In this blog post, we’ll examine the necessity of whitelists for industrial production facility security and the conditions required for their implementation.
Why Is Industrial Equipment Security an Issue?
Rapid technological advancement always comes with unintended consequences. The term “computer” here extends beyond simple desktop computers to include all devices—such as cell phones, ATMs, and production equipment—that use electronic circuits to perform high-speed computations, automated control, and data processing. As these devices have been introduced into industrial settings, security concerns have become increasingly serious.
In particular, factory automation equipment has traditionally been considered relatively safe because it is often operated on closed networks isolated from the internet. However, following the discovery of malware like Stuxnet—which was specifically designed to target industrial systems—the conventional notion that “closed networks = safety” no longer holds true. This incident sparked growing interest in proactive security systems.
Traditional Approach: The Limitations of Blacklisting (Reactive Response)
The traditional approach used in many systems to date is a reactive method that involves registering detected attack patterns and blocking them accordingly. Also known as signature-based detection, this approach involves pre-programming patterns of known threats and blocking them when detected.
While this method can respond quickly to known viruses, it is powerless against new attack patterns or zero-day vulnerabilities. Furthermore, it typically takes 24 to 72 hours to identify malware and develop and deploy an antivirus patch; the losses incurred by a company during this time can be catastrophic.
What is a whitelist?
A whitelist is a proactive approach that allows only authorized programs to run. Much like the metaphor of “writing verified items on a blank sheet of paper,” it permits only pre-verified software and blocks all other executions.
Since industrial equipment typically performs only specific functions, the programs required for operation are limited. Therefore, a system that allows only authorized programs prevents the execution of unnecessary software at the source, significantly reducing the risk of system downtime caused by unknown attacks. Additionally, since it permits only a limited scope of execution, resource consumption and operational overhead tend to be low.
However, simply “running only a limited set of programs” does not make for a good whitelist. For effective implementation, several conditions must be met.
Conditions for an Effective Whitelist
First, a list of authorized applications must be automatically collected and accessible to anyone. Manually registering applications one by one is time-consuming and can lead to omissions due to human error.
Second, while centralized management of the whitelist should facilitate easy deployment and management across devices via the network, it must also be capable of independent deployment and operation on devices not connected to the network. It is crucial that individual devices maintain normal operation even if the central device fails.
Third, the whitelist should not rely solely on a static list but must be dynamically generated and maintained. If new programs need to be permitted to ensure the normal operation of equipment, they should be automatically incorporated or efficiently approved by an administrator.
Fourth, to operate smoothly even on simple factory equipment, the overhead must be low. In other words, the security feature itself must not consume excessive resources or interfere with system operation.
Future Challenges and Recommendations
While whitelisting is a highly useful approach in industrial facility security, we must not forget that as security technologies advance, attacks also evolve. Therefore, we need to go beyond simply applying whitelists and pursue continuous improvement and refinement.
Possible improvement measures include establishing a cloud-based threat intelligence sharing system, adopting big data techniques for attack pattern analysis, and implementing secure synchronization and lockdown measures between central systems and endpoints. Implementing these measures in parallel will bring us one step closer to ensuring uninterrupted operation of production facilities.
In conclusion, relying solely on reactive measures has clear limitations when it comes to production facility security. Practical preventive effects can be achieved only when a well-designed whitelist is combined with a supporting operational and management framework, and continuous monitoring and information sharing ensure stable long-term operation.
