Cybersecurity

Physical and cybersecurity are converging

The distinction between digital and physical cybersecurity is vanishing, and the risks associated with connectivity have accelerated the need for new security protections in all aspects of manufacturing.
By Gregory Hale October 27, 2019
Courtesy: Chris Vavra, CFE Media

There is a growing intersection of physical and cyber security where the distinction between digital and physical worlds is vanishing, and the risks associated with connectivity have accelerated the need for new security protections in all aspects of manufacturing.

“The notion you can separate cybersecurity from physical security is going away,” said Tarah Wheeler, longtime cybersecurity expert and cybersecurity policy fellow at New America, during her keynote at GSX 2019 conference in Chicago. “The world is changing and physical security is becoming cybersecurity.”

In a world where information technology (IT) and operations technology (OT) cyber players have clashed and are beginning to work together, Wheeler sees the same thing on the physical security side.

“Where physical and cyber are coming together, there will be politics,” she said. “In an incident you don’t want a fight. Physical security is a piece of the world being recorded by cybersecurity. The concept of an audit trail is coming for physical.”

An audit trail is becoming more important as physical security players could rely on video from cameras, but through the years, industry players have learned sometimes video can be very misleading.

“Seeing somebody’s face is not always true,” Wheeler said. “You need to question the things you see.”

Preparing for a cyber attack

Without adequate cyber protection to connected physical security systems protecting critical infrastructure, OT environments may end up exposed and vulnerable. Every connection and connected device is an entry point, and a golden opportunity for a breach.

Everyone must understand attackers will leverage anything they can get their digital hands on to gain access to an OT system, including those within the enterprise security system itself to potentially infiltrate a manufacturing enterprise.

Brad Konkle, director of integrated solutions at Stanley Convergent Security Solutions, said there is digital technology in tools like wrenches and drills. That is why they have a digital product security team.

“Anyone that makes a product that is connected to the cloud should be concerned about security,” Konkle said. “Everything is an IoT device now. It is not just about security or IT, it is also about everything including home appliances.”

Wheeler added part of her job is to get into the mindset of an attacker.

“I have to think like a bad guy to keep people safe,” Wheeler said. “You have to think that way, too. There are three things to do on your worst day in cybersecurity:

  1. React
  2. Firefight
  3. Recover trust

“You have to do advanced planning and communications. People are the key to every part of security. Be ready for the situation that is about to come,” Wheeler said.

Even those working in marketing are security workers, Wheeler said. They are looking at social media and getting an understanding of what customers are saying and thinking. They are also seeing chatter going on that could relate to the brand in a positive and negative manner.

Wheeler added there needs to be solid communications up and down the ladder. “The value we bring is explaining what has happened,” she said.

That is why security experts need to provide:

  • Analogies
  • Images
  • Brevity
  • Understatedness.

“We want to be fierce protectors of data, people and companies,” Wheeler said. “It all boils down to trust.”

This content originally appeared on ISSSource.com. ISSSource is a CFE Media content partner. Edited by Chris Vavra, production editor, CFE Media, cvavra@cfemedia.com.


Gregory Hale
Author Bio: Gregory Hale is the editor and founder of Industrial Safety and Security Source (ISSSource.com), a news and information website covering safety and security issues in the manufacturing automation sector.