DERUUA

Industrial IT/OT Security

Security of industrial information technology (IT) and operational technology (OT): Industrial Control System (ICS) and Supervisory Control And Data Acquisition (SCADA)

We provide Industrial IT/OT Security audit, implementation and training services together with our partners AT Engineering (ATE). This is a team of software, electrical and industrial process engineers who specialize in the field of industrial automation. The experience in industrial automation and software of ATE's staff begins in 1995, and they have completed more than 120 projects. Since 2005, they have completed more than 80 projects with an average capacity of 500 man-hours each.

Our international certifications in industrial IT/OT security are ISA CFS and CRS. Our international certifications in general information security are ISC2 CISSP and SSCP, ISACA CISA, Offensive Security OSCP, EC-Council CEH, ISO 27001 Audit/Implementation and others.

Learn more about the industrial problems that we solve, the business values of our services, the methods and tools we use, our service options and deliverables.

Industrial IT Security pictures  

Problems of Industrial IT/OT Systems

Examples of technical security vulnerabilities, organizational weaknesses and security threats of industrial IT / OT. We have discovered these problems over the decades of our experience:

  • Maintenance personnel or subcontractors can have excessive access to the SCADA computers or PLC.
  • Industrial Ethernet networks can have unauthorized connections (temporary, debug, etc.) to other enterprise or office networks.
  • WiFi/GPRS/3G modems or routers can have unauthorized connection to the industrial switches.
  • Unauthorized copying or modification of the industrial software by the electricians or mechanics, who have physical access to the industrial computers.
  • Profibus, Modbus, CAN, Profinet and other buses are normally used for remote IO and slave devices, but can also be used for PLC programming, therefore enabling an unauthorized person to access the network and copy or change the PLC program.
  • Industry 4.0 approaches require Internet connection, which dramatically increases the security risks.
  • Entropy threats and vulnerabilities. Losing source codes and documentation over the years, improperly managed changes, etc.
  • Migration to the PC-based automation of PLC increases security risks. The vulnerabilities are both controller-specific (SoftPLC, etc.) and common vulnerabilities of operating systems.
  • Accidents and sabotage at an industrial enterprise can lead to serious destruction, environmental damage, damage to the reputation, litigation and fines, injuries and even death of people.
  • Reliance only on network segmentation, and ignoring other security measures: access control on all levels, configuration management, security event monitoring, update of software and operating systems, antiviruses, firewalls, user security rules, password policies, etc. result in accumulation of security problems over the time.
 

Business Values of Industrial Security Services


  1. Common IT security benefits: protection of reputation, confidential information and copyrights, ensuring of business continuity, etc.
  2. Safety, including safety during warfare and terrorist attacks
  3. Prevented penalties
  4. Facilitated Industrie 4.0 upgrade is a competition advantage of our customers

Feel free to click the button below to get consultation on Industrial IT security services.




 

Methods and Tools

To show the level of our competence and erudition, the methods and tools that we use in everyday work are listed below.

For audits, consultations and implementations in the field of security of technological processes, operations, equipment and software of industrial IT/OT, we use the following standards, frameworks and methodologies:

  • ISO/IEC 27001, VDA/TISAX
  • ISA99, ISA/IEC 62443
  • North American Electric Reliability Corporation (NERC) Reliability and Security Guidelines
  • NIST SP 800-82 Guide to Industrial Control Systems (ICS) Security, NIST Framework for Improving Critical Infrastructure Cybersecurity
  • DHS guidelines for critical infrastructure protection and the Critical Infrastructure Protection framework

In the field of assessment and implementation of OT security, we work at the level of specific vendors. For example, we work with Siemens PLCs using Step7 and TIA Portal, with Schneider Electric equipment using Concept, UnityPro and SoMachine, with Mitsubishi using GX Works, with Omron using CXOne, with Carel using 1tool and with Wago using CoDeSys.

In urgent cases, when it comes to preventing great material damage from a security incident, we are able to reverse engineer not only industrial software code, but also proprietary industrial protocols.

We assess the security of SCADA computers and switches using common automatic and semi-automatic tools (vulnerability databases and scanners, exploits, IDS, IPS, EDR, SIEM, SOAR, etc.) with special configurations, and we also do manual analysis of SCADA scripts and other source code in white box mode.

 
Industrial IT/OT Security Service Options
  1. Security audit and assessment of industrial IT/OT infrastructure >>
    can help identify all problems mentioned above, and other security threats and vulnerabilities. We also assess physical security: doors, locks, windows, access control, video surveillance, anti-intrusion systems, etc. Logical and physical security recommendations are included in every security assessment report.
  2. Security audit and assessment of SCADA systems >>
    SCADA software has its specific vulnerabilities. Access control levels and user administration can often be improved for these systems. Custom program code adds specific vulnerabilities that cannot be detected by common vulnerability scanners, but can be found manually.
  3. Security implementation and hardening of industrial IT/OT systems >>
    The recommendations of the security assessments, reviews and audits are implemented within separate projects. We perform seamless refactoring of systems. We design and implement physical and logical security controls into production environment.
  4. Disaster recovery and Business Continuity Management at industrial enterprises >>
    Simple continuity measures are taken to prevent disruptions during the hardening or other changes. We employ various quality assurance methods: simulations, staging environment testing, unit testing, software and hardware backups, etc. For continuous-cycle enterprises and other critical processes, we develop, test and implement comprehensive continuity programs. The deliverables include risk assessment reports, business impact analysis reports, realistic plans, mitigation and recovery strategies, policies, improved communications and readiness of personnel to disasters and emergencies.
  5. Personnel education at industrial enterprises >>
    is crucial for the security of any enterprise. Industrial enterprises are peculiar in that they involve different security levels, standards and procedures of different vendors and contractors. We develop and implement various personnel awareness and behavior management measures, to ensure that different security cultures are harmonized, and both internal and external personnel has the same understanding of the security requirements and expectations. The measures include, but are not limited to, training, workshops, quizzes, intranet resources, video fragments, posters, etc.
Deliverables of Industrial Security Services
  • Reports on performed security assessments, reviews and audits.
  • Risks are assessed and Annual Loss Expectancy values are calculated.
  • Risk treatment plans are developed
  • Refactored documentation, hardware and software
  • Logical and physical security measures are implemented
  • Customer’s personnel instructed, trained and tested
  • Policies and procedures are developed and unified
  • Proper industrial information security is implemented, risks and losses are reduced to acceptable levels

We are passionate about what we do because we believe that we make this world safer and give people reassurance and confidence.




Who we are, what we do and what we offer.

About penetration tests.


Our certificates:

(ISC)2
CISSP
ISACA
CISA
CISM
Offensive Security
OSCP
PECB
LPTP
Microsoft
Qualys
BSI