Securing OT: Follow Secure by Design principles

In many of today’s OT software and hardware components, security measures and concepts are added at the end of the process chain once a product is in operation. This gap can cause considerable problems in OT environments.

How do you ensure that OT security is a consideration during software and hardware development from the very start—instead of an afterthought?

“Secure by design” is a concept that promotes security from the very beginning. In other words, the security of a product is considered in all phases of the development process and throughout the entire lifecycle, from brainstorming to end of life.

The idea of secure by design brings many opportunities to improve OT system security, reliability and continuity.

Implementing integrated, sustainable security

Security by design is one of the requirements established in the European Cyber Resilience Act (CRA) for products with digital elements in the European single market. Its aim is to implement suitable security architecture in the products themselves so they have fewer vulnerabilities when they’re released to market.

This state of security is maintained over the lifecycle of the product through security updates offered by the manufacturer.

How a product becomes Secure by Design

There are many ways a manufacturer can build security into its hardware and/or software. Here are a few examples:

• Minimize the attack surface by omitting superfluous components and applying the principle of least privilege
  
  
• Implement data encryption that secures data traffic sent and received by the product
  
  
• Ensure secure authentication of product users via multi-factor authentication
  
  
• Isolate and separate security-relevant areas
  
  
• Conduct regular tests during the development lifecycle to identify and mitigate risks
  
  
• Update security regularly by installing updates, fixes and patches from the manufacturer

Why Secure by Design concepts are critical in OT

Secure by design is a concept that’s particularly important for OT systems. In operational technology, especially in critical infrastructures, cyberattacks and system failures usually have far-reaching consequences. Robust and reliable systems are needed to ensure continuous cyber-resilient operation. By defining and testing security requirements throughout the entire development process, cybersecurity is no longer seen as an add-on but an integral part of a product.

Internet of Things (IoT) and Industrial Internet of Things (IIoT) devices are increasingly being used in industrial plants, hospitals and other critical utilities. They promise more efficient processes and new value creation. At the same time, they are often a gateway for attackers, especially when manufacturers don’t build security precautions into the development process.

As a result, IoT and IIoT devices sometimes have security gaps that must be compensated for by implementing security solutions after the devices are in use.

Advantages of security by design

There are many advantages to investing in software and hardware that follow secure by design practices.

1. In OT, the lifecycles of machines, plants and systems are often long. Secure by design concepts integrate security into products from the start. Risk analyses are carried out and corresponding requirements are defined.
   
   
   
2. Following secure by design practices means developing robust products with up-to-date security precautions and understanding security as a quality feature. Vulnerabilities in the architecture and code of the products are minimized and offer a small attack surface.
   
   
   
3. Attempting to make security improvements after the devices are in use can result in high costs and have far-reaching consequences. Integrating security into the design can reduce total cost of ownership, particularly in OT, as it creates a secure basis for reliable use of the products in operation.

Belden is committed to following a secure by design approach. We integrate security into each stage of our development process, from initial design to the final solution.

Learn about our industrial cybersecurity solutions.

Related links:

• What a Recent Survey Says About OT Security and How It Can Improve
• IT Security vs. OT Security: What Are The Key Differences?
• Beating the OT Security Skills Gap Amid Rising Cyber Threats