Chapter 2 – The OT Air Gap Dissolved: A Playbook

This hierarchical structure was established in the 1990s. It doesn’t reflect the challenges of the Industry 4.0 era.

Increased Use of Demilitarized Zones (DMZs)

With the advance of technology, organizations are increasingly breaking the silos between OT and IT  to achieve efficiencies in costs and processes. For this reason, administrators are using firewalls to mediate communication in demilitarized zones (DMZs) between levels 3 and 4.

A reference in cybersecurity, the SANS Institute still sees value in the Purdue classification as a conceptual framework that set the foundation for ICS security. For example, the National Institute of Standards and Technology’s Guide to Industrial Control Systems (NIST 800-82) recommends separating ICS from the corporate network and deploying a DMZ to prevent traffic between the two layers.

According to a survey by the SANS Institute, 49% of the respondents in the ICS/OT industries reported using a DMZ between IT and OT networks. In addition, 42% of the respondents said that their control systems had direct connectivity to the internet. In 2019, the response rate was 12%. The SANS Institute’s report notes that this increase might be attributed to a series of factors, from higher adoption of cloud-based technologies to a better understanding of connectivity pathways.

Don’t Let Lower Perceived Risks of Air-Gapped Networks Deceive You

Air-gapped networks give a false notion of high security. At Armis, we often hear from new clients that there’s nothing to worry about because their OT is air-gapped. However, when deploying our agentless device security platform, we quickly find vulnerabilities in their air-gapped networks.

A common point of exposure is the engineering workstations, which typically run Windows or Linux. Thanks to our platform, an organization has recently discovered that one of its engineers was using an “air-gapped” workstation to access social media sites. What seems as trivial as checking Facebook in your spare time at work can expose a critical environment to a series of security risks, while also showing how easily air gaps can be breached.

Manufacturers often focus on their device security but do not consider the interconnected implications of employees bringing their devices to work. Once we discovered that an employee of one of our clients took a smart exercise bike to the office. The bike was transmitting large amounts of traffic from what was supposed to be a controlled environment.

A Roadmap to Comprehensive ICS Security

Air gaps as a stand-alone security measure are not sufficient to protect organizations from threats that are growing in sophistication. The increased attack surface in this Industry 4.0 era makes security even more challenging. Here are few steps that security leaders should consider:

1. Raise Employee Awareness

Organizations might think that their ICS networks are 100% air-gapped, but they are not. Misconfigured firewalls and user violations all increase the risk of exposure.  In fact, many attacks leverage employees’ lack of awareness or compliance with proper security procedures.

Humans might be victims of phishing attacks or create security breaches by connecting peripherals (for example, unauthorized flash drives) to air-gapped computers. That’s why it becomes crucial to better train employees with access to air-gapped systems.

2. Invest in Agentless and Passive Monitoring Solutions

Traditional IT solutions rely on agents or active scanning. They don’t work for protecting industrial environments because:

• Most OT and IoT devices cannot accommodate agents.
• Network scans can disrupt or crash OT devices, leading to downtime and jeopardizing employee safety.

ICS and manufacturing environments need an agentless solution like Armis, which works with all devices, managed and unmanaged, IT or OT/ICS. Our platform provides visibility to devices from all levels of the Purdue architecture and monitors the communication between them in real-time.

3. Understand the Importance of Asset Management

Organizations need holistic device visibility into their OT and IT networks. The idea is that you can’t secure what you don’t know exists. When deployed, the Armis platform discovers all assets in your environment and performs a risk assessment to identify any vulnerability and threat.

This information is crucial to developing a plan to mitigate exposure. Book a risk assessment to see what the Armis Agentless Device Security Platform can find in your ICS environment.

4. Embrace the Zero Trust Framework

Armis also helps organizations to implement the Zero Trust principles in their ICS environments. Initially coined by Forrester, the Zero Trust model has been key to increased ICS cybersecurity. This framework ensures that all devices and users are continuously verified to maintain their network’s access.

Read all of the IT OT Convergence Playbook Chapters:

1. Chapter 1 – IT/OT Convergence: Industry 4.0 Security Challenges
2. Chapter 2 – Is Perdue Model Obsolete? Air Gap Dissolved 👈 you are here
3. Chapter 3 – The Urge for Infrastructure Protection 👉 read next chapter
4. Chapter 4 – Monitoring and Protecting Industrial Environments
5. Chapter 5 – Network Visibility: Discover All Assets
6. Chapter 6 – Operational Downtime and Passive Monitoring
7. Chapter 7 – How to Secure Industrial Assets
8. Chapter 8 – Security Risk Assessment for ICS environments
9. Chapter 9 – Best Security Frameworks to Protect OT networks
10. Chapter 10 – ICS Zero Trust Security Framework
11. Chapter 11 – Armis Approach to CIS controls
12. Chapter 12 – ICS and Mitre Att&ck
13. Chapter 13 – 2021 Ransomware Attacks
14. Chapter 14 – Best Practices for IT/OT Convergence