DERUUA

Industrial IT/OT Security

Security of industrial information technology (IT) and operational technology (OT): Industrial Control System (ICS) and Supervisory Control And Data Acquisition (SCADA)

We provide Industrial IT/OT Security audit, implementation, and training services together with our partners AT Engineering (ATE). This is a team of software, electrical and industrial process engineers who specialize in the field of industrial automation. The experience in industrial automation and software of ATE's staff begins in 1995, and they have completed more than 120 projects. Since 2005, they have completed more than 80 projects with an average capacity of 500 man-hours each.

Our international certifications in industrial IT/OT security are ISA CFS and CRS. Our international certifications in general information security are ISC2 CISSP and SSCP, ISACA CISA, Offensive Security OSCP, EC-Council CEH, ISO 27001 Audit/Implementation, and others.

Learn more about the industrial problems we solve, the business value of our services, the methods and tools we use, our service options and deliverables.

Industrial IT Security pictures  

Problems of Industrial IT/OT Systems

Here are some examples of technical security vulnerabilities, organizational weaknesses and security threats of industrial IT / OT, which we have discovered in the decades of our experience:

  • Maintenance personnel or subcontractors can have excessive access to the SCADA computers or PLC.
  • Industrial Ethernet networks can have unauthorized connections (temporary, debug, etc.) to other enterprise or office networks.
  • WiFi/GPRS/3G modems or routers can have unauthorized connection to the industrial switches.
  • Electricians or mechanics, who have physical access to the industrial computers but lack proper authorization, can copy or modify the industrial software.
  • An unauthorized person can access the network and copy or change the PLC program via Profibus, Modbus, CAN, Profinet and other buses, which are normally used for remote IO and slave devices but can also be used for PLC programming.
  • Industry 4.0 / Industrial Internet of Things (IIoT) methods require Internet connection, which dramatically increases the security risks.
  • Entropy-related threats and vulnerabilities: source code and documentation can be lost over the years, improperly managed changes can be introduced resulting in conflicts of versions, etc.
  • The migration of PLC to the PC-based automation (SoftPLC, etc.) increases security risks. Common vulnerabilities of operating systems will apply in addition to controller-specific vulnerabilities.
  • Accidents and sabotage at an industrial enterprise can lead to serious destruction, environmental damage, damage to the reputation, litigation and fines, injuries and even death.
  • Relying only on network segmentation and ignoring other security measures (such as access control on all levels, configuration management, security event monitoring, update of software and operating systems, antiviruses, firewalls, user security rules, password policies, etc.) results in an accumulation of security problems over time.
 

Business Value of Industrial Security Services


  1. Common IT security benefits: protection of reputation, confidential information and copyrights, ensuring business continuity, etc.
  2. Safety, including safety during warfare and terrorist attacks
  3. Preventing penalties
  4. Facilitating Industry 4.0 upgrade is a competitive advantage for our customers

Feel free to click the button below to get a consultation on Industrial IT security services.




 

Methods and Tools

To show the level of our competence and skill, the methods and tools that we use in everyday work are listed below.

For audits, consultations and implementations in industrial IT/OT security, we use the following standards, frameworks, and methodologies:

  • ISO/IEC 27001, VDA ISA, ENX TISAX®
  • ISA99, ISA/IEC 62443
  • North American Electric Reliability Corporation (NERC) Reliability and Security Guidelines
  • NIST SP 800-82 Guide to Industrial Control Systems (ICS) Security, NIST Framework for Improving Critical Infrastructure Cybersecurity
  • DHS guidelines for critical infrastructure protection and the Critical Infrastructure Protection framework

In the field of assessment and implementation of OT security, we work at the level of specific vendors. For example, we work with Siemens PLCs using Step7 and TIA Portal, with Schneider Electric equipment using Concept, UnityPro, and SoMachine, with Mitsubishi using GX Works, with Omron using CXOne, with Carel using 1tool and with Wago using CoDeSys.

In urgent cases, when it comes to preventing great material damage from a security incident, we can reverse engineer not only industrial software code but also proprietary industrial protocols.

We assess the security of SCADA computers and switches using common automatic and semi-automatic tools (vulnerability databases and scanners, exploits, IDS, IPS, EDR, SIEM, SOAR, etc.) with specific configurations, and we also do a manual analysis of SCADA scripts and other source code in white box mode.

 
Industrial IT/OT Security Service Options
  1. Security audit and assessment of industrial IT/OT infrastructure >>
    can help identify all problems mentioned above, and other security threats and vulnerabilities. We also assess physical security: doors, locks, windows, access control, video surveillance, anti-intrusion systems, etc. Logical and physical security recommendations are included in every security assessment report.
  2. Security audit and assessment of SCADA systems >>
    SCADA software has specific vulnerabilities. Access levels and user administration can often be improved for these systems. Custom programming adds specific vulnerabilities that cannot be detected by common vulnerability scanners, but can be found manually.
  3. Security implementation and hardening of industrial IT/OT systems >>
    The recommendations of the security assessments, reviews and audits are implemented within separate projects. We perform seamless refactoring of systems. We design and implement physical and logical security controls into the production environment.
  4. Disaster recovery and Business Continuity Management at industrial enterprises >>
    Simple continuity measures are taken to prevent disruptions during the hardening or other changes. We employ various quality assurance methods: simulations, staging environment testing, unit testing, software and hardware backups, etc. For continuous-cycle enterprises and other critical processes, we develop, test and implement comprehensive continuity programs. The deliverables include risk assessment reports, business impact analysis reports, realistic plans, mitigation and recovery strategies, policies, improved communications and readiness of personnel to disasters and emergencies.
  5. Personnel education at industrial enterprises >>
    is crucial for the security of any enterprise. Industrial enterprises are peculiar in that they involve different security levels, standards and procedures of different vendors and contractors. We develop and implement various personnel awareness and behavior management measures, to ensure that different security cultures are harmonized, and both internal and external personnel have the same understanding of the security requirements and expectations. The measures include, but are not limited to: training, workshops, quizzes, intranet resources, video fragments, posters, etc.
Deliverables of Industrial Security Services
  • Reports on performed security assessments, reviews and audits are compiled.
  • Risks are assessed and Annual Loss Expectancy values are calculated.
  • Risk treatment plans are developed
  • Refactored documentation, hardware, and software
  • Logical and physical security measures are implemented
  • Customer’s personnel instructed, trained and tested
  • Policies and procedures are developed and unified
  • Proper industrial information security is implemented, risks and losses are reduced to acceptable levels

We are passionate about what we do because we believe that we make this world safer and give people reassurance and confidence.




Who we are, what we do and what we offer.

About penetration tests.


Our certificates:

(ISC)2
CISSP
Offensive Security
OSCP
ISACA
CISA
CISM
Microsoft
PECB
LPTP
Qualys
PECB
LPTP
BSI