Blog

---

The monitoring of asset performance in water treatment plants has seen rapid technological advancements in the face of changing requirements and best practices. 

Plant operators are no longer required to perform physical asset checks at fixed intervals or wait for issues to surface. Instead, modern equipment and network technology enable remote and real-time access to assets, with the ability to analyze data proactively to detect and address potential problems before they manifest. 

Water systems are among the critical infrastructure that ensures the well-being of communities. To manage and monitor these systems efficiently, Supervisory Control and Data Acquisition (SCADA) systems play a crucial role. However, enabling secure remote access to SCADA for water systems comes with its unique set of challenges.

In this article, we delve into the realm of secure remote access to SCADA for water systems and how the Zero Trust security model can provide an effective solution.

The Challenges of Remote Access to SCADA for Water Systems

Remote access to SCADA systems presents several significant challenges for water systems:

Cybersecurity Threats: Water systems have become a prime target for cyberattacks because of their ease of exploitation. Traditional remote access approaches can expose vulnerabilities, making it an attractive attack vector for malicious actors to disrupt operations, steal data, or compromise the safety of the water supply.

Legacy Systems: Many water utilities still rely on legacy or obsolete operating systems for their SCADA infrastructure that were not designed with robust security features and do not support up-to-date security fixes. These systems may lack minimum levels of encryption, authentication, and monitoring capabilities, making them susceptible to attacks.

Network Complexity: Water systems often encompass a vast network of industrial-grade sensors, pumps, and reservoirs. Ensuring secure remote access to every component across vendors can be challenging, especially when they are spread across large geographical areas.

Regulatory Compliance: Water utilities must comply with various body regulations and standards, such as the Safe Drinking Water Act. Meeting these requirements while enabling remote access can be complex and costly to maintain.

Authentication and Authorization: Traditional access control methods may not be sufficient to protect against unauthorized access. Managing user credentials and permissions can be daunting when dealing with a large number of operators and technicians. This work also often falls out of scope for OT managers who defer such tasks to the IT group

The Zero Trust Model: A Modern Solution to Secure Remote Access to SCADA

Zero Trust Architecture is a security framework that operates on the principle of “never trust, always verify.” It assumes that threats may exist both outside and inside the network. With this model, remote access to SCADA systems becomes more secure and manageable. One of its core principles is strict identity verification for all users and devices attempting to access any part of the SCADA systems, ensuring that only authorized personnel with the appropriate permissions can gain network access, thereby reducing the risk of unauthorized entry. 

Additionally, the framework promotes micro-segmentation, wherein water systems are divided into isolated zones, each equipped with its own security controls, preventing lateral movement for potential cyber attackers even if they manage to infiltrate. Continuous monitoring and real-time threat detection are crucial components, helping swiftly identify any suspicious activities to mitigate potential threats before they escalate, thus limiting their potential impact. Data transmitted between remote users and the SCADA system is also safeguarded through encryption with up-to-date ciphers to protect against interception or tampering by attackers. 

Furthermore, Zero Trust advocates for a “just-in-time access” approach, ensuring that access is granted only when necessary, with users and devices receiving the minimum level of access required for their tasks. This strategy significantly reduces the risk of privilege escalation attacks across devices.

Zero Trust in Action for Water Systems

Implementing Zero Trust for secure remote access to SCADA systems involves careful planning and investment in various key areas. These include Identity and Access Management (IAM), where IAM solutions are deployed to manage user access and enforce robust authentication methods. Network Segmentation is another vital component, which entails dividing the network into segments with stringent access controls and firewalls to isolate and safeguard critical assets.

Multi-factor authentication (MFA) plays a critical role in Zero Trust, as it is enforced for remote access, third-party organizations, or critical applications, adding an extra layer of security to verify user identities. Additionally, Security Information and Event Management (SIEM) tools are employed to ensure continuous monitoring and threat detection, enabling a comprehensive set of audit records to be applied to Risk Management and Compliance frameworks.

Finally, a fundamental aspect of Zero Trust implementation is the creation and enforcement of security policies. These policies outline who can access what and when, ensuring that access to SCADA systems is tightly controlled and only granted to authorized individuals, thus enhancing overall security and reducing the risk of unauthorized access.

Secure Remote Access to SCADA, Solved

The challenges of enabling secure remote access to SCADA for water systems are real, and the Zero Trust security model offers a robust solution. It provides a proactive approach to safeguarding critical infrastructure, protecting against cybersecurity threats, and ensuring the safety and reliability of our water supply. 

By implementing Zero Trust, water utilities can build a resilient defense against potential breaches and provide a secure environment for remote system management. 

---

Traditional VPNs: An Aging Technology

VPNs have long been the standard for secure remote access.

By virtue of being private, they create a point-to-point tunnel with encryption to secure data transmission between networks, effectively routing between a plurality of networks securely. This effectively shields the data from external threats when transiting over insecure links or the Internet. However, while VPNs offer a certain level of security over the tunnel itself, they are not without their vulnerabilities:

• VPNs operate on the principle of ‘trust but verify’, a model of implicit trust that can lead to significant security risks. If an attacker manages to gain access to the VPN, they can move laterally across the network, potentially causing significant damage. In this approach, the traffic remains secure over the VPN but the traffic payload itself has become malicious.
• VPNs often lack granular access controls, meaning that once a user is inside the network, they often have access to more resources than necessary. And when these controls are available, they are often complex and require frequent updates.
• VPNs can also be complex and cumbersome to manage, requiring detailed configurations and continuous management. This exposes an organization’s security posture when their configurations become out of sync with the latest security best practices.
• VPNs also often lead to complications with firewall rules and access control lists. This complexity not only places a significant burden on IT teams but also increases the likelihood of configuration errors, which can lead to security vulnerabilities.
• Efforts to simplify and make VPN usage more efficient through techniques such as split tunneling have been demonstrated to be a potential and exploitable attack surface for nefarious actors.

The True Cost of VPNs

But surely VPNs are budget-friendly, right?

Traditional VPNs may appear cost-effective, but hidden costs from security breaches, user frustration, and IT management can quickly add up from a financial and reputational perspective. Let’s delve deeper into what these hidden costs could look like:

Security Breaches

The average cost of a security breach through a VPN can be substantial. Assuming that a company with around 200 employees experiences two security breaches per year, each costing $50,000 in damage and mitigation efforts, the total cost would be $100,000. This doesn’t even account for the potential damage to a company’s reputation and customer trust, which can be immeasurable.

User Frustration

Traditional VPNs can often frustrate remote employees due to the need to manually connect and disconnect based on their remote location and tasks. If each remote employee spends about 15 minutes daily dealing with VPN-related connection and access issues, this translates to 6,500 hours lost annually for an organization with 100 remote employees. Assuming an average hourly rate of $25 for these employees, this results in $162,500 lost annually due to user frustration.

IT Management Overheads

Managing traditional VPNs is a continuous and tedious process. Assuming IT teams spend around 10 hours weekly managing VPN configurations, troubleshooting connectivity issues, and addressing firewall rule changes, this accumulates to 520 hours per year. With an average hourly rate of $40 for IT specialists, the annual cost of IT management for VPNs reaches $20,800. Not to mention, these management tasks also carry the risk of human or configuration errors that can compromise security and increase costs further.

Add all of this up, and the true total cost of a VPN can be as high as $283,300 per Year.

Zero Trust: The Future of Secure Remote Access

In contrast to traditional VPNs, Zero Trust Network Access offers a fundamentally different approach to secure access. This architecture operates on the principle of ‘never trust, always verify.’ Every user and device, whether inside or outside the network, is assumed to be a potential threat. Every access request is treated as originating from an untrusted network, and the identity and level of permission of the user or device must be verified before access is granted. This effectively removes the traditional network perimeter where users and devices are implicitly trusted.

As a result, the overall attack surface is reduced because the concept of trust has been eliminated from the network altogether. There is no implicit trust granted to users or devices based on their network location or login credentials. Instead, access is automatically granted based on the user’s identity and the context of the access request. 

This approach significantly enhances security by preventing unauthorized access, even from within the network. In addition, Zero Trust implementations simplify the management of remote access by eliminating the need for complex VPN configurations and firewall rules, ultimately reducing the burden on IT teams.

Zero Trust vs. VPN: At a Glance

When it comes to infrastructure network security, Zero Trust significantly outperforms traditional VPNs in a number of ways: 

VPNS	Zero Trust
Operate on a ‘trust but verify’ model that typically grants access at the network layer, leading to potential security risks and lateral movement within the network.	Built on a ‘never trust, always verify’ philosophy, continuously verifying the identity of users and devices, preventing unauthorized access.
Can be complex and frustrating for end users, requiring them to repeatedly manage connections based on where they are and what they’re doing.	Provides a seamless user experience, eliminating the need for manual connections and granting access to only the necessary resources across networks.
Requires tedious and constant attention, making it easy for configuration errors to occur and persist.	Simplifies remote access management, eliminating the need for complex configurations and reducing the burden on IT and OT teams.

Getting Started with Agilicus

As the network security landscape continues to evolve, it’s clear that the ‘trust but verify’ model of traditional VPNs is no longer sufficient to maintain security best practices on IT and OT networks. As we’ve described in detail above, the ‘never trust, always verify’ approach offers a more secure, efficient, and manageable alternative. 

While traditional VPNs have served us well in the past, the increasing sophistication of cyber threats necessitates a more robust and secure solution. Agilicus’ Zero Trust solution, with its superior security, simplified management, and granular access control, offers a compelling alternative for IT and OT professionals. By choosing Agilicus, you’re not just choosing a product; you’re choosing a partner committed to securing your network and safeguarding your data.

Discover the transformative impact of our client-less Zero Trust Architecture to safeguard your critical infrastructure, simplify access, and reduce the burden on your team. 

---

Secure Shell (SSH) is no ordinary protocol. 

As its name implies, it’s secure, but also reliable, and has the built-in ability to encrypt data while ensuring authentication. 

However, challenges arise when you need to provide exclusive access to a particular resource via SSH alone.

The SSH Conundrum

More often than not, you’re struggling to find a proper gateway protocol ‘jump box’ for SSH, and unlike a straightforward reverse proxy, SSH ends up exposing the entirety of a host. This ‘all-or-none’ issue then results in the necessity for a public IP to map inbound connections into your private network.

Imagine having a battalion of virtual machines, each needing access from a set of remote users. These users could be vendors, contractors, or simply temporary staff. Without a standard mechanism in place to handle this, things can get messy pretty quickly.

Next on the list of issues is the question of two-factor authentication (2FA). While HTTP-based protocols have their own well-understood methods for 2FA, integrating this into SSH is often an uphill task. It’s complex and something most people aren’t used to or give up trying altogether. 

What if there was a simpler way to secure your SSH access points without grappling with jump box complexities, 2FA setup hassles, or needing to expose the services to a public IP at all?

Zero Trust: The Simple Solution

Zero-Trust Networking Access might be the answer you’re looking for. When implemented, it becomes possible to provide SSH for remote access to your pool of hosts for anyone, regardless of their identity provider.

The best parts? The extra layer of security provided by enabling 2FA eliminates the need for public IP mapping to internal hosts and maintains end-to-end encryption.

SSH then becomes straightforward: Users can directly log into the hosts, all while ensuring that security remains intact.

Ready to Learn More?

This novel approach of deploying SSH with Zero Trust can be achieved with ease with Agilicus. Get in touch with us to learn how you can simplify your systems administration without compromising on security.

Enabling Zero Trust Architecture to streamline Rockwell Automation remote PLC access without requiring a VPN improves security while still allowing your crucial users to remotely access systems for critical client support. In this piece, we’ll explore the security implications of legacy VPNs and delve into how Rockwell Studio 5000™ suite can be used remotely, sans VPN, to securely and easily program industrial devices like PLCs.

---

In today’s evolving manufacturing landscape, straightforward and secure access to Programmable Logic Controllers (PLCs) is pivotal for optimizing production processes.

Ensuring seamless remote PLC access is becoming more of a necessity for many organizations. However, achieving top-tier security best practices without sacrificing efficiency can be challenging, mainly due to the inherently broad access challenges associated with Virtual Private Networks (VPNs) and other outdated security approaches. 

The VPN Challenge

VPNs have been the traditional choice for secure remote access for over 25 years. And they have proven to be effective in securing data transmission between remote users and the central network. However, they have some notable drawbacks, especially in Industrial Control Systems’ programming:

1. Security Vulnerabilities: OT systems must live on an air-gapped network. However, industrial air-gapping often prevents or limits just-in-time access to OT and industrial control systems, leading to long repair cycles, customer complaints, increased costs, and workarounds. Keeping these systems off the public internet remains essential to prevent risks, but leveraging an antiquated VPN for vendor and remote access can actually compromise your air gap, by bridging disparate networks together, ultimately leaving these vital systems vulnerable to cyber threats.
2. Complex Setup: Setting up a VPN can be complex and time-consuming when defining security rules at the network layer, requiring IT expertise that many manufacturing engineers may not possess.
3. Performance Issues: VPNs can introduce latency and reduce network performance, potentially impacting real-time control and PLC monitoring.
4. User Experience: VPNs can be cumbersome for end-users, requiring them to install and configure additional software on their devices.

VPNs are also limited in the security they offer. While the perimeter protection model they offer is based on establishing a secure boundary around a trusted network, the concept is no longer ideally suited to the distributed nature of today’s Industrial Control Systems. This approach also lacks the requisite flexibility, visibility, scalability, and user-friendly experience that modern manufacturers need.

In particular, the challenge posed by using the Rockwell Automation suite of software such as FactoryTalk™ Linx Browser (FTLinx), or RSLinx™ Classic to access PLCs within an Industrial Control System facility should be facilitated by a solution that makes EthernetIP connectivity to remote PLCs transparent to the user and the underlying software tools, which maintaining performance and security.

Embracing A VPN Alternative Remote PLC Access

The ideal way to achieve PLC access is through a Zero-Trust security model, not a VPN providing connectivity to everything.

Implementing Zero Trust in OT requires a thorough understanding of all assets and resources. With this knowledge, companies can apply granular security controls, prioritize continuous authentication (especially for vendors and other partners), and enforce protection at multiple network points. 

In contrast to a VPN approach, a VPN alternative approach built on a foundation of Zero Trust provides considerable advantages:

Heightened Security

Enabling Rockwell Automation remote PLC access through Zero Trust fortifies the entire OT network and its PLCs against cyber threats. By leveraging modern features like role-based access control, end-to-end encryption, micro-segmentation, and two-factor authentication, you can safeguard these systems from unauthorized access. With this in mind, it becomes possible to use clients such as RSLinx™ and RSWho and seamlessly combine them with two-factor authentication.

Simplified Remote Access

Zero Trust, when implemented well, greatly simplifies remote access without compromising security. For example, Agilicus achieves this by enforcing user authentication (both internal and external) with the existing identity provider such as Azure/Office 365 or Google Suite login. And it only grants users access to the resources they need to do their work with the least amount of continuously validated privileges. When enabled, an organization can choose who gets to access PLCs with Rockwell Studio5000™, and what operations they can undertake.

Enhanced Productivity

In manufacturing, downtime equals lost revenue and time. A VPN alternative, Zero Trust-based environment boosts productivity and efficiency. It elevates the user experience and maintains strong network performance to streamline operations while ensuring unparalleled transparent security in the process. The end user can not access multiple PLCs across multiple sites without the need to re-establish VPN connectivity to individual locations. PLCs can even be deployed with overlapping internal IP address spaces on a site-by-site basis and still be accessible.

Cost-Efficiency

Shifting from a VPN infrastructure to a VPN alternative setup is economical. VPNs often demand investments in hardware, software, and maintenance. Transitioning away saves capital and operational costs.

See Zero Trust in Action: On-Demand Rockwell Automation Remote PLC Access Platform Showcase

Enabling VPN alternative Rockwell Automation remote PLC access within a Zero Trust model offers comprehensive benefits that extend beyond remote access alone. At Agilicus, we maximize easy access to your PLCs for employees and vendors alike while strengthening security in the process. 

Witness its prowess in our on-demand platform showcase and explore how the Agilicus Zero Trust solution can redefine your manufacturing operations.

In “Your VPN Hates Your Video Conferencing. Here’s Why” I discussed why VPN’s often very negatively impact the performance of non-corporate applications. End users often complain of performance on YouTube, performance on video conferencing, VoIP issues, etc. But VPN users also complain, since the corporate network upstream becomes their downstream, and someone else watching Netflix reduces the performance of all users.

In each case, the reason is the same: in order to safely operate VPN, you must force all of the traffic into it. Companies often sacrifice security for performance by running what is called a ‘split horizon’ VPN. In a nutshell, a split-horizon VPN cherry-picks certain routes, forcing those to route into the VPN, but allowing others to use the default route, the default ISP. The end user may see this as better (since the performance is improved) but the security is dramatically reduced.

In “Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables“, the authors show just how dramatically that security is reduced. In particular, they note that 100% of VPN’s tested on iOS were insecure.

The attack vector is the routing table. Networks route to the most specific route (longest-prefix match). The corporate VPN, once configured for split-horizon, has a set of more-specific routes. A local ISP, wifi provider, etc, can in turn advertise even more specific routes, causing that traffic to be captured, altered, inspected…. things you do not want.

Is there a better solution? If the full-route VPN is too slow, and the split-horizon VPN is too weak, what should you do? We recommend a Zero Trust solution. In Zero-Trust Makes Working From Home Secure And Reliable, Unlike VPN, we discuss how making each resource available as its own, public endpoint, with appropriate authentication and authorisation, provides better performance, stronger security, simpler use. Everybody wins.

Read more of the Tunnelcrack paper including the author’s summary here.

Water and wastewater facilities have relied on Virtual Private Networks (VPNs) for years. 

But how secure are they, really? 

The short answer is they aren’t. 

The longer answer is that as the number and complexity of security threats continue to increase exponentially, VPNs and other traditional network access tools simply can’t keep up with modern solutions. This should be especially concerning for water and wastewater facilities as critical infrastructure services like these are being increasingly targeted by cyber attacks.

In this article, we’ll help you understand the risks and what to do instead so you can protect your critical infrastructure and the community you serve. 

Security Risks for Water and Wastewater: Why VPNs Leave You Open to Cyber Attacks

VPNs leave your water and wastewater facilities vulnerable to cyber threats for several reasons: 

Insufficient Access Control

VPNs allow remote access to the facility’s entire network, which can be convenient for remote monitoring and maintenance tasks. However, if unauthorized individuals gain entry to the network, they could potentially control or manipulate your critical water networks. 

Inadequate Security

VPNs often rely on poorly configured and outdated encryption protocols to protect data transmitted over the network. This can create significant security vulnerabilities and potentially expose sensitive data or allow malicious actors to intercept and manipulate network traffic.

Vulnerable to Insider Threats

VPNs can also inadvertently provide an opening for insider threats. Malicious insiders, such as disgruntled employees or contractors, can abuse their access privileges to laterally traverse your network and sabotage or compromise critical infrastructure systems.

Lack of Network Segmentation

Water and wastewater facilities typically have complex and interconnected networks that include various operational technology (OT) systems. A VPN may not have the secure segmentation needed to prevent unauthorized access to critical systems via the VPN. 

Dos and Don’ts

• Don’t overlook VPN software vulnerabilities: Stay informed about potential vulnerabilities and exploits related to the VPN software you are using. Regularly check for updates and security patches released by the vendor, and promptly apply them to protect against known vulnerabilities.
• Don’t rely on VPNs for security: Better yet, don’t use a VPN at all! While VPNs are often used in water and wastewater facilities to provide an additional layer of security, they aren’t an effective modern solution. 
• Do leverage Zero Trust instead: Instead, switch from a perimeter-based (firewall and VPN) model of access to a user-to-resource model through Zero Trust. It’s simpler and more secure. 
• Do Enforce Strict Access Controls: Implement granular access controls to ensure that only authorized individuals can connect to your network. Regularly review and update access privileges to prevent unauthorized access and regularly revoke access for employees or contractors who no longer require connectivity. 
• Do implement strong authentication: Ensure that strong authentication mechanisms (like multi-factor authentication) are leveraged as much as possible to verify the identities of users attempting to access your network. This adds an extra layer of security and helps prevent unauthorized access. 

Transition Your Water and Wastewater Facilities to a Zero Trust Architecture with Agilicus

Now that you know the risks and the best practices, how do you transition to a Zero Trust architecture?

Well, with Agilicus, you can leverage Zero Trust to deploy a robust, seamless solution in just one hour with no disruption to your operations and no VPN. 

Here’s How We Do It: 

Agilicus grants access to specific resources based on stringent authentication and authorization principles, rather than allowing broad access to your entire network (like a VPN would). This significantly reduces the damage a cyber attacker can do once they’re inside your network and eliminates the risks associated with lateral traversal entirely. 

We also make it easy to proactively defend your critical infrastructure too by enforcing multi-factor authentication, eliminating shared credentials, (which we discussed in more depth in part one of this series), and providing comprehensive visibility into the network. This allows your IT team to detect and respond to potential threats promptly. 

Finally, Agilicus gives your remote workers and third-party vendors secure access to only the resources they need to do their work. This restricts them from accessing the rest of your network, further securing your systems. We also allow you to enforce strong security measures on their third-party devices to prevent anything from being introduced to your network. 

Discover the Agilicus Difference

Learn more about how Agilicus can help you implement a Zero Trust Architecture here. Or, check out this case study to learn how we helped a municipality secure its water treatment facility’s operational technology.

You probably know about the significant risks sharing credentials poses for your water and wastewater facilities. 

But you may not know that over 80% of hacking-related breaches can be attributed to weak or stolen credentials. 

This is especially concerning for water and wastewater facilities. After all, these organizations provide invaluable services that our communities depend on. 

Moreover, these facilities heavily rely on both information technology (IT) and operational technology (OT) systems to ensure smooth operations. If these systems are compromised, it could result in service disruptions or worse, a harmful impact on your organization and the people you serve. 

By eliminating shared credentials, you can avoid these risks and consequences. You’ll be protecting your systems from unauthorized access while significantly reducing the risk of a cyber attack. 

The Risks of Using Shared Credentials in Water and Wastewater Facilities

Shared credentials leave you vulnerable to cyber threats for several reasons: 

Lack of Accountability

When multiple people share the same credentials, it becomes difficult to establish individual accountability for actions performed within the system. If an unauthorized or malicious activity occurs, it becomes challenging to identify the person responsible. This lack of accountability hinders effective incident response and can delay or impede the investigation of security breaches.

Increased Vulnerability to Insider Threats

Insider threats occur when individuals with authorized access to a system misuse their privileges. Shared credentials make it challenging to trace unauthorized activities back to specific individuals. In a water and wastewater facility, insiders could potentially manipulate critical systems, disrupt operations, or cause damage to infrastructure. Shared credentials make it difficult to attribute such actions to a particular person, increasing the risk of insider threats going undetected.

Limited Access Control

Shared credentials often lead to a lack of granular access control. Different users within a water and wastewater facility may have varying roles, responsibilities, and authorization levels. By sharing credentials, there is no way to differentiate between users or enforce fine-grained access restrictions. This means that an individual with shared credentials might have more privileges than necessary, increasing the potential impact of any security breach or unauthorized activity.

Weakened Password Hygiene

Shared credentials typically require passwords to be known by multiple individuals. This often leads to poor password hygiene practices. Passwords may be shared through insecure channels, written down and left in plain sight, or stored in easily accessible files, increasing the risk of password compromise. Weak or easily guessable passwords may also be used, further undermining the security posture of the system.

Difficulty in Revoking Access

When shared credentials are used, revoking access for specific individuals becomes challenging. If one person’s access needs to be revoked due to a change in employment, termination, or any other reason, it requires changing the shared credentials and distributing the new credentials to everyone else. This process is cumbersome, time-consuming, and prone to errors, potentially leaving revoked individuals with continued access to critical systems.

What Not to Do

• Don’t give out new usernames, IDs, or passwords for each application: Instead, leverage single sign-on using your Microsoft or Google workplace accounts whenever possible so everything is connected to one account, not 20. This also makes it easy to revoke access. 
• Don’t give out clients and VPNs: Clients and legacy access technologies like VPNs don’t provide sufficient security against modern cyber-attacks. Implementing a Zero Trust architecture not only protects your systems but also helps you align with EPA cybersecurity recommendations. 
• Don’t forget about multi-factor authentication: Multi-Factor Authentication is the strongest protection against phishing, identity theft, and other account-takeover attacks. In the case that credentials are compromised, it can be the failsafe that stops a cyber attack in its tracks.

How Agilicus Eliminates Shared Credentials in Water and Wastewater Facilities

Now that you know why you should eliminate shared credentials, here’s how you can do it with Agilicus. 

For simplicity, let’s use a common scenario of a decade-old application as an example. This particular application doesn’t participate in any of this new mumbo-jumbo cybersecurity stuff and the organization can’t get rid of it because it’s necessary for business operations. 

In this example, Agilicus solves this challenge by putting our platform – which is known as an identity-aware web application firewall – in front of the legacy application. 

This accomplishes a few things. First, it makes it easier for your users to access the resources they need with a one-click single sign-on experience. That means no more memorizing new passwords and a consistent login experience every time. And more importantly, it makes it more difficult for hackers to spear phish you with random forms that ask for your user’s passwords, thereby significantly reducing the risk of compromised credentials. All of this happens without any changes to your existing network or configuration. 

In addition to removing shared credentials, Agilicus’ platform also strengthens the security of your water and wastewater facilities in other ways, including: 

• Multi-factor authentication, which you can enforce for all your systems, even on legacy applications (like the one in the example mentioned above) or for your third-party vendors.
• Vendor access management with centralized managed permissions
• Granular, audible administrator control so you can see who accessed what, when, and from where.

Want to learn more? Check out this on-demand webinar hosted by our CEO, Don Bowman, for a deeper dive into how Agilicus can help you eliminate shared credentials. 

Or, if you want to see specifically how Agilicus can help water and wastewater facilities like yours, read this case study about how we helped a municipality secure its water treatment facility’s operational technology. 

In the past, organizations relied on perimeter security to protect their networks.

This meant that they built walls around their networks and only allowed authorized users to access them: access everything or nothing.

However, this approach is no longer effective.

With the rise of cloud computing, mobile devices, and remote work, the perimeter of the network has become increasingly porous. This makes it easier for attackers to gain access to networks. We now have the ironic situation of making it harder for legitimate users while lowering security for the illegitimate.

There has to be a better way.

And there is: Zero Trust Network Architecture.

Zero Trust Network Architecture is a new approach to network security that is designed to address the challenges posed by the modern threat landscape. Zero Trust Network Architecture assumes that no user or device is trusted by default. Instead, all users and devices must be authenticated and authorized before they are allowed to access any resources on the network.

There are three key things you need to ensure in order to have a Zero Trust network architecture:

• Who: Who is this actor (person, system) proposing to do something with my systems?
• What: What is this actor entitled to do on a specific system?
• How: How will I get the traffic from the actor (the Who) to the resource?

Rephrased, the three key things are:

• Unified authentication: A single authentication mechanism for all users and devices. This makes it easier to manage authentication and reduces the risk of passwords being compromised. Unify the authentication across multiple types of users, and multiple types of identity. Allow a contractor, a temp, or your peer in a joint venture each and all to have a single sign-on without a new account or identity.
• Precise authorization: A VPN is the definition of imprecise. You are all-on, or all-off. Precise authorization to control access to resources individually, with roles. Can you edit the Wiki? Or only read it? This means that users are only granted access to the resources they need to do their job with the least privilege. This helps to reduce the risk of unauthorized access to sensitive data.
• Simple access: A simple and user-friendly access experience. This makes it more likely that users will follow security best practices. Make multifactor and single-sign-on ubiquitous. Make it work regardless of network, regardless of device. Overlapping IPs and lack of public IP should be immaterial.

Zero Trust Network Architecture is a powerful security architecture that can help organizations to protect their networks from attack. By implementing Agilicus AnyX, organizations can reduce the risk of data breaches, improve their security posture, and save money on security costs.

Here are some of the benefits of using Agilicus AnyX:

• Increased security: Increase the security of your network by assuming that no user or device is trusted by default. This makes it more difficult for attackers to gain unauthorized access to your network, and, if they do, they cannot travel laterally. Defense in Depth.
• Reduced risk of data breaches: Reduce the risk of data breaches by preventing unauthorized users from accessing sensitive data.
• Improved user experience: Improve the user experience by providing a simple and user-friendly access experience, browser-first, and device-agnostic. This makes it more likely that users will follow security best practices.
• Reduced security costs: Reduce security costs by consolidating security infrastructure and eliminating the need for multiple security products. Implement multifactor policies in an Identity-Aware Web Application Firewall to provide ubiquitous audit without rework of existing systems.

If you are looking for a way to improve the security of your network while simplifying the end-user experience, Agilicus AnyX is the best option.

Learn more: https://www.agilicus.com/what-we-do/

Securing industrial operational networks has become a serious business in recent years. 

And rightfully so. 

One needs to only remember the now-infamous Colonial Pipeline cyberattack on May 7, 2021, which led to 5,500 miles of pipeline – 45% of the United States’ east coast’s fuel supplies – being shut down for nearly a week. 

The impact cannot be overstated. About 12,000 gas stations were directly affected by the shutdown until operations were restored on May 13, 2021. 

This is a high-profile example, but unfortunately not an unusual one. Cyber attacks and attempted breaches on industrial facilities have increased exponentially over the past 5 years. They are predicted to continue on the same trajectory for facilities that fail to update their security measures.

There’s no doubt the threat level and danger are high for industrial networks. But thankfully there are measures you can take to mitigate the risks and better protect your systems. 

If you rely on third-party vendors or other external users, Vendor Access Management is something you should consider implementing to secure your critical industrial systems against threats like the one that threatened Colonial Pipeline.

What is Vendor Access Management?

Vendor Access Management is a specific application of a broader concept called Privileged Access Management, the strategy and processes for controlling, managing, and monitoring privileged access to essential systems, networks, and data. It ensures that only authorized individuals have access to your sensitive resources, significantly reducing the risk of unauthorized access and potential data breaches.

In the context of vendor access, Privileged Access Management empowers these external users with the ability to securely access an organization’s resources while extending robust cybersecurity measures to all vendor interactions with the enterprise, going beyond traditional perimeter defenses.

By implementing Vendor Access Management, the Principle of Least Privilege is enforced for vendor remote access. Additionally, this approach typically incorporates various Zero Trust controls for vendor access, such as continuous authentication, just-in-time access provisioning, and behavioral session monitoring and management.

How Vendor Access Management Improves Industrial Network Cybersecurity

Vendor Privileged Access Management plays a crucial role in enhancing industrial network cybersecurity by providing control and oversight over the privileged access granted to vendors or third-party entities. It helps mitigate the risks associated with providing vendor access to critical systems and infrastructure, ensuring the integrity, confidentiality, and availability of industrial networks. 

Here’s how it can improve industrial network cybersecurity:

Granular Access Control

Vendor Privileged Access Management enables organizations to define and enforce granular access controls for vendors. It ensures that vendors have only the necessary access privileges required to perform their specific tasks and limits their access to sensitive systems or data. By minimizing unnecessary privileges, the attack surface is reduced, lowering the risk of unauthorized access or malicious activities.

Secure Remote Access

Industrial control systems often require vendors to access critical systems remotely for maintenance, troubleshooting, or support purposes. Vendor Privileged Access Management provides secure remote access mechanisms, especially when used in tandem with a Zero Trust Architecture, that authenticates and authorizes vendor connections. It ensures that all remote access sessions are encrypted, logged, and audited to prevent unauthorized access and so you can keep a finger on the pulse of any suspicious activities.

Strong Authentication and Authorization

Vendor Privileged Access Management enforces strong authentication methods, like multi-factor authentication. This requires vendors to provide multiple proofs of identity before being granted access. Additionally, it verifies vendor credentials and authorizations against predefined policies and access rules, preventing unauthorized vendors from accessing critical systems or resources without permission. 

Monitoring and Auditing

Continuous monitoring and auditing of vendor activities within industrial networks provide real-time visibility into vendor sessions. This allows organizations to track what actions vendors are taking, commands executed, and the changes they make. If any unusual or suspicious behavior is detected, you can take immediate action to mitigate any potential threats.

At its core, Vendor Privileged Access Management strengthens industrial network cybersecurity by providing controlled, monitored, and audited access for vendors. It reduces the risk of unauthorized access, insider threats, and potential disruptions caused by vendors while ensuring the integrity and availability of critical systems and data.

Vendor Privileged Access Management Best Practices for Industrial Systems

Develop Comprehensive Vendor Access Policies

It’s important to clearly outline the rules, responsibilities, and acceptable use of privileged access. These policies should define the scope of access, authentication requirements, session recording, and any other relevant guidelines.

Apply the Principle of Least Privilege

Use the Principle of Least Privilege to grant vendors only the minimum privileges necessary to perform their specific tasks. Avoid granting excessive access rights that could increase the attack surface and potential risks.

Empower Your Vendors with Simple, Secure Remote Access

Utilize modern secure remote access mechanisms instead of deprecated approaches like VPNs or Teamviewer. These connections should be encrypted, require strong authentication, and be monitored and continuously auditable.

Enforce Multi-Factor Authentication

Multi-Factor Authentication is one of your best tools for reducing cyber risks, and for vendors, it’s no different. We strongly recommend enforcing multi-factor authentication for vendor access to ensure strong authentication. You must avoid any new usernames or passwords as the risk of shared credentials being compromised is not a risk you should take. Agilicus’ Zero Trust platform enables your vendors to use their existing identity provider and means of logging in so you don’t have any credentials floating around that you aren’t aware of. Our solution also allows you to enforce multi-factor authentication, even on non–participating systems (you can learn more about that here).

Continuous Monitoring and Auditing

Implementing real-time monitoring and auditing capabilities allows you to track vendor activities as part of your Governance, Risk Management, and Compliance strategy. Taking advantage of this allows you to monitor sessions, commands executed, and changes made by vendors within the industrial network. This helps detect any suspicious behavior, anomalies, or security incidents promptly so you can respond immediately. 

Strengthen Your Industrial Network Cybersecurity with Agilicus

At Agilicus, we know how hard it important it is to implement Vendor Privileged Access Management without disrupting vital business operations. That’s why we’ve streamlined vendor management to strengthen your cybersecurity without any downtime or network changes. Learn more about what we do and why our vendor access management solution is a no-brainer for your organization.

Or check out this recent webinar our CEO, Don Bowman, recently ran for an in-depth look into how our platform solves vendor access for industrial networks. 

In this article, we’ll provide a high-level overview of the CISA Zero Trust Maturity Model, the recent changes made in version 2.0, and how it can benefit your organization. 

As an IT leader, there’s a lot of responsibility on your shoulders to protect your critical systems against cyber attacks. 

You need to protect sensitive data, meet specific cyber insurance requirements, and reduce risk. 

No pressure. 

Thankfully, there are already several different frameworks available to use as a roadmap for evaluating and improving your security posture. 

In this blog post, we will delve into the CISA Maturity Model in particular, how it can benefit your organization, and how it compares to its predecessor.

What is the CISA Maturity Model?

The CISA Maturity Model is the federal government’s answer to the increasing number of cyber threats and risks. It is a voluntary guideline developed by the Cybersecurity and Infrastructure Security Agency (CISA) to help organizations evaluate and improve their cybersecurity posture. 

In it, CISA outlines five different levels of ‘maturity’: 

• Level 1 – Partial: At this level, the organization has limited awareness of its cybersecurity risks and has not implemented any formal cybersecurity practices.
• Level 2 – Risk-Informed: At this level, the organization has started to identify its cybersecurity risks and has established some basic cybersecurity practices.
• Level 3 – Repeatable: At this level, the organization has established a formal cybersecurity program and has implemented a set of standard cybersecurity practices that are consistently applied across the organization.
• Level 4 – Adaptive: At this level, the organization has established a dynamic and flexible cybersecurity program that can respond to changes in the threat landscape and business environment.
• Level 5 – Risk-Optimized: At this level, the organization has fully integrated cybersecurity into its overall risk management strategy and is continuously monitoring and improving its cybersecurity posture.

Why Should You Use It? 

There are many advantages of the CISA Maturity Model: 

• By using this model, your organization can identify and address weaknesses in your cybersecurity program. This can lead to a more robust security posture that can better protect against cyber threats.
• It also provides a standardized framework for assessing your cybersecurity capabilities. This can help organizations benchmark their cybersecurity program against industry standards and identify areas for improvement.
• The maturity model is a voluntary guideline, which means you can choose to adopt only the components that are relevant to your needs. This can make it an effective and flexible solution. 
• Finally, it aligns well with other cybersecurity frameworks and regulations, such as the NIST Cybersecurity Framework, the EU General Data Protection Regulation (GDPR), and ISO 27001. By implementing the CISA Maturity Model, organizations can better meet regulatory requirements.

What Changes Were Made in Version 2.0?

CISA Maturity Model Version 2.0 builds on the previous CISA Cybersecurity Framework, which was initially released in 2021. The new version includes several updates and improvements, including: 

• Notably, it now covers a broader range of cybersecurity domains, including identity and access management, supply chain risk management, and vulnerability management.
• Version 2.0 provides more detailed guidance on how to implement the framework, including how to measure cybersecurity maturity and develop a roadmap for improvement.
• It provides more flexibility for organizations to tailor the framework to their specific business needs.
• The CISA Maturity Model 2.0 places a greater emphasis on risk management, including identifying and mitigating cyber risks and developing a risk management strategy.

Conclusion

By understanding the CISA Maturity Model and how it can help your organization, you can decide if it’s the right framework for your team to align with.

But unfortunately, implementing a Zero Trust Architecture to align with this framework is often far from easy.

With this in mind, here’s a case study you might find interesting about an organization that quickly enabled secure access to resources through Zero Trust.

In this article, I’ll help you understand NIST 800-207, Zero Trust, and how to meet the standards mandated by the US federal government’s recent cybersecurity mandate.

Today, your critical systems are more vulnerable than ever to cybersecurity threats. 

We’ve all heard this before. News of organizations falling victim to ransomware attacks is all too common. But what you might not know is why we continue to see organizations fall victim to ransomware and other similar attacks. 

In a 2021 CISA report, the top three initial infection vectors for breaches were phishing, credential theft, and vulnerabilities. 

The common thread? All of them had the common root cause of unauthorized resource access.

The Problem with ‘Castle and Moat’

Protecting your organization against this problem isn’t always so simple, however. For a long time, legacy network solutions like the VPN used a traditional castle and moat architecture of protecting your perimeter and stopping the bad guys from entering your sacred space. The thinking was that if you can control who comes in, you can trust everyone within your network. Bad people out there. Good ones in here. 

And that served us well for many years. But the modern network doesn’t have clear boundaries. The castle and moat approach fails when what you need to protect is outside your castle. 

What is Zero Trust? 

This is where a Zero Trust Network Architecture (ZTNA) shines. Whereas a traditional perimeter typically takes a “Trust, but Verify” approach, Zero Trust asserts that nothing should be implicitly trusted – not your identities, devices or even your network components.

Because information and resources are segmented into smaller ‘buckets’, users are given access to the least amount of data they need to do their job. This approach severely limits the amount of damage that an intruder can do because the pool of data that they can see and access is much smaller. 

This ultimately prevents attackers from gaining access to systems and users that will help them advance deeper into the network (a technique commonly known as lateral movement).

Despite the stronger security that comes with Zero Trust, the concept is still a relatively new one. It was only when organizations began making the rapid shift to remote-first or hybrid workforces in 2020 as a result of the COVID-19 pandemic that organizations began to take Zero Trust seriously. 

NIST’s Response

In response to this evolving cybersecurity landscape, the National Institute of Standards and Technology (NIST) published Special Publication (SP) 800-207, Zero Trust Architecture in 2020. 

Even today, it stands as the gold standard for understanding the requirements, challenges, and nuances of implementing Zero Trust. 

Although other federal bodies like NSA and CISA have published their own guidance and recommendations, we will focus specifically on NIST 800-207 in this post. We will give you an overview of the document and the different ways of implementing ZTNA so you can meet the guidelines and improve your organization’s security posture. 

What is Included in NIST 800-207?

In a world where remote work prevails and traditional network defenses are increasingly ineffective, NIST SP 800-207 provides enterprises with systematic guidelines for updating their network cybersecurity 

The document itself (which you can read here) lays out a clear, albeit abstract definition of Zero Trust, which has been key to standardize the concept. That being said, this definition has been left purposely vague to let organizations decide how best to implement it within their organization. 

NIST clearly understood that this could also spark some confusion, so the special publication also lays out common components of a Zero Trust Architecture, as well as the ways it could interact with existing federal guidance (more on that below). 

Perhaps more importantly, NIST 800-207 gives you general deployment scenarios and different use cases where Zero Trust so you can see how it can improve your overall information technology security posture.

How does NIST 800-207 define Zero Trust?

Why It Matters

I’ve talked a lot about the increased security that Zero Trust brings to organizations like yours, especially with increasingly distributed users, resources, and systems. 

The federal government has also noticed the value of NIST 800-207 and the benefits of Zero Trust. So much so that on January 26th, 2022, the US government issued a memorandum that formally established a federal strategy for implementing Zero Trust across the country. 

It requires that government agencies move to Zero Trust by the end of Fiscal Year (FY) 2024. 

With recurring references to NIST 800-207, this mandate sent a clear message: Zero Trust is the future of cybersecurity for critical infrastructure. 

With this order in place, similar protective regulations will likely also be mandated at the state and local levels of government in the coming weeks and months. We have already seen some of these mandates from some agencies (like the Federal Aviation Administration) following high profile incidents. 

With a tight 2024 deadline, it’s vital for government agencies and public bodies to meet the standards set out in NIST 800-207 as soon as possible. 

How to Align Your Organization with NIST 800-207

As I mentioned, there are many different ways you can set up a Zero Trust Architecture to satisfy the guidelines set out in NIST 800-207. 

Here are a few different approaches you can take.

The Different Approaches

Zero Trust Architecture Using Enhanced Identity Governance

In this approach, policies for enterprise resource access are created based on the identity of users and assigned attributes. Access to resources is primarily based on the access privileges granted to the user. Other factors like the device used, asset status, and environmental factors may be considered to alter the confidence-level calculation, which ultimately decides access authorization. Agilicus, for example, uses your existing native identity provider (Ex. Azure, Google, etc…) to authenticate, avoiding the need for new user names, passwords, or active directory licenses. 

This approach is typically employed in open network models or enterprise networks with frequent non-enterprise devices on the network (like vendors, for example). 

Because access to resources is restricted to identities with the appropriate privileges, this approach is typically more secure than the others mentioned below. Let’s use Agilicus as an example – our platform authenticates and authorizes you before a connection is established (you can learn more about that here if you’re curious). 

Zero Trust Architecture Using Micro-Segmentation

In this approach, individuals or groups of resources are placed on a unique network segment protected by a gateway security component. The enterprise can use infrastructure devices such as intelligent switches, routers, next-generation firewalls, or special-purpose gateway devices to act as Policy Enforcement Points (PEPs) that protect each resource or a small group of related resources. Alternatively, the organization can choose to implement host-based micro-segmentation using software agents or firewalls on the endpoint asset(s).

The gateway devices dynamically grant access to individual requests from a client, asset, or service. Depending on the model, the gateway may be the sole PEP component or part of a multipart PEP consisting of the gateway and client-side agent. This approach can be applied to a variety of use cases and deployment models, as the protecting device acts as the PEP, with the management of said devices acting as the Policy Engine/Policy Administration (PE/PA) component.

This approach requires an Identity Governance Program (IGP) to function fully, but it relies on the gateway components to act as the PEP that shields resources from unauthorized access and/or discovery. The key necessity to this approach is that the PEP components are managed and should be able to react and reconfigure as needed to respond to threats or changes in the workflow.

It is possible to implement some features of a micro-segmented enterprise by using less advanced gateway devices and even stateless firewalls, but the administration cost and difficulty to quickly adapt to changes make this a poor choice.

Zero Trust Architecture Using Network Infrastructure and Software-Defined Perimeters

This approach uses the network infrastructure itself. This can be done through an overlay network, which operates at the application layer (layer 7) or lower layers of the Open Systems Interconnection (OSI) network stack. 

These approaches are sometimes referred to as software defined perimeter (SDP) approaches and may include concepts from software defined networks (SDN) and intent-based networking (IBN). In this approach, the policy administrator (PA) acts as the network controller, setting up and reconfiguring the network based on decisions made by the policy engine (PE). 

Clients still request access via policy enforcement points (PEPs), which are managed by the PA. The most common deployment model for this approach is the agent/gateway, where the agent and resource gateway establish a secure channel for communication between the client and resource. Other variations of this model may exist, including for cloud virtual networks or non-IP-based networks.

Agilicus Can Help! 

While this post only begins to scratch the surface of NIST 800-207 and Zero Trust, you should now be equipped with a high-level understanding so you can decide how best to implement a Zero Trust Architecture for your organization. 

And although Zero Trust has many clear benefits, it can be challenging to make such an enormous shift. At Agilicus, we believe the fastest path to adoption is to make it simpler. That’s why our Zero Trust platform removes the need for a VPN, leverages your existing identity providers for secure authentication, and gives you fine-grained authorization tools to precisely manage access.

It’s the easiest way to align with NIST 800-207 while also greatly elevating your organization’s security posture. 

Curious to learn more? Check out this case study to see how we helped a municipality modernize its critical infrastructure to better enable simple, secure connectivity with precise control over privileges. 

Vendor privileged access management is the process of managing and securing the privileged access of third-party vendors who have access to an organisation’s critical systems, data, and networks. Here are some best practices for vendor privileged access management:

1. Implement Access Controls: It is important to have proper access controls in place to limit vendor access to only the systems and data they need to perform their tasks. This can include implementing role-based access controls (RBAC) and limiting access to specific times and locations.
2. Use Strong Authentication: Vendors should be required to use strong authentication methods, such as two-factor authentication (2FA) or multi-factor authentication (MFA), when accessing the organisation’s systems and networks. Do not introduce a new identity (e.g. a mirror), instead use federation to their existing employer Identity system.
3. Do no allow shared passwords (e.g. account per company)
4. Monitor and Audit Activity: Regular monitoring and auditing of vendor activity can help detect any unauthorized access or suspicious behavior. This can include logging and reviewing all vendor activity and implementing real-time alerts for any unusual activity. Audits should be fine-grained, per resource, per transaction, rather than general “accessed something in these hours”.
5. Use Secure Remote Access Methods: When providing remote access to vendors, it is important to use secure remote access methods, on a per-resource basis. Use a Zero-Trust Network architecture rather than a ‘secure’ remote desktop or VPN.
6. Train Vendors on Security Best Practices: Vendors should be required to undergo security awareness training and be educated on the organisation’s security policies and procedures. This can help ensure that vendors understand their roles and responsibilities and are equipped to handle sensitive data and systems securely.
7. Regularly Review and Update Access: Regularly reviewing and updating vendor access privileges can help ensure that access is still necessary and appropriate. This can include revoking access when vendors are no longer needed or when their contracts expire.

By implementing these best practices, organisations can better manage and secure vendor privileged access, reducing the risk of unauthorized access, data breaches, and other security incidents.