Network services
Maximising uptime for your critical infrastructure
Unplanned downtime of your operational technology can have severe consequences - from lost productivity to regulatory penalties and reputational damage.
Phoenix Contact have partnered with iT4Automation to address the growing gaps that have emerged between product supply and a secure by design implementation. Experience has identified some common challenges faced by End User organisations responsible for Operational systems.
Compliance
Those organisations that own, manage and support critical infrastructure assets are now legally obliged to raise the bar when it comes to the cyber security of network infrastructure and those systems that sit upon this infrastructure. Products, no matter how smart, are only an element of a desired outcome. Desired outcomes now consider risk and the controls that will mitigate and thus reduce risk to an acceptable level.
The days of operational security through obscurity are long gone; in current times with heightened global threat, governments including the UK, are demanding threats are understood and controlled.
For Critical Infrastructure, legally binding and enforceable obligations are detailed within the NIS1 2018 directive. Whilst Europe are evolving to NIS 2 the UK has remained with NIS 1 adding some local enhancements.
Compliant network design
To achieve a complaint infrastructure some strategic decisions need to be taken by asset owners and keepers. The steps involved in a compliant network design are:
Discovery and Inventory:
• Identify and document all the components, systems, and devices that make up the infrastructure.
• Gather information about the purpose, functionality, and interdependencies of these elements.
• Establish a comprehensive understanding of the overall infrastructure landscape.
Risk Assessment:
• Analyse the identified infrastructure components and assess the potential risks, threats, and vulnerabilities associated with each element.
• Evaluate the likelihood and impact of potential security incidents or breaches.
• Prioritise the risks based on their severity and the organisation's risk appetite.
Security Requirements Definition:
• Define the security requirements and controls necessary to mitigate the identified risks.
• Align the security requirements with relevant standards, best practices, and regulatory requirements.
• Ensure the security requirements address the confidentiality, integrity, and availability of the infrastructure.
Secure Design and Architecture:
• Incorporate the defined security requirements into the design and architecture of the infrastructure.
• Implement secure and resilient components, configurations, and communication channels.
• Ensure the overall infrastructure design adheres to the principle of "defense in depth," with multiple layers of security controls.
Secure Implementation and Configuration:
• Deploy the infrastructure components according to the secure design and architecture.
• Configure the security controls, access management, logging, and monitoring mechanisms.
• Validate the implementation of the security controls and ensure they are functioning as intended.
Ongoing Monitoring and Maintenance:
• Continuously monitor the infrastructure for any security incidents, anomalies, or changes.
• Regularly review and update the security controls to address evolving threats and vulnerabilities.
• Implement a robust patch management process to keep the infrastructure components up-to-date.
Testing and Validation:
• Conduct regular security assessments, penetration testing, and vulnerability scanning to identify and address any security weaknesses.
• Perform security testing throughout the infrastructure lifecycle, including during development, deployment, and production.
• Validate the effectiveness of the implemented security controls and their ability to mitigate the identified risks.
Incident Response and Recovery:
• Develop and maintain a comprehensive incident response plan to address security incidents and breaches.
• Ensure the plan includes procedures for detection, containment, eradication, and recovery.
• Regularly test the incident response plan and update it based on lessons learned and evolving threats.
OT Infrastructure transformation
IT4A can provide services that enable a smooth OT Infrastructure transformation.
- OT Infrastructure Assessment
First, iT4A assess your current network and your needs then use the Infrastructure assessment output to propose recommendations relating to achieving the ultimate, sustainable and complaint, infrastructure goal. - Recommendations
By the time the infrastructure assessment is complete, iT4A will have a good understanding of what is needed to achieve the wider goal of reliability, sustainability and security. We will be able to recommend next steps towards your wider goals.
Over a period of time iT4A can help you develop local systems of work for local infrastructure monitoring and management. Alternatively, iT4A can propose a remote support agreement where we bring data back to iT4A to monitor, assess and where necessary perform or mange the remediation process – reporting to the business each month on availability, condition and security.
