Attack detection

For cyber-secure operation, all OT/IT connections should take place via defined and documented processes (above). Each connection process also includes an initial data traffic analysis to determine the typical data patterns of the communication dialogues and to optimize the firewall rules if necessary (bottom). The resulting data is also suitable for detecting attacks.

© SSV

A solid and comprehensive knowledge base about the details of possible attacks, which can be used effectively in practice to prevent successful attacks, is still a major challenge due to its complexity. The German Federal Office for Information Security therefore recommends that all organizations that can be assigned to the critical infrastructure use the MITRE ATT&CK-ICS matrix in the document Orientation guide for the use of attack detection systems (BSI-OZA). In this case, "ATT&CK" stands for "Adversarial Tactics, Techniques and Common Knowledge" (see web tip). It contains a linked matrix overview of TTPs - techniques, tactics and procedures - with twelve columns, each of which represents a specific tactic. Specific sub-techniques with individual alphanumeric identifiers are then assigned to each of the attacker's sub-targets. For example, if you click on "Module Firmware" (ID = T0839) in the "Persistence" column, a comprehensive explanation of how an attacker could permanently anchor a malicious firmware in the ICS attack target appears. If you want to or have to deal more intensively with attack detection in your own OT, it is helpful to take a closer look at the MITRE ATT&CK-ICS matrix. Organizations that fall under the new version of the IT Security Act "IT-SiG 2.0" have been practically legally obliged to do so since 1 May of this year.

Relatively independent of possible attack details, a clean OT/IT network separation (see the connection process in the image) within the organization-wide network infrastructure provides an effective control point for communication data-based OT cyber attack detection. As a result of the initial data traffic analysis, there is also a transparency-creating (log) data model with sample data for normal OT/IT communication. Furthermore, it can be assumed that the configuration of the connection process firewall prevents all unnecessary network traffic. In other words, practically everything that is not necessary for the dialogs between OT and IT applications. In this respect, the next step would be to select the technical options for attack detection and integrate them into your own connection process. The most important building blocks to choose from would be

Anomaly detection: this involves monitoring all data traffic at the OT/IT connection point - preferably in real time - using a suitable machine learning algorithm to identify and report patterns that deviate from normal OT/IT communication based on the communication data. The data structures and results of the data traffic analysis can be used for the required ML configuration and training phase.

IDS or IPS: An intrusion detection system (IDS) is a software function that scans the data traffic of a communication connection for known attack patterns in order to report suspicious activities. The traffic data can be compared with the fingerprints of known attacks in real time or with a time delay by evaluating log files. If a defensive measure is automatically initiated when an attack is detected - for example, blocking a port in a firewall - this is referred to as an intrusion prevention system (IPS).

The author: Klaus-Dieter Walter is a member of the management board at SSV Software Systems.

© SSV

SIEM system: A SIEM system (Security Information and Event Management) is usually a centralized, organization-wide security solution in which as much correlating sensor data as possible from different measuring points is combined to form an overall picture or context and meaningful alarm messages are generated. They signal potential security threats and help to identify and rectify vulnerabilities in good time.

SOC : 24/7 round-the-clock monitoring 365 days a year by a team of IT experts as a central security instance is generally referred to as a Security Operation Center (SOC). The depth of tasks depends on the respective organization and the individual objectives. In addition to monitoring and defending against IT security incidents, the SOC's tasks often also include prevention and compliance management measures.