigations, UK NCSC connectivity guidance and modern "islanding" requirements all lead to OT designs whose security materially exceeds that of conventional IT networks. The post How Should OT Security Be Stronger Than IT? appeared first on Waterfall Security Solutions.
Analysis Summary
# Best Practices: Engineering-Grade OT Security (Beyond IT Standards)
## Overview
These practices address the fundamental gap between IT security (which prioritizes data confidentiality) and OT security (which must prioritize physical safety and continuous operation). The goal is to move away from "IT-like" reactive measures (patching/encryption) toward "Engineering-Grade" defenses that prevent physical consequences through architectural deterministic controls.
## Key Recommendations
### Immediate Actions
1. **Inventory "Worst Credible Consequences":** Identify the specific physical failures (explosions, spills, outages) that cyber-attacks could trigger. OT security must be scaled to these consequences, not just to the value of the data.
2. **Map All External Connectivity:** Identify every point where the OT network touches the IT network or the Internet. This includes "hidden" connections like vendor remote access or maintenance laptops.
3. **Implement Data Diodes/Unidirectional Gateways:** For critical segments, replace software-based firewalls with hardware-enforced unidirectional gateways to ensure information flows out (to IT) without allowing threats to flow in.
### Short-term Improvements (1-3 months)
1. **Apply Biba Integrity Model Principles:** Move toward a "No Read Up, No Write Down" data integrity posture. Ensure that high-integrity control systems cannot be influenced by lower-integrity systems (like IT or the public internet).
2. **Establish "Islanding" Capabilities:** Develop and test the ability to physically disconnect OT networks from IT networks during an active compromise without losing local operational control.
3. **Harden SEC-OT (Security for OT) Protocols:** Prioritize protocol-specific filtering over generic packet inspection to ensure only legitimate industrial commands can reach controllers.
### Long-term Strategy (3+ months)
1. **Adopt Cyber-Informed Engineering (CIE):** Integrate cybersecurity into the physical design of the plant. Use non-computable controls (e.g., physical pressure relief valves vs. software sensors) to mitigate cyber-risk.
2. **Transition to Deterministic Architectures:** Move away from "Zero Trust" (which relies on continuous authentication/software) to architectures where the physical hardware makes attack propagation mathematically impossible.
3. **Alignment with UK NCSC Guidance:** Restructure network tiers to ensure that even if a corporate network is completely compromised by ransomware, the industrial process remains unaffected.
## Implementation Guidance
### For Small Organizations
- **Focus on Isolation:** Use physical air-gaps or simple unidirectional hardware where possible to minimize the need for complex, resource-heavy patching cycles.
- **Manual Overrides:** Ensure critical processes can be operated manually if the control network is compromised.
### For Medium Organizations
- **Visibility without Vulnerability:** Use unidirectional gateways to mirror OT data to a "DMZ" where IT-based monitoring tools can analyze it without ever touching the production environment.
- **Simplified Patching:** Instead of patching every PLC, focus on hardening the perimeter and preventing the arrival of the exploit.
### For Large Enterprises
- **Standardize on CIE:** Mandate that all new capital projects undergo Cyber-Informed Engineering reviews during the design phase.
- **Global SOC Integration:** Use one-way data flows to feed OT telemetry into a central Global Security Operations Center (GSOC) without creating back-door entries into the plants.
## Configuration Examples
*While specific code is not provided in the webinar overview, the technical strategy centers on:*
- **Unidirectional Gateway Configuration:** Configure the "Transmit" host on the OT side to replicate historian databases to the "Receive" host on the IT side. No physical return path exists for packets, preventing TCP-based handshakes from the internet into OT.
## Compliance Alignment
- **UK NCSC:** Connectivity Guidance for Industrial Control Systems.
- **CISA/CIE:** Cyber-Informed Engineering Framework.
- **IEC 62443:** Particularly the requirements for Zones and Conduits (3-3 and 4-2).
- **NIST SP 800-82:** Guide to Industrial Control Systems (ICS) Security.
## Common Pitfalls to Avoid
- **The "IT Copy-Paste" Error:** Assuming that what works for an office (antivirus, frequent patching, encryption) is sufficient for a power plant.
- **Over-Reliance on Software Firewalls:** Firewalls have millions of lines of code and are subject to vulnerabilities; they are "probabilistic," not "deterministic."
- **Neglecting the "Biba" Principle:** Allowing IT-based systems (low integrity) to send commands or updates to OT systems (high integrity) without physical mediation.
## Resources
- **Waterfall Security Solutions:** [hxxps://waterfall-security[.]com/ot-insights-center/]
- **UK NCSC Connectivity Guidance:** [Search for NCSC OT Guidance]
- **CIE Framework (Idaho National Laboratory):** [hxxps://inl[.]gov/cyber-informed-engineering/]
- **Biba Integrity Model Documentation:** [Standard Information Security Literature]