HUG: Myth of air gaps

In case anyone was wondering, air gaps don’t exist.

06/29/2012


ISS SourceIn case anyone was wondering, air gaps don’t exist.

They may have at one time, but in today’s modern manufacturing automation environment, they are not viable. An air gap is a physical gap between a network in the enterprise and a control system where digital information cannot cross that line. Yes, vendors and experts talk about air gaps as being a supreme security measure, but if you listened to Eric Byres, chief technology officer and vice president of Tofino Security, during his session entitled “Air Gaps and Unicorns: Do they really Exist?” at Honeywell Users Group (HUG) 2012 in Phoenix, Ariz., a super worm, like Stuxnet, didn’t even care if there was an air gap or not. It had quite a few different attack vectors and it knew how to use them.

“Stuxnet was assuming there was always another pathway in,” Byres said. “Stuxnet played on the human nature of control systems.”

If everyone is fine with the idea an air gap does not really play into the security equation, then the next step is to understand what you really have to protect and then work on a plan that involves solid technology and also fit in the human factor.

“If you want security to work, you have to have it work with the way a human works,” Byres said. “If you design security that runs counter to human nature, then that will be a design flaw.”
Some of the areas Byres said a user should do are:

  • Manage all flows into the industrial control system (ICS)
  • Manage all flows out of the ICS
  • Subdivide the ICS system employing the zones and conduits approach
  • Detect unusual behaviors on the ICS system
  • Don’t focus on protecting your system, focus on knowing your system.

One of the areas Byres talks about frequently is companies should not get caught up in the hype of the latest huge potential attack, but rather understand what you really have to protect.

“Have strategies for looking at all pathways,” he said. “Always protect the crown jewels. Start with what really matters.”

One of the ways to protect those key assets is to understand the system.

“Control systems are usually pretty steady. Knowing that, you can really find out and understand when there is some anomaly on the system. That is something to look at.”

There is no one way to protect systems, instead there is a multitude of options a user must employ to keep the system up and running.

“You have to remember air gaps are a dangerous illusion,” Byres said. “Defense in depth is the only real defense.”



No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
System integration: Best practices and technologies to help; Virtualization virtues; Cyber security advice; Motor system efficiency, savings; Product exclusives; Road to Hannover
Collaborative robotics: How to improve safety, return on investment; Industrial Internet of Things, Industrie 4.0: World views; High-performance HMI, Information Integration: OPC and OMG
9 tips: How to integrate a servo system; Process control mathematical models; Serial network grounding; Engineers' Choice Awards; Learn from cyber security mistakes
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.
PLCs, robots, and the quest for a single controller; how OEE is key to automation solutions.
Learn how Industry 4.0 adds supply chain efficiency, optimizes pricing, improves quality, and more.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Getting to the bottom of subsea repairs: Older pipelines need more attention, and operators need a repair strategy; OTC preview; Offshore production difficult - and crucial
Digital oilfields: Integrated HMI/SCADA systems enable smarter data acquisition; Real-world impact of simulation; Electric actuator technology prospers in production fields
Special report: U.S. natural gas; LNG transport technologies evolve to meet market demand; Understanding new methane regulations; Predictive maintenance for gas pipeline compressors
click me