From manufacturing facilities and oil refineries to electricity transmission
and communications networks, we rely on computer‑based technologies for
almost every aspect of our daily lives. But if they're computer based, and
particularly if they're internet connected,
there are at least as vulnerable to cyber attack, if not
more so, than traditional IT systems.
Hi,
I'm Matt Lloyd Davies, and in this course, we're going to look
at how cyber attacks are carried out against computer‑based
systems that interact with the physical world and what you can
do to protect against them.
Operational technology, or OT, refers to computer‑based systems
that are used to manage all aspects of industrial operations
rather than administrative operations.
Industrial control systems, or ICS, are a major subset of
operational technology that are used to monitor and control
industrial processes, for example,
oil refinery cracking towers or electricity grid transmission.
Industrial control systems are usually mission‑critical
applications with a high availability requirement.
Let's take a look at an example. Here we have a small operational technology
setup. It's a drinks manufacturing plant. Ingredients are combined in the
right proportions in a tank that's kept at the right temperature and
pressure and levels of acidity and so on.
To automate the process, there needs to be a
computer system that contains a recipe.
The recipe describes the quantities of raw materials that
need to be added, in which order they should be added, and
how they should be mixed or blended.
The system will also need to provide data about the process's
operation and also notify operators when something's going
wrong and allow them to intervene.
Here we see a control panel, which allows an operator to interact with
the process, maybe setting a recipe, starting or stopping the process,
or monitoring the status of the process.
Is it operating within expected parameters?
This control panel is almost certainly computer based.
We can also see an indicator light suggesting green when the
process is operating correctly or red when it's not.
This is an analog indicator,
so not computer based, but it's likely triggered by a
computer‑based decision process.
Here we have the mixing tank. It's where the magic happens.
There are various sensors attached to the tank
monitoring parameters such as temperature,
pressure,
acidity or alkalinity, volume or level, even the proportion of liquid to froth.
Here we can see a control valve. A control valve adjusts the flow of a liquid
or gas to maintain the set point of a system parameter.
It may, for example,
control the flow of hot water through a heating coil to maintain the temperature
of the tank at a specified value. As the temperature rises,
the valve gradually closes.
If the temperature starts to drop, the control valve slowly opens.
This is another set of operator controls which look like stop and start buttons
and a dial indicating the value of an operating parameter.
These are analog controls, so not computer based. Here we can see a
temperature sensor that's reporting its value on an analog dial.
Again, these are not computer based,
but the temperature sensor may be reporting its value as a current or voltage
to a computer‑based system, as well as to the analog dial.
If the sensor and dial are operating correctly,
it will always show the true value of the temperature.
As a final example of an ICS component, in this picture, we can see a
couple of pumps used to move liquids around the process.
These will be computer controlled and will be switched on and
off to adjust the contents of the tank.
You may already be starting to see how a process like
this can be impacted by a cyber attack.
An attacker with access to the system could extract sensitive information.
The control system will essentially contain the
recipe, so ingredients, quantities, operating parameters, and so on.
That data could be of great value to a competitor.
Signals from temperature and other sensors could be manipulated to cause
the process to respond in an adverse way, increasing the temperature
when it should be decreasing or vice versa.
An operator needs to trust the data they're receiving because they'll
adjust the process based on the data they observe.
And if an attacker can somehow create denial‑of‑service
conditions or otherwise corrupt the system,
then the process stops.
And if a manufacturing process isn't operating,
it's not making money, so availability is essential for
operational technology in industrial control systems.