Industrial Cybersecurity

The risk landscape

In industrial control systems the stakes are higher than in traditional IT: risks involve operational safety, the physical security of goods and people, environmental impact, and the availability and integrity of production tools. OT systems were designed for operational safety and continuity — not to fight malicious activity — so most have limited cybersecurity functions.

Specific threat vectors

Unlike consumer networks where the main risk comes from the internet, in an ICS the main concerns are harmful programs introduced through USB keys or lateral movement of malware, and remote access for diagnostics and maintenance, which interconnects networks of different criticalities and may involve third parties. Proprietary protocols and operational events that are neither inherently malicious nor legitimate make detection especially challenging.

Monitoring and anomaly detection

To monitor extended industrial networks without costly infrastructure, the detection system uses sensors close to the process to extract communication data, and a central server to gather, store and analyse it. Sensors are placed at key interconnection points — from the IT/OT boundary to process networks, remote maintenance links and the open field network.

FusionView, powered by Cisco Cyber Vision, gives industrial organisations full visibility into their networks so they can ensure process integrity, build secure infrastructures, drive regulatory compliance and enforce security policies across the operational technology domain.