How can you make your control systems more resilient to cyber attacks?

1️⃣ Create asset inventory for all hardware and software. 2️⃣ Perform Gap assessment for example using CSET.  3️⃣ Create list for all communication protocols that existed on ICS network using sniffing tools such as Wireshark  4️⃣ Using security capability list for industrial communication protocols , you could identify the vulnerabilities in industrial communication protocols 5️⃣ Perform vulnerability assessment using passive method or active methods such as OpenVas on Kali Linux 6️⃣ Perform high level risk assessment using ISA/IEC 62443-3-2 or any other risk assessment method 7️⃣ Partition  Control system into zones and conduits 8️⃣ Perform detailed risk assessment.  9️⃣ Apply the recommendation of the detailed risk assessment

Initially focus on a detailed and thorough risk assessment & employ frameworks like NIST SP 800-82 or ISA/IEC 62443. Equally important is understanding the specific nuances of your control systems & how they could be uniquely vulnerable. Evaluate potential vulnerabilities, considering external threats & internal risks like staff errors or insider threats. Examine the integrations with broader internal or external networks & defensible architecture for network segmentation, strict access controls, & continuous monitoring. Train staff in cybersecurity best practices & have a strong incident response plan. This early-stage assessment is crucial for developing targeted, layered defense strategies & the foundation for ongoing security measures.

Additively comprehensive ICS hardware & software inventory should be in record to do risk assessments and find the vulnerabilities of system in operation and priorities the actions in conformation of NIST SP 800-82 and IEC 62443-3-2 standards.

Regarding managing cybersecurity risk for industrial control systems and variable frequency drives (VFDs), there is no single solution nor a perfectly secure system. The practical approach is called the “Defense in Depth,” meaning the coordinated management of operations, technology, and people in a multiple-layer countermeasure approach. Alternatively, the security approach is often called the “castle approach” and works to establish a stacked layer of defenses across an information technology (IT) or operations technology (OT) system. The primary motivation behind the approach is reducing risk to threat vectors and providing redundancy in the worst-case scenario of a security failure or exploited vulnerability.

Understanding the specific operational context of your control systems is essential when implementing basic controls. Each system has its unique quirks & requirements. In some cases, frequent software updates or patches might not be feasible due to operational constraints or lack of availability. In these scenarios employing protective measures such as continuous network monitoring & visibility or enhanced physical security controls is vital. A common oversight is not regularly reviewing and updating these controls. Cyber threats evolve rapidly & what worked a year ago might not be sufficient today. Regularly revisiting & updating your security measures, in line with the latest threats & best practices is essential.

Cyber Security awareness is one of the most important recurrent activity, doesn't matter if you have the best technology or a full compliant process if your users are not aware or don't embrace cyber security as part of their daily work.

More we can decrease our attack surface more resiliant our system can become to compromise we have to reduce number of system input that attacker can useto attempt comprimise system

Staff training and security awareness is important element in cybersecurity management system as per standard ISA/IEC 62443-2-1 as training and awareness considered vital cyber countermeasure to prevent or mitigate cyber risk

From an experience point of view know what’s vulnerable, look at the complete chain , yes those pesky switches provided by your vendor long time ago too and access from the outside in only through proven defence tech in line with the zones and conduits as stated in isa 99 .

Understanding what each control system does, how it interacts with the rest of the plant and who the key personnel on site are is very important. I've often seen a perimeter protection centric approach applied where a box is drawn around a control system and hardening is only applied to that. If you understand the system under consideration, and the people who maintain it, you can provide better defence in depth, and save costs, by utilising the systems you already own to add security.