Protect Your Operations with Proactive Threat Hunting

December 12, 2018

By: Pascal Ackerman, Rockwell Automation

You have a strong industrial security program in place. You’ve cleaned up with good cyber hygiene and have implemented intrusion detection systems to avoid future incidents. But in the complex world of cybersecurity, you can’t stop there.

Despite all your efforts, latent advanced persistent threats (APTs) are still a concern. They are slowly at work trying to find chinks in your armor and exfiltrate data, bogging down your operations. And intrusion detection isn’t going to catch this activity.

You’re Ready for Threat Hunting

Threat hunting is one of the next logical steps in your cybersecurity program. In its simplest form, you are searching the network for external threats or intrusions that went undetected by automated security systems. It is a very scalable exercise and can be done with varying degrees of automation, including none at all.

It can not only further protect your proprietary recipes and information, but it also has great potential for improving operational efficiencies as well. While this practice isn’t entirely new to the IT space, it is making its way into OT environments. And this is where beverage and food production can benefit the most.

Threat hunting is proactive, and takes a step back from the scanning tools, traps and future-focused infrastructure already in place. In an age of technology, it uses gray matter to uncover malicious activity and infiltrations that have been hiding in your network for months, maybe years. And further, it can find correlations not otherwise detectable between network activity and production inefficiencies.

Infestations Wreaking Havoc in Unexpected Ways

Have you noticed your mixer acting up? Are HMIs locking down? A label printer flashing errors?

It can start with an operator charging their unprotected phone in an open USB port on the network. Months later, your oven starts acting up and won’t maintain set parameters, even though mechanically, there’s nothing wrong.

Careful review of network logs uncovers that each time the oven acts up, there are beacons going to an outside IP address. This correlation is otherwise undetectable, and is what makes the human factor critical, and threat hunting so valuable. 

I went into a plant once that was experiencing repeated network slowdowns on a certain shift. Proactive hunting led to the discovery that one employee’s workstation was running an undetected Bit Torrent. So, each day when they logged in at the beginning of their shift, the entire network was impacted.

Why Aren’t Intrusion Detection Systems Catching All of This Hidden Malware?

Most of what threat hunting uncovers appears innocent, and without context and correlation, passes detection systems as business as usual. A piece of malware can communicate with an unknown IP address, but will look similar to intended internet traffic.

There also could be SYN scans going on in the peripheral, outside the boundaries of what your security software is looking for. They sit quietly and slowly look for a hole in the network. They’re not getting refused and haven’t established outside connections yet, so they remain undetectable.

In a threat hunting exercise, you may discover that an outbound connection is coming from a process that shouldn’t be going out to the internet. Or you may find a system that wasn’t being used at the time the communication was made, indicating an infected source.

The thing is, these APTs were probably already there when you implemented your cybersecurity system. That’s because most intrusion detection and prevention programs rely on a known, good state. If the baseline it starts from has poor traffic or malware activity, it becomes part of the norm. Many publicized security breaches have fit into this category. It is only years after a breach occurred that it’s detected and the scope off the damage realized.

Getting Started

The good news is, you likely have what you need to get started. Threat hunting is easy to implement with the right partner and can be a one-time activity, or become part of an ongoing security program. Your HMIs and servers are already creating activity logs you can gather and analyze offline so there’s no stress on the network or production interruptions.

So stop relying solely on endpoint protection and virus scanners to detect if you’re vulnerable. Go hunting for infiltrations before they impact your plant floor.

Source