What Are OT Cyber Security Countermeasures?
The risk assessment output will highlight any gaps between the existing or designed security posture and an organisation’s tolerable risk. Countermeasures should be defined and implemented to reduce the risk of compromise by external attack or internal malicious or inadvertent maloperation of IACSIndustrial Automation and Control Systems assets.
The Countermeasures should be appropriate to foreseeable threats and proportionate to the zone’s criticality or consequence of any compromise, i.e. critical zones will require more stringent security countermeasures than supporting or non-critical zones.
Countermeasures should follow the Protect – Detect – Respond concept to:
- Minimise the chance of initial intrusion,
- Detect indicators of compromise,
- Minimise the impact of compromise by responding to an attack in an appropriate and timely manner.
Countermeasures should be implemented to provide defence in depth whereby the potential impact of diverse and constantly evolving cyber security threats can be mitigated by deploying multiple layers of organisational and technical countermeasures to remove any single point of failure:
Organisational Countermeasures
Policies and procedures for:
- Governance
- Risk Management
- Asset Management
- Supply Chain Management
Protective Countermeasures
Policies and processes and/or technical controls for:
- Service Protection
- Identity and Access Control
- Data Security
- System Security
- Resilient Networks and Systems
- Staff Awareness and Training
Detect and Respond Countermeasures
Policies and processes and/or technical controls for:
- Security Monitoring
- Response and Recovery Planning
These countermeasures form part of the NCSC CAF principles for assessing compliance with the UK Network & Information Systems (NIS) Regulations.
Where countermeasures cannot be implemented for identified security gaps, e.g. due to incompatibility with older IACS assets or proprietary firmware, alternative countermeasures should be investigated or the security gap agreed by management and tracked for action at a future systems upgrade or replacement under obsolescence management.
HSE OG86, Appendix 5 outlines the basic technical countermeasures expected to mitigate against an unskilled attack i.e. the minimum level of cyber hygiene an IACS operator is expected implement.
As the cyber security threat landscape is constantly changing and additional countermeasures are developed against newly discovered vulnerabilities the IACS risk assessment, including countermeasures, requires to be reviewed periodically (no more than yearly) or when new threat intelligence relevant to your organisation’s IACS is published.
Technical author
Steve Essery
Technical Director at Method Cyber Security & Group Quality Assurance Manager at Method Safety and Security
Since 2019, Steve has worked as a contract Functional Safety Professional and Cyber Security Specialist, and as a Regulatory Compliance Consultant and Equipment & Control Systems Validation Specialist within the pharmaceutical industry, before becoming a Technical Director at =Method.
