What should be the ideal solution for identifying threats and vulnerabilities in the OT sector?

In an interview with Wise TV, Ediz Öztürk, founder of edZconsult, provides a comprehensive assessment of why Red Teaming practices are critical for OT (Operational Technology) systems, how these tests are conducted, and the protocols within which they should be addressed.

We are all well aware that Red Teaming practices are not sufficiently implemented in manufacturing facilities. We must acknowledge this fact, as the systems and initiatives involved in Red Teaming entail specific costs—the most significant being the human cost, given that people are the most vital resource in Red Teaming. Effectively identifying threats and vulnerabilities within OT environments—and devising solutions for them—requires personnel with years of experience in both OT and other systems. Naturally, the time of such experienced professionals is valuable; consequently, Red Teaming exercises, penetration tests, and similar attack simulation tests come at a significantly higher cost for manufacturing facilities. Especially considering the current economic climate, keeping production costs within a certain range is crucial for these facilities, leading them to shy away from such additional expenses. In short, Red Teaming is not being conducted adequately within OT systems. So, why should we do it? Because responding to an attack—or even detecting one—depends entirely on having properly configured monitoring systems. Without a proper monitoring system in place, you simply cannot detect that an attack is occurring. We generally categorize industrial facilities—or companies in general—into two groups: those that have been hacked, and those that do not realize they have been hacked. There is no such thing as a company, institution, or individual that has never been hacked. Therefore, it is essential that we are aware of such incidents; this makes monitoring systems the primary prerequisite. The next component of the monitoring process is cyber incident response. Companies absolutely must acquire the capability to respond rapidly to the incidents and threats we refer to as “incident response.” Red Teaming activities and penetration tests naturally provide companies with this capability. We categorize the penetration tests or attack simulations we conduct on OT systems into two—or arguably three—types: Black Box tests, White Box tests, and Grey Box tests. We observe that Grey Box testing is generally preferred for industrial systems, as it represents a middle ground between the other two. In Black Box testing, the professional conducting the test is provided with no information regarding the industrial system; consequently, they must discover and map out the system on their own. Naturally, discovery takes time, and time equates to money, which is why Black Box tests are not frequently chosen. However, since Black Box tests fully simulate a real-world hacker, we strongly recommend their use. Of course, companies are often reluctant to opt for them due to the higher cost. So, what is White Box testing? It is the exact opposite; it addresses the question of what to do in the event of an insider attack. After all, we have employees within the organization, and threats could arise from various sources—such as an employee seeking revenge, other motives, or even incitement by competitors. Therefore, we need a way to simulate attacks originating from within the organization. How do we perform this simulation? Through White Box testing. In this scenario, the attacker—our professional—is provided with full access to all system information. Naturally, this approach itself presents a potential risk to the company’s internal security. That is why “Grey Box” testing—which falls somewhere in between the two—is commonly performed. It begins with Black Box testing, and a specific timeframe is allocated for it. If certain issues remain undiscovered during that initial phase, the process shifts back to a “White Box” approach. This is generally how Red Teaming tests are conducted. Is this the right way? It is, in fact, a necessary approach. However, it must be performed periodically; for instance, if we conduct it today, it needs to be repeated—say, in six months—and the White Box assessment might need to be repeated after a year. This is because various vulnerabilities emerge over time. Especially when considering the OT (Operational Technology) landscape—if I recall correctly, a recent Gartner figure projected that more than 35 billion embedded systems would be operational worldwide by 2024—we are talking about tens of billions of systems communicating with one another. There is a vast array of protocols involved. When we hear “protocol,” we often think of TCP, but the reality extends far beyond that; there are many other protocols in use globally. Therefore, we need to conduct various types of penetration tests—addressing protocols, physical layers, and the different architectural layers mentioned earlier—while also implementing necessary isolation measures. Furthermore, remote control systems now frequently operate in conjunction with industrial cloud services. Integrating these systems with the industrial cloud introduces a whole new dimension to the challenge; conducting Red Teaming—particularly on cloud systems—becomes significantly more complex, often requiring authorization from the cloud service provider. This necessitates the use of hybrid cloud technologies and a holistic view of the entire infrastructure. Consequently, it is essential to establish GRC (Governance, Risk Management, and Compliance) frameworks. Naturally, various other precautions must also be taken, including the implementation of regular updates. For instance, we see Windows XP in industrial systems. Even though the manufacturer has abandoned the operating system—meaning no updates are being released—production facilities keep these systems in place because the software developed for them back then still needs to function. Yes, they may be retained; yes, such systems do exist. However, they still need to be supported by the isolation measures we discussed earlier. If we consider this within a holistic framework, Red Teaming is a major component of the whole; unfortunately, if you remove that key piece from the picture, the value of the entire setup diminishes.

What Is Red Teaming and Why Is It Important?

Red Teaming involves simulation tests conducted to identify and remediate an organization’s security vulnerabilities. These tests evaluate the organization’s cybersecurity defenses against real-world attacks. Red Teaming is particularly crucial for critical infrastructure, such as manufacturing facilities. However, due to the associated costs and human resource requirements, such tests are often underutilized. In this article, we will examine the importance of Red Teaming and how it can be implemented more effectively.

Key Elements of Red Teaming

Red Teaming is generally conducted using three main types of tests: Black Box, White Box, and Grey Box. In Black Box testing, the testing team receives no information and is expected to act entirely like an external attacker. In White Box testing, full system information is provided, simulating an insider attack. Grey Box testing combines these two approaches and is often the preferred method.

Red Teaming in Manufacturing Facilities

Red Teaming implementations in manufacturing facilities are often limited due to cost and human resource constraints. However, identifying and remediating security vulnerabilities in such facilities is vital. Disruptions to production processes can lead to significant financial losses; therefore, Red Teaming exercises should be conducted on a regular, periodic basis.

The Role of Monitoring Systems

The effectiveness of Red Teaming tests depends on the implementation of robust monitoring systems. Monitoring systems enable the detection of attacks and facilitate rapid response. Without these systems, an attack might go completely unnoticed. Consequently, the installation and continuous updating of monitoring systems are of great importance. The Importance of GRC Frameworks

Governance, Risk Management, and Compliance (GRC) frameworks enhance the effectiveness of Red Teaming practices. These frameworks define an organization’s security policies and ensure their implementation. Furthermore, they provide the necessary infrastructure for assessing risks and managing compliance processes.

The Importance of Updates

Updates are critical for ensuring system security. Outdated operating systems and software, in particular, can lead to significant security vulnerabilities if they are not supported by updates. Therefore, it is essential to update systems regularly and replace obsolete software whenever possible.

Conclusion

Red Teaming is a vital tool for testing and improving an organization’s cybersecurity defenses. Conducting such tests regularly—especially within critical infrastructure like manufacturing facilities—ensures preparedness against potential attacks. However, the effectiveness of these tests depends on the implementation of proper monitoring systems, GRC frameworks, and regular updates. By integrating these elements, organizations can become more resilient against cyber threats.