building cybersecurity into dp systems - dynamic positioningbuilding cybersecurity into dp systems...
TRANSCRIPT
![Page 1: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/1.jpg)
DYNAMIC POSITIONING CONFERENCE October 11-12, 2016
CYBERSECURITY
Building Cybersecurity into DP Systems
Siv Hilde Houmb Secure-NOK
![Page 2: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/2.jpg)
www.securenok.com
Building Cybersecurity into DP Systems
MTS DP Conference 2016 By: Siv Hilde Houmb
![Page 3: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/3.jpg)
Source: https://ics-cert.us-cert.gov/sites/default/files/Monitors/ICS-CERT Monitor_Nov-Dec2015_S508C.pdf
Cyber attacks - U.S.
![Page 4: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/4.jpg)
Cyber attacks - Global
![Page 5: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/5.jpg)
What Do We Know?• Increasing number of cyber attacks• Cyber attacks are becoming more sophisticated (APT)
• The attackers are more organized:- Well funded- Highly skilled- Aggressive
![Page 6: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/6.jpg)
Advanced Persistent Threat• Advanced – high level of coordinated human
involvement to monitor and control the attack• Persistent – priority to gain (several) foothold(s),
remain «invisible» to the target for as long as possible with priority to complete a mission (low and slow) and get back out UNDETECTED
• Targeted – has a specific target in mind
![Page 7: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/7.jpg)
![Page 8: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/8.jpg)
STUXNET – Targeted Cyber Sabotage
• Designed to sabotage the Natanz nuclear facility• Destroyed 1000 centrifuges• Continues to affect the Natanz plant• Undetected for more than 3 years• Attacked more than 20 control systems• An APT attack design to be destructive and targeted
![Page 9: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/9.jpg)
Cyber Attacks:Information Technology vs Operational Technology
Cyber attacks in IT
• Information Systems• Corporate networks• Consumers• Homes• ...
Cyber attacks in OT
• SCADA Systems• PLCs• ...
![Page 10: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/10.jpg)
• Anti-virus software?
• Firewalls?
• Whitelisting?
• Hardening?
• Access control?
• Network monitoring?
• Encryption?
Can´t We Just Adopt Solutions from IT Systems?
![Page 11: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/11.jpg)
IT System Security Model
IT security focus (CIA)• Confidentiality• Integrity• Availability
IT security safeguards• Firewalls• Access control• Malware protection• Antivirus solutions• Patch management• Network monitoring
![Page 12: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/12.jpg)
Traditional OT System Security Model
OT security focus (AIC)• Availability/Criticality• Integrity• Confidentiality
OT security safeguards• Air-gapped/Island network
![Page 13: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/13.jpg)
• Defence-in-depth strategy tailored for OT systems
• Built on NIST Cybersecurity Framework (CSF)
- Identify
- Protect
- Detect
- Respond
- Recover
Strategy for Protecting OT Systems (1)
Process People
Technology
![Page 14: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/14.jpg)
![Page 15: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/15.jpg)
NIST CSF group security safeguards into following categories:
• Technical safeguards
- Physical and logical segregation
- Authentication and access control
- Perimeter defence
- Network monitoring
- End-point protection
Strategy for Protecting OT Systems (2)
![Page 16: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/16.jpg)
• Non-technical safeguards
- Security policies and procedures
- Incident response plans and procedures
- Security awareness training
Strategy for Protecting OT Systems (3)
![Page 17: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/17.jpg)
Defense-in-Depth Strategy for OT Systems
![Page 18: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/18.jpg)
Credit: 401kcalculator.org
![Page 19: Building Cybersecurity into DP Systems - Dynamic PositioningBuilding Cybersecurity into DP Systems Siv Hilde Houmb Secure-NOK. Building Cybersecurity into DP Systems MTS DP Conference](https://reader034.vdocument.in/reader034/viewer/2022042308/5ed46bf8638f1c7113662a81/html5/thumbnails/19.jpg)
www.securenok.com
Thank you for your AttentionQuestions?