In today’s industrial organization, Operational Technology (OT) and Industrial Control System (ICS) are increasingly being integrated with cloud technologies and the internet for faster communication and remote control. The interconnectedness and data helps the industrial organizations achieve performance and efficiency. In the due process, these systems are exposed to cybersecurity threats and risks. It is the responsibility of each industrial organization to enforce security controls and follow standards to prevent unforeseen cybersecurity incidents. While standards are comprehensive, best practices in cybersecurity may be followed as a first step to protect every industrial organization from cybersecurity threats and events.

Security hardening is one of the basic cybersecurity best practices to ensure OT and ICS security.  Each ICS security hardening should include the following, but is limited to the below steps:

• Establish Physical security: To ensure physical safety, the entire infrastructure and systems must be provided with essential physical security measures that do not allow unauthorized physical access to assets of the organization.

• Enable Applications whitelisting: Employees and administrators must be authorized to use software applications approved within the organization, and only those applications must be whitelisted. Users must be provided with guidelines to follow, for using the approved applications, to reduce human errors and related cyber threats. 

• Address operating system vulnerabilities: Security patches must be installed to protect operating systems from vulnerabilities to reduce the attack surface. Where patch management is not practical, compensating security controls must be enabled.

• Secure Networks and services: Network and corresponding services must be allowed for access to authorized assets only. Being the heart of connected systems, networks, and its corresponding services must be monitored for anomalous activities. Secure communication channels must be established for transmission of critical data within and outside the network.

• Enforce Strict Access control: Access to assets must be limited to assets and personnel who are authorized to access them. Access control shall include establishing roles for personnel, such as Admin and non-admin. Each asset or user must be assigned to a role based on the level of access permitted. 

• Practice password hygiene: Use complex passwords and promote password change every 90 days, for all systems and applications within the infrastructure. Replace default usernames and passwords for all assets. 

• Install anti-malware solutions: Most cyberattacks in the past few years involved a malware or ransomware. Install an effective and up to date anti-malware solution capable of protecting against malware, ransomware, virus, worms etc.

• Enable continuous monitoring: Continuous monitoring must be enabled to detect anomalous activities within the infrastructure. All cyberattacks involve stages such as privilege escalation, lateral movement and other indicators collectively known as indicators of compromise. The monitoring system shall be capable of identifying such indicators of compromise or any unexpected/unauthorized activities.  

• Enable Data encryption: To minimize man-in-the-middle attack and to maintain data integrity, data encryption must be enabled for both data-at-rest and data-in-motion, where necessary. 

• Secure System backup: There is no guarantee to avoid a cyber attack, even when all the above-mentioned steps are taken. In the event of a cybersecurity incident, the system must be capable of quick recovery. Enabling secure system backups is critical to quick recovery and it is a crucial step in a business continuity plan. 

Security hardening ensures consistent safety and security configuration to all systems. When any new system is brought online and is not security-hardened, it increases the likelihood of breaches. Attackers constantly look for ways and opportunities they can take advantage of, and security hardening is a basic step to protect an organization’s network. 

If your organization has not implemented security hardening measures as part of the existing cybersecurity program, 3WaySecure Consulting is happy to provide consulting and advisory services to help with security hardening. 

At 3WaySecure Consulting, we offer holistic, pragmatic, and sustainable cybersecurity services to protect industrial organizations from evolving cyber threats. We offer services in the areas of risk management, cybersecurity compliance, security testing, and cybersecurity consulting that are tailored to your specific infrastructure and business needs. If you need help regarding the cybersecurity challenges your business faces or advice on ICS/OT security, please don’t hesitate to contact us for more information or to get non-binding advice from our experts. 3WaySecure Consulting will be an essential partner to guide you along the journey of OT cybersecurity.