In operational technology (OT) networking, the reliability and availability of industrial processes trumps everything, even cybersecurity. But what happens when an OT networking protocol designed to ensure speedy availability of safety-critical communications also embeds a security weakness into the architecture?
Without a full slate of cyber controls folded in, that reliability mechanism could itself become a vehicle for the kinds of industrial failures it's supposed to help prevent.
"Availability and security are very close to one another," says Luca Cremona, senior security researcher for Nozomi Networks which Mitsubishi Electric acquired in a roughly $1 billion deal that closed in January. "A protocol that is not secured is not guaranteed to be available."
Cremona and his colleagues demonstrated this dynamic at play with recent findings they unveiled at Black Hat USA last week in an on-demand-only recorded session that's available to attendees through September 14. The team showed how weaknesses in Time-Sensitive Networking (TSN) protocols could be abused to ultimately manipulate all the industrial systems it touches.
"What we show in the recorded session is that we can tamper with all of the process variables within the TSN network," he says. "We can start and stop robotic arms, for example making them open pliers and let the object they're holding fall down. You can do whatever you want, basically."
The robotic arm example is the most impactful scenario described, says Cremona. But there are other, quiet attack scenarios their findings demonstrate. This also includes subtly tampering with OT synchronization clocks to inject damaging changes in scheduling of processes.