Building Secure Industrial Networks: A Conversation with Stewart Kantor

Stewart Kantor, CEO and a co-founder of Full Spectrum.

Stewart Kantor:                I’m the CEO and co-founder of Full Spectrum. We manufacture and distribute licensed wireless communications equipment for mission critical industries, such as electric and water utilities, transportation, homeland security and any entity or application where security and network reliability are of paramount importance. We can provide either a secure wireless communication network as a managed service or supply the network equipment for the customer to operate their own network using our wireless technology. The core principle behind our Company and technology is that industrial companies need higher levels of service and security for their data communications as they automate their networks using mostly IP protocol.

Hugh Taylor:                       Do you feel that IP-based architecture is a threat to industrial facilities?

Stewart Kantor:                It’s both a threat and great enabler of efficiencies. At a fundamental level, the combination of Internet Protocol and low cost micro-computing including sensor technology are enabling a great wave of innovation and efficiencies for all commercial, industrial and governmental sectors. IP networks implemented at a local plant or enterprise become very focused on internal policy control and procedures related to internal and external connectivity to the public internet.

On the other side of it, you have utilities and others that operate networks covering tens of thousands of square miles with a need to monitor and control remote assets distributed over large areas. As you extend beyond the local plant and rely on multiple service providers for network communications, the vulnerabilities increase many fold. You are now more susceptible to both service quality and security issues beyond your control. The public wired and wireless networks are more focused on volume consumer applications, and industrial users end up competing for connectivity. Consider, for example, man-made and natural disasters ranging from 9/11 to Hurricanes Harvey, Maria, Irma, Sandy and Katrina where priority for public networks is designated to getting consumer cellular connectivity up and running. Only after consumer networks are restored do we see focus shift to repairing connectivity for industrial operations. Most of these industrial customers operate in the background of our lives until there is a problem. This includes electric grids, natural gas distribution systems, water, wastewater and hazardous material pipelines, transportation like rail, and so on. This also includes governmental networks that help protect us on a daily basis.

Hugh Taylor:                       Say I’m an industrial facility like a chemical plant. Until, say ten years ago, how were the systems at that plant managed, and were they less vulnerable than they are today?

Stewart Kantor:                At some level, yes they were less vulnerable because a lot of the computing was more isolated and either machine or device-focused. It would require physically interfacing to the equipment perhaps with its own protocol. Ten years ago, it was likely that an employee would be assigned to manage a group of machines in isolation. Now with the dramatic reduction in computing power, almost every mechanical device has access to a micro-computer with some kind of communications interface. These devices can be networked with either a wireless or wired connection (Ethernet, fiber, WiFi, etc) and managed from a centralized location at the plant or perhaps now extended to the world through a WAN connection. Security and control are becoming increasingly removed from a specific location.

Hugh Taylor:                       If you were a malicious actor, of some kind, like a terrorist or foreign intelligence agent or something, are you saying that if they could get inside the network, they could affect the operation of the equipment and stuff?

Stewart Kantor:                Sure. A good example of that was the Stuxnet Virus, which was designed to disrupt centrifuge machines using the industrial SCADA protocol. Utilities and industrial companies around the world rely heavily on SCADA for monitoring and control and have since the 1960s. SCADA predated the Internet and a lot of different kinds of communications. As all the devices are networked together, small numbers of individuals, either internally or externally, can gain access to everything. It’s the networking component that raises the vulnerability.

Hugh Taylor:                       What can you do to mitigate that threat?

Stewart Kantor:                There’s a lot we can do to mitigate these threats, but you need to ask yourself some critical questions. Does your network need cloud connectivity or should you have a physical air gap between the industrial network and the public internet?  How are you impacted by the public networks for connectivity?  Most public service providers share a few locations to connect to high speed fiber connections to the rest of the world, what happens if those connections go down?  Can you continue to operate independently?  One of the advantages of our technology is that we minimize cloud connectivity for mission critical networks. The operator makes the decision if and when public WAN access is needed.

Hugh Taylor:                       What’s your feeling about the equipment itself. Do you feel that hardware can be a threat vector?

Stewart Kantor:                Well, from what I remember of Stuxnet, the software laid dormant until it was triggered by other events, so I think there are issues where there are back doors to different devices and all of those do pose risk. There are tradeoffs between those risks and the network. A lot of this is like a wave, too. It’s not going back. We are going to be a networked society. Almost every mechanical device now has the option of coming with a micro-computer and a communications interface.

Hugh Taylor:                       Do you feel that firmware on digital devices is vulnerable to being infected with malware?

Stewart Kantor:                Sure. I mean, it could be written in it at the beginning. There are all sorts of vulnerabilities where a device boots and launches malicious code. There’s been a number of occasions where issues like that have occurred.

There are also social engineering hacks that allow for someone to gain access to a critical network managed by a service provider. A malicious actor could pose as an employee of an organization or even a government employee and have a network device sent to them as a replacement.

Hugh Taylor:                       Let’s say that the phone rings and it’s the President of the United States, and he says to you, “I want to offer you unlimited money and resources and power to make the United States safer from cyber threats.” What would you do? What would you recommend?

Stewart Kantor:                I think you would start with critical infrastructure and push for minimum security precautions and guidelines for specialized applications. Most industries object to mandated policies but it may come to that. It’s important to give utilities support (either through federal funding or from local regulators in rate cases) to fund the required security. The public networks are an easy default for utilities but they are not going to offer the long term protection required. Industrial networks are different from consumer networks and it’s important to differentiate the two, ensuring they’re built for their specific needs and operations.

Hugh Taylor:                       You’re recommending that resources and attention be paid to developing specialized networks for, for example, for utilities to be able to communicate securely, and automate their equipment and stuff?

Stewart Kantor:                Exactly. The carriers, like a Verizon, AT&T, Sprint, are mostly focused on their consumer applications. The bulk of the revenue comes from consumer-based applications and so, they prioritize that over the needs of industrial customers.

Hugh Taylor:                       Do you feel that the current set of frameworks and laws and regulations and security policies are adequate to address the threats that the country faces?

Stewart Kantor:                Not yet. Many industrial companies and utilities are getting conflicting messages. For example, a publicly traded utility has to balance the needs of many stakeholders including its shareholders, customers, management, federal, state and local regulators. You must maintain secure networks, but cost is critical too. You want to prevent pushing utility rates up too much. Our country runs in a very decentralized fashion. There’s so many systems involved. Take the electric grid for instance, which is created from thousands of different utilities. There’s many different actors in some of these networks, so it requires that they all work together for the distribution of electricity. The systems are becoming much more complicated just because of technology in its own right is driving some of the complications and it’s becoming increasingly difficult to have a good handle on them since they’re evolving quickly. We’re still human actors and have an insatiable appetite for moving faster and doing new things – it’s not in our nature to try and slow ourselves down. It’s the same drive that we see when we find some new application for our phones. We often say to ourselves , “Oh, I’ll just try that out, whatever it is. Looks kind of cool and it’s got a couple of nice ratings, I’ll download it to my phone.” Meanwhile we don’t stop to consider the cyber threats or the vulnerabilities we could be opening our phones and information to.

Hugh Taylor:                       Right, and if you have a bring your own device policy, then you might connect that phone to your corporate network.

Stewart Kantor:                There’s pressure on being efficient, working and being available all the time so  you may have five or six different devices  that you work from. This then begs the question, do they all have their VPNs turned on or are you saying to yourself, “Oh well, I can’t get it through the corporate network so I’ll send it from Gmail?” These concerns go on and on and disasters are what seem to initiate any sort of change. Even then they don’t always last that long because many people immediately revert back to the old ways after the disaster has subsided. It is a cycle that we need to get ahead of.