As industrial cybersecurity matures, more and more governance programs are being built around control networks. That includes not only personnel dedicated to managing risk around industrial control systems (ICS) and processes, but also introducing the need for security assessments and penetration testing to ICS.
In this episode of Nexus, Justin Searle, a two-decade veteran of the industry, shares his experiences pen-testing control networks, focusing on the distinct challenges surrounding this practice, which is markedly different from security assessments conducted against IT networks.
"We're starting to see more companies consider at least some lightweight, safe penetration testing," said Searle. "I think the really hardcore penetration testing really is being driven more by vendors who are testing their individual products in labs before and after they go to market, as well as owner/operators who are doing testing before they do the implementation."
Missing from that scenario, of course, are pen tests against production environments. Much like the challenges around vulnerability management and patching production equipment, there is little tolerance for downtime in the ICS domain. Operators are also hesitant to allow third-parties, for example, to test the resilience of a production environment for fear of affecting processes, especially in critical infrastructure markets.
"It's not a rarity; it is actually occurring to some degree," Searle said. "I think what's being done often makes me more nervous than it does make me feel better. I'm a proponent of actually doing more penetration testing in our production networks. However, we need to do that in a very safe manner."
Searle—who is the director of ICS security at consultancy InGuardians and a senior SANS Institute instructor—covers a number of other areas of pen-testing during this extensive conversation, including:
What organizations can do to prepare for a security assessment—including architecture reviews, asset inventories, and establishing an understanding of communication protocols before allowing network captures
What ICS penetration tests look like
Organizations' readiness to act on the final assessments they are handed
The effects of digital transformation and IT/OT convergence on threats to ICS and operational technology (OT) networks
What actual threats to ICS and OT networks look like today
Michael Mimoso is Director of Influencer Marketing at Claroty and Editorial Director of Nexus.
