I live and breathe cybersecurity.

I’ve been at Siemens for six years, initially working as a Field Application Consultant, and now as a cybersecurity subject matter expert. I review areas of design and networking, mostly within oil, gas and transportation in the Malaysian market. I’ll answer questions like ‘is this design workable?’ or ‘is this designed to cybersecurity standards?’

I’m lucky that I’ve found real passion in my work. I’m super interested in cybersecurity outside of work hours – I keep myself up to date on the latest by reading a lot of articles, watching a lot of YouTube tutorials, and engaging myself in more formal courses to gain professional qualifications.

Over the last six years I’ve learned a lot about cybersecurity, both in technical terms, and in how others perceive it. Today I’d like to share a little of what I’ve discovered over that time, and the potential consequences for those in the industrial sphere.

Cybersecurity: perception vs reality

In my experience, people don’t care about cybersecurity until it’s too late. The overarching attitude is ‘it won’t happen to me’… until it does.

My aim is to generate awareness about the threats that we all face and the practices that can keep us safe. We want to close the gaps that a threat can get through, to use the latest updates and technologies to protect against cyber attacks, because in the real world there’s no such thing as 100 percent safety. Malware is a lot like COVID, there are always new and more dangerous variants to watch out for, so you can’t stop the fight.

In some ways the cybersecurity industry should thank hackers – they show us vulnerabilities and loopholes, helping to make our systems better. Hackers come in many forms: some attack for fun, others are driven by incentives. Recently a gas line in the US was hacked and held for ransom, and an entire state ran out of gas in the process. When the ransom was eventually paid, the hackers returned some of it and apologized for the trouble they’d caused. It goes to show that many hackers are real people, not heartless robots.

At the same time, the best hacker is no hacker at all.

The 5 common myths/challenges around cybersecurity

In the industrial control system world that I operate in, there are five cybersecurity myths that continue to exist. By believing in these myths, companies are seriously compromising their cybersecurity. As such, it’s worth taking a look at the realities of each.

Myth 1: We can’t get hacked because we don’t connect to the internet

The truth: malware can come in from any number of sources, as seen in a recent case from our global partner Fortinet: an operator was charging his phone with a USB connected to his computer, which passed ransomware onto an internal system that wasn’t connected to the internet. The hackers demanded Bitcoin from the company if they wanted to get their data back.

Myth 2: I’m safe because I have a firewall installed

Often firewalls represent a box to be ticked, rather than a security measure to be taken seriously. As such they can be badly configured, granting access for all manner of programs, making it relatively easy for threats to pass through.

Myth 3: Hackers don’t understand industrial control systems

This statement might be true, but the implication is not. Hackers don’t need to understand industrial control systems, they just need to do some network jamming to halt the system. They’re not trying to operate the system, they’re usually trying to shut it down or steal some of its data, which is far easier.

Myth 4: We are not an appealing target

Hackers usually aim for two types of targets: high value or easy kill. If your attitude is ‘we’re not an appealing target’, you’ll place yourself firmly in the ‘easy kill’ group. The truth is that you might actually be in the ‘high value’ group too – a wastewater facility might not seem like a high-value target because it doesn’t generate a huge profit… but it is critical infrastructure that has the potential to affect the lives of a lot of people. High value means different things to different people. In short, you may not have been targeted yet, but with hacking becoming increasingly autonomous, your time will likely come.

Myth 5: Our safety systems protect us

The industries I work with, like oil and gas, have Safety Integrity Level (SIL) systems. A lot of people in these industries falsely believe that this system offers cybersecurity, but it does not. The aim of the SIL is to ensure there are no casualties in an emergency situation. It doesn’t act on the cause of the emergency, but rather the effects.

Balancing security with availability

Most people don’t mind waiting a few seconds for a YouTube clip to load. The same can’t be said of an oil company, as every single second generates profits. I was once told by Infineon, a semiconductor manufacturer, that an hour of downtime sees them losing multiple millions of dollars. I was shocked.

This situation means that industrial companies can sometimes prioritize system availability over system security. If a security update results in an hour or two of downtime, it will effectively cost millions to implement when lost productivity is taken into account. ‘Is it really worth it?’ a company might ask.

The answer is almost always ‘yes’. Short-term profit is great, but if it results in long-term vulnerability, it could end up costing a company far more than a few millions.

How Siemens helps solve these challenges

At Siemens we take what we call a Defense in Depth approach to industrial cybersecurity. Instead of one ‘Great Wall’ to keep the invaders out, Defense in Depth uses three:

Plant security: The ‘perimeter’ of your defenses, this is formed of the fences and security guards that ensure your plant can’t be accessed by unauthorized individuals.
Network security: The second layer of defenses is digital, and includes IP layers, firewalls, anti-virus protection and the use of virtual private networks (VPNs).
System integrity: The third layer includes the logins, 2FA and authorized devices that form a solid defense against unauthorized system access.

If you’re intrigued by Siemens’ Defense in Depth approach you can learn more here. At its core it is built on the concepts discussed above: the knowledge that no organization is truly safe in terms of cybersecurity, and the fight against threats is unlikely to ever end. But if you commit to investing in security, you’ll at the very least ensure that you don’t suffer the fate of the lame deer in the herd.