"PLEASE!!! god damn it! I hate this hacker crap!" OT Security 65 Million years in the making
Synopsis
Most people desire predictability and convenience. It is why we endeavour to automate, orchestrate, and offload complex or repetitive tasks in favour of reducing stress, accountability, and pressure. To accomplish this in the modern world we have adopted operational technology (OT) to run manual tasks and perform critical functions.
When complex, and often heavy, equipment operates within proximity of humans there is often an observed level of elevated risk. Too often these environments neglect to implement appropriate risk management planning that could help avoid additional factors of disruption.
History has recorded several lessons where a lack of proper resilience in both virtual and physical environments has led to severe impacts upon the operational capabilities of their intended function, or worse on human life.
Let us take a step back in time almost 30 years ago to find a story of an internal threat actor that can show the importance of addressing key security issues across people, process, and technology. This highly motivated individual used their intimate knowledge of a bespoke program to shut down critical operational technology for financial gain, ultimately leading to the death of many.
Being frozen in the chronicles of film history, our story and culprit are known to many. Dennis Nedry was hired as a computer programmer at Jurassic Park to automate the operational technology and critical infrastructure of the project. Technically competent, a series of events led him down a path where he was eventually tempted by financial reward to commit an act of sabotage.
How was Dennis driven to this point? Significant triggers from this story that highlight lessons learnt:
How can we learn from the incidents that played out at Jurassic Park? OT is not immune to human insider threats. With such environments often running off the knowledge of a few key individuals, it is vital that organisations act and plan appropriately to avoid similar scenarios occurring in the real world.