Key Controls in Securing Cyber-Physical Systems (CPS) 

As operational technology (OT) environments evolve, their networks of connected devices are no longer limited to isolated industrial equipment. Today’s OT systems include many things. They range from traditional programmable logic controllers (PLCs) and human-machine interfaces (HMIs) to IoT devices. They also include engineering workstations and IT assets that connect to business networks. 

Connected sensors, smart devices, and automation systems have become more commonplace in industrial environments. Combining IT systems and IoT devices with OT has simplified data sharing as well as remote control of devices. While this can help improve efficiency and modernization efforts, new devices and new communication paths introduce new risks into operations environments. 

This interconnection has given rise to what many are calling cyber-physical systems, where digital technologies directly affect physical operations. Gartner defines cyber-physical systems as “engineered systems that orchestrate sensing, computation, control, networking, and analytics to interact with the physical world (including humans)… When secure, they enable safe, real-time, reliable, resilient and adaptable performance.” 

What Are Cyber-Physical Systems (CPS)? 

The term cyber-physical systems is often used as an umbrella term to cover devices that include OT, IoT (Internet of Things), IIoT (Industrial IoT), the Internet of Medical Things (IoMT), smart building solutions, robotics, and autonomous systems. It can serve as an overarching framework that encompasses all these technologies. 

Dragos is focused on securing cyber-physical systems for industrial operations, including OT, IT, IoT, and IIoT devices found in electric, oil & gas, manufacturing, water, transportation, and other industrial environments. While industry solutions exist to secure networks against cyber attacks targeting medical devices or IoT devices in IT environments, our focus remains on preventing attacks on critical infrastructure that can jeopardize national security and cripple entire communities. The dangers became evident in incidents like the Stuxnet worm, the 2015 Ukraine power grid attack, and the Colonial Pipeline ransomware event. 

The concept of cyber-physical systems may be useful in helping CISOs and IT security professionals understand that cybersecurity is no longer limited to data breaches or theft. Today, cyber attacks pose real threats to the physical world—disrupting power grids, shutting down pipelines, and even causing harm or loss of life. 

Security Challenges in Cyber-Physical Systems 

IT and IoT devices are often directly connected to OT systems to enable data sharing, remote monitoring, and real-time analytics. The expanded attack surface of cyber-physical systems has not gone unnoticed by adversaries. Adversaries, like state-sponsored groups and ransomware gangs, are targeting IT more often. They know that a single breach can disrupt critical infrastructure. 

A vulnerable IT system can be a launchpad for lateral movement and pivoting to reach sensitive OT assets and potentially disrupt operations. IoT devices like sensors and cameras are increasingly integrated into OT environments for real-time data and process optimization. However, these devices are often insecure by design, lacking basic security features, such as strong authentication or encryption. They are frequently exposed to the internet. 

A risk-based approach to vulnerability management for OT ensures industrial organizations prioritize vulnerabilities in cyber-physical systems based on their potential to disrupt critical business operations and affect safety. 

Best Practices for Operational Technology (OT) Security 

Addressing these risks requires a comprehensive approach that considers the entire attack surface. The SANS Institute offers guidance on key controls that help to secure cyber-physical systems in OT environments. The following is a summary of what you need to consider to ensure resilient, secure industrial operations. 

Segmentation and Access Controls 

OT security strategies often start with hardening the environment – removing extraneous OT network access points, maintaining strong policy control at IT/OT interface points, and mitigating high risk vulnerabilities. This approach reduces lateral movement within the network, confining potential intrusions. 

Secure access is essential and requires you to implement a robust, controlled solution that effectively manages and monitors access to ICS environments. This solution should incorporate multi-factor authentication, encrypted communications, and strict access controls to ensure access is both secure and compliant with organizational policies.  

Enhanced Visibility and Network Monitoring 

In cybersecurity, the principle is clear: you can’t protect what you can’t see. Asset visibility is fundamental for securing these systems. This requires real-time insight into all assets, their communication patterns, automatic identification of vulnerabilities linked to specific assets, and prioritization based on their criticality and function. Leveraging OT-specific threat intelligence further enhances identification, enabling faster detection and response. 

Achieving complete visibility across the cyber-physical attack surface is essential. Use asset inventory and network mapping tools to identify all connected devices, including legacy OT systems and IoT devices, and understand their communication patterns. 

Risk-Based Vulnerability Management 

Not all vulnerabilities pose the same level of risk to OT systems. By focusing on vulnerabilities with the most significant operational impact, organizations can prioritize their resources to mitigate the threats that matter most. 

An effective vulnerability management solution should equip you with the insights necessary to address the most critical vulnerabilities in your OT environment. The solution must include a comprehensive and precise OT vulnerability knowledgebase, accompanied by clear prioritization guidance. This enables security teams to focus on the most pressing issues first. Identifying top-priority vulnerabilities helps reduce risk, minimize downtime, and direct cybersecurity resources to where they are most needed. 

Proactive Threat Detection and Monitoring 

Continuous monitoring of OT networks can help detect signs of ransomware or malware before they escalate. Using OT-specific threat intelligence to understand threat groups’ tactics, techniques, and procedures (TTPs) can support proactive defenses. 

Effective threat detection should offer detailed insights into adversary TTPs, enabling organizations to quickly identify malicious activities and receive context-rich alerts and notifications. Ideally, threat detection integrates with investigation playbooks, empowering analysts to respond to threats with greater efficiency. Unlike anomaly-based detection methods, threat behavior analytics minimize the volume of alerts, reduce false positives, and deliver comprehensive context about threats, facilitating faster and more informed responses. 

OT-Specific Incident Response Planning 

OT incident response plans differ significantly from IT’s due to unique devices, communication protocols, and specialized TTPs used by industrial threat groups. Effective OT response requires tailored tools, skilled personnel, and location-specific strategies, as impacts vary across pipelines, grids, and plants. Develop a plan identifying key contacts, employee roles, and clear steps for various scenarios. Regular tabletop exercises can test and refine the plan for real-world readiness. 

Building Your OT Security Roadmap 

Building OT cybersecurity resilience is a gradual process, often complicated by uncertainty around next steps, ownership, and resources for addressing ICS-specific risks. Industrial environments face operational, environmental, and safety threats amid modernization, regulation, and evolving threats. Establishing adaptable ICS security controls is crucial for achieving long-term resilience. 

Download our guide to the SANS ICS 5 Critical Controls for further guidance on getting started on your OT cybersecurity journey.