As a veteran automation professional, I have experience in industries ranging from big chemical to pharmaceuticals, and have worked on projects scaling DCSs to tiny systems with 20 I/O and two screen HMIs. I was excited when I saw the title of this book because I anticipated a balanced look at real world solutions for very real problems. There is a serious issue right now in our industry with people spreading fear, uncertainty and doubt about how we are all doomed because our protocols are insecure and vendors are not practicing proper security development lifecycle. Though many of the frightening details being publicized are true, I think a more balanced approach to highlighting the deficiencies, and then providing actionable information an end user can take away from the discussion and put into practice is more appropriate. And that approach is almost the exact outline of this book.
The authors do an excellent job of giving the reader some basis for understanding the material through both a history lesson and an introduction to basic concepts in industrial control system (ICS) network design. Next, they raise the stakes by describing the insecure protocols, with a culminating discussion on how you might hack these protocols. The information revealed is certainly not earth shattering, and is probably the equivalent of Hacking 102 or 103 for someone once they learn the protocols. Where this book truly succeeds, however, is in taking you from a fearful place to walking you through real world tasks that can be used to safeguard your systems.
The authors do a magnificent job of taking you through the logical steps of assessing risk, compartmentalizing the risk, and then monitoring for undesirable activity on your network. It is essentially a step-by-step on how to methodically reduce your overall risk profile with what I think is an appropriate level of detail for a broad ranging book such as this. Though there is no way to ever be 100 percent secure, this book provides a long list of things to do to make the adversary’s task infinitely more difficult.
No review would be complete, however, if it didn’t include honest criticisms. Living outside of the United States, I was forced to download and read the book via Kindle. The text layout and formatting was acceptable, but many of the tables were very poorly formatted and indecipherable in the Kindle format. It appeared that instead of taking the time to format these tables for optimum viewing on the Kindle, they were copied as black and white images and included in line. Some of the longer tables were presented as multiple images in a series, making it very difficult to follow.
Another issue was a constant return to the data diode as a solution to many potential issues in the plant. Yes, a data diode is an excellent solution for limited use cases when communicating outside the ICS networks, but it seemed to be revisited as a solution at almost every turn. Instead, I would have preferred to keep the focus on securing the internal networks with flexible and relevant solutions like firewalls and IPS/IDS. A well-crafted attack has the potential to do serious damage even if cut off from the C2 (command and control) infrastructure. This is our unique risk in the ICS space—attackers can do serious harm without exfiltrating a single byte of data.
I also have a heads-up for those who already work in the cybersecurity space. This book is not a deep dive on any particular topic related to ICS security. If you want a detailed discussion of the insecure protocols, the numerous ways they can be attacked, and suggestions for altering the protocols for security, this is not your book. Also, if you are an experienced ICS professional, the opening chapters of the book may be redundant as they simply introduce the readers to some basic cybersecurity concepts. Finally, if you fancy yourself a security expert and think that reading this book will give you all the tools you need to walk into a refinery and demonstrate your superior knowledge of their unique systems, you are in for a serious wake up call. Given that, I think this book is aimed at the following groups:
- The ICS engineer who knows how to make the systems work, but doesn’t really know how the systems work. Here is an example to help clarify my point: You can get a Modbus TCP connection up and running between your server and a client, but you don’t understand how a Modbus TCP packet actually works and, therefore, don’t understand how it can be attacked. You will understand this issue better after reading this text, and then you are ready to start thinking about the most effective way to secure your installation.
- The security professional who would like to begin to understand ICS networks and the unique challenges they pose. The authors do a great job describing the fundamental concepts associated with ICS networking and how they are so different from traditional IT systems. With a firm foundation and requisite level of respect for what we do in ICS, I think an IT security professional can start to work towards helping make our systems closer to being on par with our IT brethren.
My overall impression is that this is a good book for a broad range of potential readers, but you should also be prepared to continue your studies in more depth.
Andy Robinson is Information Solutions Consultant at Avid Solutions Inc., a certified member of the Control System Integrators Association (CSIA). For more information about Avid Solutions, visit their profile on the Industrial Automation Exchange.