From Assumed to Assured — SSAB Validates ICS Segmentation with Beacon
For years SSAB has been systematically developing the cybersecurity of industrial systems. As part of these efforts the isolation of networks has also been significantly improved.
Isolation of critical network segments such as industrial control systems is one of the most important cybersecurity policies and best practices. Policies and best practices have always existed, but have evolved over time.
In an increasingly networked world, it has been understood that network isolation in industrial systems is paramount because the system update and life cycles are very long. Often the support for devices has already ended long before the systems can be renewed.
SensorFu Beacon is a solution that allows the functionality of network isolation to be monitored and improved continuously and automatically. Network isolation is also an essential part of SSAB’s company-wide safety ideology.
“Deploying Beacon was extremely easy. Actual deploying took approximately five minutes including the coffee break,” says Pertti Valtonen, OT Service Manager at SSAB.
“Configuring and downloading the beacons from the management interface was smooth, and there was no need to read the instructions at all. SSAB had deployed beacons as both virtual and physical devices. Some minor delays were found when the IT solution supplier did the virtual machine deployment to an HCI environment. SensorFu’s support has also been very well available.”
“After deploying the Beacons, results were found immediately. We caught an old firewall rule that allowed traffic to pass from one network segment to another. After finding this vulnerability the corrections were made quickly.”
The problems found with SensorFu Beacon were not surprising as environments that have been in place for so long have unfortunately deteriorated slightly. There’s been turbulence in the processes and over time old firewall rule openings that were necessary at the time may have remained in the environment.
“When the observations were made, the corrective actions were easy, and thanks to the findings, the isolation of several networks was improved at once. After discovery, it was easy to show what the issue was, and the necessity of a firewall rule was easily decided,” says Valtonen.
According to SSAB’s experience, SensorFu Beacon is a good solution for continuous monitoring of network isolation, based on the findings of which network isolation has been improved. Deploying beacons was easy and they did not cause any unexpected issues in industrial systems, but of course, the implementation had to be done carefully and widely communicated.
“At first, we were cautious about introducing new software into the production network segments, but SensorFu’s references and descriptions of the software’s operation convinced us of the system’s safety. We also tested the operation of SensorFu Beacon initially in a less critical environment.”
