It seems axiomatic that a zero-day vulnerability is undefendable. At the moment a particular exploitable bit of software code is discovered by a malicious hacker and the clock starts ticking from zero-day forward, clearly, by definition, there is no protective patch or workaround yet available. And so the hacker has free rein to wreak havoc while the good guys work frantically to play catch up.

As industry readers well know, the National Fire Protection Association (NFPA) is an authority of critical importance for any organization operating or manufacturing electrical equipment and related accessories. The creator and maintainer of the ubiquitous National Electric Code (also known as NFPA 70), originally founded in 1896, is devoted to eliminating “death, injury, property and economic loss due to fire, electrical and related hazards.” The NFPA currently maintains some 300 standards, which often form defacto regulations in their product categories for states and municipalities in the United States, and, in many cases, adopted as such in localities around the world.

We’ve been seeing the trend for the better part of a decade; but, according to the annual HMS Industrial Networks’ study, 2017 has become the milestone year in which Industrial Ethernet has, as ultimately expected, finally overtaken fieldbus in numbers of new nodes installed in factory automation applications.

Securing industrial operations is a unique challenge. The same approach used to secure information technology (IT) networks can’t effectively secure plant floors. That’s because operational technology (OT) has evolved tremendously over the years, creating very complex environments consisting of a dizzying variety of devices from different makes, models and generations communicating through different protocols.

Like many specialized disciplines, the world of cyber security is filled with technical jargon that can hamper communication. In this blog, we’ll demystify some cyber security best practices and terms, as we focus on an often-overlooked factor in ICS and corporate security known as the “attack surface.” We’ll take an in-depth look at what attack surfaces are, how to keep them safe and how the human element plays a critical role in their security.