Details
Initial situation and challenge
Perhaps more than in any other industry, cybersecurity in chemical production is also about protecting employees and the environment. The supported chemical company already has a well-established and effective IT security team. However, the OT of the process plants had not been monitored for cyber incidents until now. Given the high level of digitization and networking of the production lines, however, this had become necessary in order to strengthen protection against data theft as well as protection for people, plants and the environment in chemical production.
First, a risk analysis was carried out to examine three production lines of the chemical company at one site. For this, a Rhebo Industrial Security Assessment was carried out to identify existing security gaps and vulnerabilities.
Solution
Risk analysis and vulnerability assessment
Rhebo Industrial Security Assessment
- detect and analyze assets and communication structures,
- identify vulnerabilities, stability and security gaps,
- define mitigation measures for system hardening.
Network intrusion detection system for OT networks
Rhebo Industrial Protector
- continously monitor OT network communication,
- identify cyber attacks, security gaps and error states in real time,
- ensure legal compliance with national cybersecurity laws.
Managed OT security monitoring
Rhebo Managed Protection
- conduct regular vulnerability assessments,
- regularly evaluate reported anomalies with Rhebo experts,
- get emergency support with forensic analysis of incidents.
Implementation and findings
To run the Rhebo Industrial Security Assessment, a Rhebo sensor was integrated into each OT network. Over a period of two weeks, the sensors passively and non-intrusively recorded the OT communication and stored it as packet captures (pcap). Afterwards, Rhebo experts analyzed the communication logs, using methods such as deep packet inspection, automated anomaly detection and forensic analysis.
As a result, the chemical company was able to gain visibility into its OT for the first time. It was revealed – not surprisingly – that the chemical production plant had a relatively homogeneous infrastructure. Although several hundred devices were identified in each monitored OT network, they were from only a few manufacturers.
However, the security posture and network quality scored in the middle range. Observations that led to this assessment included:
- insecure software, operating systems, and firmware on multiple devices,
- suspected address scanning,
- use of protocols with unencrypted passwords,
- insecure authentication methods,
On the stability and availability assessment side, the team identified
- unreachable devices,
- network disturbances,
- checksum errors.
The sensors integrated as part of the Rhebo Industrial Security Assessment remained in the OT networks and were put into operation with a Rhebo Controller as a network intrusion detection system (Rhebo Industrial Protector). Rhebo regularly supported the chemical company in evaluating anomaly alerts and assessing the risk situation until the company had built up sufficient in-house expertise to operate the intrusion detection system independently.
