Partnering with Stakeholders to Secure Digitization of Water

Authors: Sindhu Govardhan, Kenneth G. Crowther

Abstract:

Modernisation of the water sector is leading to increased connectivity and integration of emerging technologies with traditional ones, leading to new security risks. The convergence of Information Technology (IT) with Operation Technology (OT) results in solutions that are spread across larger geographic areas, increasingly consist of interconnected Industrial Internet of Things (IIOT) devices and software, rely on the integration of legacy with modern technologies, use of complex supply chain components leading to complex architectures and communication paths. The result is that multiple parties collectively own and operate these emergent technologies, threat actors find new paths to exploit, and traditional cybersecurity controls are inadequate. Our approach is to explicitly identify and draw data flows that cross trust boundaries between owners and operators of various aspects of these emerging and interconnected technologies. On these data flows, we layer potential attack vectors to create a frame of reference for evaluating possible risks against connected technologies. Finally, we identify where existing controls, mitigations, and other remediations exist across industry partners (e.g., suppliers, product vendors, integrators, water utilities, and regulators). From these, we are able to understand potential gaps in security, the roles in the supply chain that are most likely to effectively remediate those security gaps, and test cases to evaluate and strengthen security across these partners. This informs a “shared responsibility” solution that recognises that security is multi-layered and requires collaboration to be successful. This shared responsibility security framework improves visibility, understanding, and control across the entire supply chain, and particularly for those water utilities that are accountable for safe and continuous operations.

Keywords: Cyber security, shared responsibility, IIOT, threat modelling.

References:

[1] Dragos, 2023. Summary of Threat Activity Groups. Available online: https://www.dragos.com/threat-groups/
[2] AWS, 2023. Amazon Web Services (AWS) Shared Responsibility Model. Available online: https://aws.amazon.com/compliance/shared-responsibility-model/
[3] Lostri, E, JA Lewis, G Wood, 2022. A Shared Responsibility: Public-Private Cooperation for Cybersecurity. Center for Strategic International Studies. Published March 1, 2022. Available online: https://www.jstor.org/stable/resrep40145
[4] ENISA, 2018. Good Practices for Security of Internet of Things in the context of Smart Manufacturing. Available online: https://www.enisa.europa.eu/publications/good-practices-for-security-of-iot
[5] Mission Secure, 2023. Is the Purdue Model Relevant in a World of Industrial Internet of Things (IIoT) and Cloud Services? Available online: https://www.missionsecure.com/blog/purdue-model-relevance-in-industrial-internet-of-things-iiot-cloud
[6] Shostack, A, 2014. Threat Modeling: Designing for Security. Wiley.
[7] Microsoft, 2023. Threat Modeling. Available online: https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling
[8] MITRE, 2015. ATT&CK Knowledge Base. https://attack.mitre.org/
[9] MITRE, 2007. CAPEC Enumeration. https://capec.mitre.org/
[10] Hernan, S, S Lambert, T Ostwald, A Shostack, 2006. Threat Modeling: Uncover Security Design Flaws Using the STRIDE Approach. MSDN Magazine. 2006 (November). Available online: https://learn.microsoft.com/en-us/archive/msdn-magazine/2006/november/uncover-security-design-flaws-using-the-stride-approach