Know All Communications Paths to Your Assets
Securing all external and internal network access points is one of the most important things you can do to increase the cybersecurity of your system. Take an inventory of communications paths and the access points they require—and then disable all unused communications ports. USB ports should also be considered, as they may be potential vulnerability points for viruses and malware propagated via thumb drives.Having an alternate communications path for key system assets will minimize the impact of denial-of-service attacks. Security alarms should be sent through a second path as well.Network access points include the following:
- SCADA
- Energy management system (EMS)
- Engineering access
- Maintenance
- Telephone lines
- Wireless
- Internet
- Network interconnections
Use Encryption and Authentication Tools
All communications access points should be secured with user access controls and authentication procedures. In addition, all communications entering or exiting the electronic security perimeter (ESP) should be encrypted to prevent man-in-the-middle attacks.SEL layered cybersecurity products provide encryption, password management, secure access control, and device management for OT networks.
Practice a “Need-to-Know” Policy
Keep your designs safe, and limit access to system details to those who have a need to know in order to do their jobs. Be especially careful to protect the following:
- Computers
- Passwords
- Software
- Instruction manuals
- Encryption equipment and keys
- Onsite inspection of control system communications and security hardware/software.
- Evaluation of electronic and physical perimeters.
- Assessment and documentation of open ports and/or services.
- Onsite interviews of operations personnel regarding security procedures.
Practice Security in Depth
A strong and effective security solution should have multiple layers of defense. Defense in depth should include:
- Layering security for cyber assets.
- Applying deny-by-default and whitelisting policies.
- Encrypting all data leaving the ESP and data being transported across public or untrusted networks.
- Implementing physical security.
- Logging and monitoring all physical and cyber activity.
- Baselining, monitoring, and logging all firmware updates and settings changes.
- Training personnel on security best practices.
- Creating a security-aware culture.
- Physical security and cybersecurity
- User accounts
- Proxy services
- Access controls
- Logging
- Firewall rules
- VPNs
- Network security
Develop an Incident Response Plan
Your organization should have a clear, concise plan that details how your company will respond to a cyber incident. Having a cybersecurity incident response plan in place before the emergency occurs will help you mitigate potential damage and recover more quickly. SEL helps companies build incident response plans that include the following recovery services:
- Development of an incident response playbook
- Restoration of system images
- Virus response and onsite support
- Investigation of unusual behavior in your substation or industrial control system
- Update and patch management maintenance services
- Document recovery
Use and Manage Strong Passwords
Implement these best practices to ensure that passwords protect access to devices and systems:
- Do not use default passwords.
- Change passwords periodically.
- Change passwords when people leave.
- Use different passwords in different regions.
- Control passwords.