The Role of Identity in Cyber-Physical Systems

The role of identity in cyber-physical systems is essential for securing interactions between digital and physical components through authentication, authorization, and trust management.

As Cyber-Physical Systems (CPS) become increasingly sophisticated and tightly integrate the physical and virtual worlds, they introduce new security demands. Identity has now emerged as the foundational pillar for safeguarding operations and ensuring human safety.

With IT network convergence, new security demands are emerging. For this reason, identity becomes a basis for the protection of operations and ensuring individuals’ safety beyond even the most stringent security best practices.

IT/OT Convergence CPS Introduction

CPS represents the integration of computational algorithms with physical processes, encompassing a spectrum from smart grids to manufacturing plants. Industrial Control Systems (ICS) and SCADA systems are the primary components. These networks have been run on isolated Operational Technology (OT) networks, also known as “air-gapped,” to maintain their integrity and security. The isolation was designed to keep infrastructure away from the threats inherent in Information Technology (IT) networks.

The environment has shifted with the convergence of OT and IT. With the increasing need for efficiency, coupled with developments in data analytics, remote access, and the use of IoT devices, the air gap that once existed is decreasing, leading to increased interconnection between the OT and IT environments. The convergence significantly broadens the attack surface, allowing cyber threats previously confined to the digital realm to directly affect physical processes.

The physical consequences of cyberattacks on CPS are wide-reaching and pervasive, from data-stealing to even physical harm to equipment, environmental catastrophe, and loss of human lives. With this profile of risk, where a cyber intrusion can manifest as a tangible, real-world catastrophe, the demand for identity security in CPS environments has never been higher.

OT Legacy Unique Vulnerabilities

Operational technologies have inherent weaknesses, primarily due to the design principles on which the systems are founded. The majority of these systems were created decades ago, and their design focused more on reliability, uptime, and performance rather than security. The systems lack some of the security controls commonly found in IT environments, including patch management capabilities, authentication, and logging.

Some of these inherent weaknesses are exacerbated by specific characteristics. OT assets have long operational lifecycles, e.g., decades, and are, therefore, complex and costly to replace with secure assets or upgrade. They can use proprietary communication protocols that are often opaque and undocumented, which presents challenges in employing standard security tools to monitor and secure network traffic.

Real-time requirements of most OT systems also impose limitations. Any action, including updates or reconfiguration, must be well thought out to avoid disturbing critical processes, which require downtime that is either unrealistic or impossible in 24/7 systems. These factors collectively render IT cybersecurity methods largely ineffective or even detrimental when applied without consideration of OT environments.

Identity the New Perimeter

The foundational shift brought about by the convergence of IT and OT has eroded the notion of a secure perimeter. In a time when the traditional air gap has been compromised, the idea of a network boundary as a security perimeter is no longer adequate. Instead, identity has become the key security control point in CPS and is becoming the new perimeter.

The networked character of the IT and OT networks guarantees that lateral movement between domains is no longer a barrier. Now that these previously siloed areas have been opened up, we require a paradigm shift: security can no longer be solely based on keeping out, but must also be concerned with the regulation of internal access and privilege.

Therefore, security against manipulation of physical processes and infrastructure rests on controlling who (or what entity) has access to which systems and what they are authorized to do once that access is granted. Identity governance, encompassing authentication and authorization, is now the frontline in safeguarding CPS against both external actors and insider threats.

Complex CPS Identity

The identity of the CPS environments is diverse and vast, posing challenges to the unified management of the space. Human identities form part of the building blocks, which involve operational personnel, maintenance engineers, and other third-party vendors and contractors requiring access to perform their roles.

Beyond human users, a wide variety of machine identities populate CPS. These consist of Programmable Logic Controllers (PLCs) providing process automation, Remote Terminal Units (RTUs) that operate remote equipment, a multitude of sensors recording environmental data, and actuators that trigger physical responses. Additionally, intelligent devices, industrial IoT endpoints, and domain-specific workstations add to this rich system of non-human identities.

Moreover, “process identities” have been defined as self-contained processes, programs, or software agents that interact with physical systems independent of human intervention. Many of these machine and process identities were never designed with modern identity management principles in mind, often lacking unique identifiers, credential storage, or standard integration capabilities, making their discovery, inventory, and secure management an arduous task.

IT/OT Identity Management Challenges

Implementing strong identity management for CPS presents a distinct challenge compared to deploying general IT. The biggest challenge is the presence of legacy systems, which include some that are based on hardware and software platforms that are no longer valid for supporting existing identity protocols or agents and, therefore, are challenging to integrate with centralized identity solutions.

Many OT devices, particularly sensors and actuators, possess limited computing power, memory, or network bandwidth, rendering standard identity clients or authentication mechanisms impractical. Moreover, operational requirements call for nearly zero downtime; any patching, rebooting of the system, or changes in configuration required for the deployment of identity solutions must be scheduled and performed, usually during maintenance windows.

This is further complicated by the fact that domain-specific operational knowledge typically resides with OT engineers who understand industrial processes but may not be well-versed in enterprise IT security. This leaves us with a siloed organizational structure, where different tools, priorities, and reporting lines are used by IT and OT organizations, impeding the necessary collaboration and unified approach required for identity security across the converged environment.

OT Authentication Mechanisms

Based on the specific needs of CPS, a tailored solution is required for authenticating both machine and human access. For human users, implementing MFA is paramount, moving beyond simple passwords to incorporate a factor that a user has (e.g., token, app) or is (biometrics) that significantly raises the barrier for unauthorized access.

For machine identities, device-specific authentication mechanisms are critical. These consist of the extensive use of digital certificates for machine-to-machine communications, such that only approved devices can communicate. Secure hardware elements or hardware tokens embedded in devices can provide cryptographic roots of trust, which establish device integrity and authenticity on boot-up and communications.

Secure boot processes that verify software and firmware components for integrity from the moment a device powers on are vital in preventing the execution of code. Mechanisms on resource-constrained devices, which are usually based on pre-shared keys or challenge-response, must be carefully engineered for security without compromising performance. The aim is to eliminate shared, default, or guessable credentials and replace them with strong and cryptographically secure credentials that are unique.

Access Control Network Segmentation

Aside from authentication, safe authorization and diligent network design constitute the foundations of CPS security. The concept of least privilege should be upheld at all times, such that human and machine identities possess only as much privilege as required to carry out their individual functions, which reduces the likely impact of a breach. This is typically accomplished with RBAC, specifically customized for OT environments.

Just-in-time (JIT) access, which provides temporary and time-limited permissions for a specific purpose, adds an extra layer of security by closing the window of opportunity for misuse. Most importantly, network segmentation is a key factor in managing the flow of communications. Framework models such as the Purdue Model, which characterizes hierarchical zones and channels within an industrial network, are needed to establish logical boundaries.

These segments isolate critical systems, preventing unauthorized lateral movement from less secure IT networks into sensitive OT domains and even within different levels of the OT network itself. By specifying requirements and stipulating communication channels between zones, organizations can limit the extent of a breach, ensuring that even if one section is compromised, these essential physical processes are maintained.

CPS Identity Safety-First

The direct and disastrous implications of identity compromise in CPS demand a “safety-first” strategy for IAM.  In contrast to traditional IT breaches, which usually result in data loss, financial fraud, or reputational harm, a successful OT breach can initiate much more disastrous consequences with real physical effects.

A compromised identity in CPS can lead to direct physical damage to devices, including overheating of turbines or pump failure, resulting in immense financial loss and system downtime. Even more, the effect of such compromises can go further to create severe environmental risks, including chemical emissions or spills, that can harm ecosystems and inflict damage on public health. Of grave concern is that an uncontrolled or compromised identity can enable a safety system to be taken over.

Therefore, all CPS identity management functions, such as access policy enforcement and user provisioning, must be executed with utmost priority given to preventing physical risk or exposure during operations. Such high criticality calls for augmented levels of rigor, constant audit, and greater awareness of the possible physical implications of each grant or denial of access.

IT/OT Security Gap

To implement strong identity management in CPS, it is imperative to bridge the existing gap between IT and OT security. It requires effort to bring IT and OT personnel together and change from disconnected to collaborative working modes, sharing expertise, tools, and a common appreciation of risk. Cross-training programs, collaborative working groups, and incident response planning are just a few of the components that contribute to achieving such synergy.

Sophisticated OT security solutions must be employed. They are capable of translating proprietary protocols, operating within the confines of the OT environment, and integrating with IAM platforms. The integration provides a consolidated view of identity and a single policy enforcement point, enabling hybrid identity management methods that incorporate IT and OT security best practices.

To develop end-to-end identity security in CPS, comprehensive visibility of both the physical and virtual worlds is a must. This involves possessing a single catalog of all human, machine, and process identities, their relationships with assets, and their activity in real-time. With this level of transparency, organizations can find, manage, and protect all identities and establish operational resilience.

Best Practices

Identity protection in CPS necessitates the imposition of strategic best practices. One of the cornerstones is an end-to-end identity lifecycle management program, which comprises discovery, provisioning, de-provisioning, and regular review of all human, machine, and process identities to ensure authorized parties have the required privileges.

Key actionable practices are rigorous MFA for OT system access and machine identities, digital certificate deployment, hardware-based roots of trust, and secure boot. Implementation of the principle of least privilege through RBAC and JIT access must be done to minimize attack surfaces and enhance breach containment.

Alongside technical controls, practices also encompass developing a common security culture where OT and IT teams work together, for example, through collaborative threat modeling, shared security operations, and ongoing security awareness training. Regular audits, vulnerability scanning, and OT environment-appropriate incident response exercises must be conducted to maintain a proactive approach and ensure physical process integrity and resiliency.