REACTION Magazine: Maintaining cyber security vigilance during business continuity challenges

Like business and technology leaders worldwide, chemicals Chief Information Security Officers (CISOs) are concerned about keeping their workforce healthy, while at the same time ensuring cyber operations are maintained to protect their information and operational technology (IT and OT). The mantra of “when, not if” attempts will be made to attack systems applies now more than ever.

With COVID-19 leading to disruption throughout the supply chain, many chemical organizations areimplementing a laser focus on cash and working capital and rapidly reviewing their capital spending for the year ahead. Despite the urgent need to maintain security, cyber projects are among those being delayed or cancelled. The operations side of the house is looking to go leaner, with plant turnarounds being reduced or delayed as more social distancing protocols are put in place, resulting in a potential increase in risk to safety and the security of OT landscape.

Finally, older populations are considered to be at a higher risk of complications from the virus. The potential impact of COVID-19 on chemical plant operations is heightened given the average decades-long experience of the plant workforce and the senior engineers with deep business knowledge.

As bad actors seek to take advantage of the situation during this period of reduced operational strength, we anticipate an increasing number of phishing attacks. In fact, the U.S. Federal Bureau of Investigation is warning of an increase in cyber attacks related to COVID-19, including fake CDC and phishing emails,¹ and cyber experts in the UK noted that online attacks are increasing and evolving.² Indeed, cyber adversaries are already taking advantage of the situation, and phishing emails related to COVID-19 are surging along with their malware payloads.³ Typically, the attack vector is through corporate IT, then down into the industrial zone once the bad actor has identified the account of an employee involved in both IT and OT.

Meanwhile, plant systems—including distributed control systems (DCS), supervisory control and data acquisition systems (SCADA) and programmable logic controllers (PLC)—rely on their proprietary vendors to provide support, traditionally on site or from suppliers’ offices. Now stay-at-home orders and social distancing measures are forcing supplier personnel to work remotely, adding even more “hops.” This has impacted a range of activities, from normal maintenance to dedicated projects and, importantly, system security and patching.

Every organization is at a different level in its maturity, operational response capabilities and functional security organization. That said, most organizations have invoked their business continuity plans (BCPs) given COVID-19 travel and social distancing restrictions, and they are operating on a skeleton crew in the office. This works for most “corporate” employees who can function remotely with a laptop and VPN access.

However, the risk is potentially increasing at the plant operations level as staffing levels are reduced and remote working is ramped up, pressuring the IT and OT teams that manage those operations. And as mentioned, critical service partners such as DCS, SCADA and PLC providers now also need to operate remotely. Where supply chain contracts already allowed remote access for these outside companies, access is now likely to be even more remote through the vendors’ VPN networks—one further step removed. Security infrastructure at suppliers will also be under additional load as remote workers won’t have traditional access to IT security tools and resources in the offices, elevating the risk of compromise.

In order to accommodate the need for remote work, chemicals organizations are having to increase remote infrastructure usage. However, that means more “holes” in the firewalls in both corporate and OT systems that require monitoring by the cyber security team, and an increased risk that malware, if successfully deployed in an environment, could impact safety, production and operational integrity. Unfortunately, the economic realities of COVID-19 will no doubt continue to have effects on the operational delivery of cyber, as traditional security projects become subject to harsh budgetary reviews.

Meanwhile, from a health and safety perspective, plant operations will look to limit the exposure of workers, including by organizing shifts to keep the same, smaller teams of engineers together to limit widespread COVID-19 exposure, equally where possible they will leverage multiple control rooms (including the training rooms) to reduce exposure and load in the nerve center of plant operations. However, this presents a potential headache should the virus impact one of the teams. Should the virus continue to spread among the workforce, current BCP operations will need to be further adjusted, though in the short term this shift-matching process should provide tactical relief. However, economic pressures (both supply and demand) will necessitate a rethink of operations in the medium term, along with increased pressure for plant turnarounds and maintenance windows (which traditionally have up to three times more staff on the floor) that allow for security patching as well.

Given concerns around the more at-risk older employee demographic, some organizations are kicking off accelerated, extensive documentation of plant operations and critical knowledge from engineers and other key employees. The documentation effort is often in conjunction with a review of the operational safety processes, which focuses on capturing the alarm management logic for plant operations and the need for alarms to be in place.

• In the short term, consider the need to continue operating with reduced staffing under the BCP longer than anticipated. However, now also is the time to start updating the BCP in light of potential longer-term disruptions, and stress test the BCP for scenarios where multiple disruptions occur at the same time.
• Accelerate any planned security reviews, including a review of remote access arrangements and procedures for the OT organizations (looking for security quick wins for those who have remote access into the plant environment from the outside) and look at any OT hardening that can be done tactically.
• Consider whether security operations are robust and able to handle both the IT and OT layers, and where possible, increase the capability of the organization to “look for bad” on the networks.
• Review the OT risks around delayed patch deployments and the potential vulnerabilities those delays will cause, ensuring that you have compensating controls in place (e.g. ensuring the Safety Instrumented System (SIS) is still islanded from the rest of the network).
• Plan and conduct remote penetration testing activities to check and secure facilities, especially plant-side VPNs. (The concerns are now that this will need on-going change and expansion, without resources to manage, police changes and continually monitor).
• Operational efficiency reviews: Conduct BCP/Disaster Recovery reviews with a focus on critical documentation to put “knowledge in heads” on paper and a look at a potential streamlining of plant procedures.
• Assess ways to help shore up defenses with quick wins, such as BCP or ops documentation reviews, process reviews, and toolsets risk remediation. Ensure best practice sharing across the organization and look to provide appropriate resources to help address the increasing confluence of risk.

By keeping these consideration in mind, along with ensuring regular cyber-readiness reviews, chemical organizations can help keep plants safe and secure while likely developing a number of new, effective ways of working that can be used again in the future.

The KPMG Global Energy Institute (GEI) is a worldwide knowledge-sharing form on current and emerging industry issues. Launched in 2007, the GEI interacts with over 30,000 members through multiple media channels, including audio and video webcasts, publications and white papers, podcasts, events, and quarterly newsletters. Subscribe today to begin receiving valuable insights covering critical business topics and industry issues by visiting Global Energy Institute.