By Joe Agee, Area Manager for Automation and Software at Rockwell Automation
Several high-profile cyber attacks in recent years have put a spotlight on growing levels of cybersecurity risk in the automotive sector. The industry needs to quickly increase awareness of the current attack surface, which is often through the installed base of network assets, including machines and devices on plant floors.
The Risks
Successful attacks create not only financial risks in terms of ransomware shutdowns, data loss and expensive recovery processes, but also can create physical safety risks on automotive plant floors, lengthy supply chain disruptions – even litigation.
Fortunately, there are steps every automotive manufacturer can take to close common cybersecurity gaps. And it’s much more cost efficient to strengthen cyber resiliency up front than to allow high priority, curable gaps to remain unresolved.
This article outlines some frequently seen installed base vulnerabilities targeted by today’s threat actors.
OT/ICS Network and Asset Security
Over the last decade, automotive manufacturers opened up communications protocols and enabled plant floor data collection with an IoT ecosystem of sensors and actuators. Data sharing from OT to IT has greatly facilitated plant floor efficiencies and cost reductions through detailed analysis of this data within enterprise systems.
The explosion of data-driven insights from increased connectivity across the OT/IT boundary, however, has increased risk with the rise of sophisticated threat actors. Effective cybersecurity starts with knowing exactly what’s on networks to enable proactive securing of what’s legitimate, while removing and blocking what isn’t.
Without proper security, threat actors can potentially breach the system with the potential of locking up controllers for ransom, controlling the physical actions of machines, altering recipe data, and even creating worker safety hazards.
Automotive manufacturers require a current and up-to-date understanding of all install base assets with visibility to known or unknown vulnerabilities, and a thorough risk assessment methodology within their OT environments to understand and mitigate the security vulnerabilities associated with increased data flow across the OT/IT boundary. This risk assessment can flag poor cyber hygiene practices such as a lack of incident detection capabilities in IDMZ’s, communication protocol risks (e.g. Modbus, PROFINET), or unsecured (or unauthorized) IoT devices.
Poor Patch Management
Weak patch management of the installed base is hugely problematic— 71 percent of automotive companies score poorly on patch management. From industrial plant floor PCs to PLCs, devices running outdated versions of operating systems or software are highly susceptible to cyberattacks. Patches often address critical security vulnerabilities in software, and not applying them on time carries high cybersecurity risk by making it relatively easy for malicious actors to exploit outdated versions with known security flaws.
While poor patch management poses automotive cybersecurity risks, it’s also understandable in the context of production-critical plant floor devices. In the IT world, it’s straightforward to establish a patching routine for servers and workstations that cause minimal business disruption.
On plant floors, patching can lead to downtime on production machines that keep things ticking, and those responsible for OT environments are understandably averse to any downtime. The statistics show that just one minute of halted plant floor production costs can cost automotive manufacturers $22,000. Risk increases when production environments operate with physical servers and have not yet migrated to virtual compute infrastructures with 24/7 monitoring and administration of OT data centers.
Addressing OT patch management calls for a structured strategy with a minimal production disruption footprint. An asset inventory is critical to provide an overview of every plant floor device, the software versions running on them and their unpatched vulnerabilities. An experienced cybersecurity advisor who’s experienced in production operations to avoid common pitfalls and to quickly reach the right balance between effective security and production uptime.
OT Security Knowledge Gaps
OT security knowledge gaps are another source of vulnerabilities – because you can’t protect what you don’t know about.
For example, startups in the electric vehicle space may cover all the bases for IT cybersecurity to an extremely high degree, yet neglect OT vulnerabilities. Viruses, worms, and vulnerabilities at the automation level may propagate through the network and pose threats to physical equipment. The most infamous example is Stuxnet, which targeted PLCs via Windows exploits.
Increasing OT security starts with tested and validated reference architectures such as Converged Plantwide Ethernet (CPwE). CPwE provides a solid foundation for securing automotive plants. Assistance from experts in such architectures can help smartly deploy firewalls and establish industrial IDMZs to bolster plant floor security.
Additionally, adopting cybersecurity solutions aligned with the five pillars of the NIST framework (Identify, Protect, Detect, Respond, Recover) can greatly mature both IT and OT cybersecurity.
Credential Compromise
Despite the complexity of modern cybersecurity solutions and the sophisticated tactics used by malicious actors, many attacks initially exploit shockingly simple vulnerabilities. The most high-profile example recently was the 2021 Colonial Pipeline hack, in which intruders used a password stolen from a previous dark web data leak to access a VPN account and gain network access.
In an automotive installed base context, credential compromises could result in malicious parties accessing plant floor computers and devices with default or weak username-password pairs. Shared passwords and remote access, more common in our Covid-19 era, can introduce compromises where attackers gain control of machines and/or confidential data.
Zero Trust, an approach that hardens cybersecurity by removing excess or assumed trust from prioritized data, assets, application, and services (DAAS), emphasizes strong identity and access controls as a critical protection. Multi-factor authentication, regular password changes, least privileged access and other techniques can be used to grant access to authorized users, for authorized reasons, and at authorized times only.
Joe Agee has over 15 years of experience in the automation industry. In his current role he is responsible for helping Rockwell Automation customers find ways to increase the security posture of their industrial control systems environments through a combination of strategic and tactical approaches.
.
.
Follow Brilliance Security Magazine on Twitter and LinkedIn to ensure you receive alerts for the most up-to-date security and cybersecurity news and information.