Launched: Tool to Increase Cyber Resilience in OT Environments
A Public-Private Partnership between the Ministry of Economic Affairs and Climate Policy (EZK), Digital Trust Center (DTC), Deloitte, VNG-IBD, Novel-T, NCSC, Siemens, ASML, Accenture and the Cybersecurity Alliance, which represents interests in the field of cyber security in operational technology (OT), introduces the Security Check Process Automation. This is an interactive self-scan that has been developed to provide Dutch organisations with ICS-SCADA systems with tools to make these systems more resilient. The group has presented the tool to Hester Somsen, Deputy National Coordinator for Security and Counterterrorism, and to Jos de Groot, Director of the Digital Economy at the Ministry of Economic Affairs and Climate Policy.
Resilience of industrial control systems
The Security Check Proces Automation launches a week after the publication of the annual Cybersecurity Assessment Netherlands (CSBN) report, which again focuses on the vulnerability of the Dutch digital infrastructures. The check offers organisations a practical tool to fulfil the CSBN's call to increase cyber resilience and is the result of a unique partnership. This ICS partnership was born out of the ICS Security working group within the Cybersecurity Alliance in late 2019 and was formed to help organisations (small, large, critical and non-critical, private and public) selflessly raise awareness and provide them with concrete, applicable solutions to improve the cyber resilience of their industrial control systems.
The DTC, which supports entrepreneurs in the Netherlands in the field of digital security on behalf of the Ministry of Economic Affairs and Climate Policy, facilitates the Security Check Process Automation via its website.
DTC Relationship Manager Jacco van der Kolk: "I am particularly pleased to be able to offer a practical self-scan to organisations that use ICS or OT devices. There is great diversity in security maturity within the ICS domain. There are organisations that are very mature, but there are also organisations that need to significantly increase the digital resilience of their ICS landscape, but unfortunately lack the knowledge to do so. I hope that with this tool we can provide help to all of them.
The business operations of most organisations today are heavily dependent on automation and control systems, and organisations are often not aware. With the current trend of digitalisation, this is increasing even further. Unfortunately, this also increases the chance of a cyber incident. The Security Check Process Automation allows organisations to quickly identify potential risks and the protective measures they can take against them. The security check, which can also be used without technical or IT knowledge, offers organisations a practical tool to increase their cyber resilience.
Strategic, tactical and operational level
The cyber resilience of OT environments is very specific because industrial process automation within organisations is often a separate digital environment and the security of the control systems (ICS) requires a different approach than IT environments. As a result, the potential risks are underestimated and there is still insufficient ICS security awareness. In order to take the right digital resilience measures, extra attention is required, at strategic as well as tactical and operational levels. The Security Check Process Automation contributes to gaining this insight. The check highlights subjects such as access control, incident response and modification control and includes existing frameworks, guidelines and frameworks of standards (proven methodologies and instruments) as part of the route an organisation can take.
The risk bar
How many and which measures an organisation needs to take depends on the consequences of a cyber incident on its own industrial processes. If the consequences are serious in financial terms, if there is a threat to health, or if serious environmental damage may occur, then the protective measures required are more numerous. The check therefore starts by identifying a framework of standards; how high should an organisation's risk bar be? The tool then provides insight into whether the most important measures are being taken to protect the ICS environment against cyber incidents. The outcome of the Security Check Process Automation is a checklist of measures that match the organisation's security level.
In September, the ICS alliance will present the first findings on the use of the tool during the annual cybersecurity conference ONE in The Hague.
Read the official press release (in Dutch) here.