CYBERSECURITY FOR OPERATIONAL TECHNOLOGY IN
 THE IRON AND STEEL INDUSTRY

A BRIEF HISTORY OF INDUSTRIAL CYBER ATTACKS 

Cybersecurity attacks on production systems date to at least 1982, when a Trojan virus triggered the Trans- Siberian pipeline explosion. In At the Abyss: An Insider’s History of the Cold War, author Thomas C. Reed writes that the compromised control software made “pumps, turbines and valves” go haywire, resulting in “the most monumental non-nuclear explosion and fire ever seen from space.”*

Fast-forward to 2010, when cybersecurity for operational technology drew public attention with the STUXNET malware attack, which targeted Iranian centrifuges. While the application was much more sophisticated compared to the Trans-Siberian pipeline incident, the result was similar. While updating the control system code, malware manipulated the rotation speed of centrifuges during the refinement of uranium. No one has publicly acknowledged carrying out the attack, but in the 2016 documentary Zero Days, writer/director Alex Gibney†contends it was a joint operation between two nation-states to circumvent the “air gapped” or siloed Iranian ICS network.

Today, ransomware is among the most common types of malware attacks that affect operational technology environments. Ransomware is a cyber attack in which a cybercriminal gains access to an organization’s sensitive files, such as customer data, financial records or intellectual property, and encrypts them so the owner can no longer access them without a decryption key. The cybercriminal offers to provide the key in exchange for a ransom of up to six or seven figures. Paying the ransom is no guarantee that the data will be returned, which has led many professionals to advise against paying. In some cases, not only does the cybercriminal refuse to return the data, they instead release it publicly, damaging an organization’s reputation and pocketing the money.

In May 2020, Australian steel producer BlueScope reported that it was the victim of a cybersecurity attack, possibly ransomware. The company said it had to shift some steel production to “manual operations” as it sought to recover from the disruption to manufacturing and sales operations in Australia.

CYBER RISK AND RESILIENCY DEFINED

To think about how companies in the steel and iron industry should approach cybersecurity risk and build resiliency to protect physical plant systems, it’s helpful to follow a five-point framework developed by the National Institute of Standards & Technology (NIST), which is part of the U.S. Department of Commerce and strives “to promote innovation and industrial competitiveness.”²

CYBER RISK
Cybersecurity risk is any risk of financial loss, disruption or damage to the reputation of an organization from a failure in critical operational systems.

CYBER RESILENCY
Resiliency is an organization’s ability to identify, protect, detect, respond and recover (each detailed in the next section) from process or technology failures and to achieve the goals of minimizing harm, damage to reputation and financial loss.

NATIONAL INSTITUTE OF STANDARDS & TECHNOLOGY FRAMEWORK

NIST defines five functions as the focus of cybersecurity. As maturity develops within an organization, these functions become less reactive and more proactive.

IDENTIFY
Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities. The focus here is to understand your environment at all levels. The tendency is to focus on assets or vulnerabilities, but a more complete picture focuses on both, in addition to communication behaviors. Once you identify assets and version levels, you can measure risk and potential impact on your network. Solutions such as vulnerability assessments, networks mapping and asset discovery are often the focus in this stage.

PROTECT
Develop and implement appropriate safeguards to ensure delivery of critical services. One of the key components to minimizing risk is hardening and protecting critical assets. Often this can involve network segmentation, antivirus or encryption, but it can also include reviewing firewall policy/rules, patch management and microsegmentation.

DETECT
Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. Actively hunting for potential threats and new risks is critical. One advantage operational networks have over their information technology (IT) counterparts is that they are static in nature. This allows us to identify a baseline of good behavior and focus on anomalous or negative behaviors. This often means deploying tools such as network intrusion detection systems (NIDS) and security incident and event management (SIEMS). Correlating events across multiple tool sets is key to success.

RESPOND
Develop and implement an appropriate plan when a cybersecurity incident is detected. The most overlooked factor in cybersecurity is often the response plan. How quickly an organization can respond to an incident is a measure of the organization’s maturity. The key to successful response is training, awareness and a culture developed around cybersecurity readiness.

RECOVER
Develop and implement appropriate activities to maintain plans for resilience and restore capabilities impacted by a cybersecurity incident. Even the most secure organizations can be affected by a cyber incident. Having a detailed recovery plan is critical. Critical infrastructure should have a manual operation plan in place.