Manufacturing systems at risk from cyber attacks and the SaxaVord Spaceport project has been saved
SMEs face a stark warning from the NCSC on their manufacturing and processing systems, but good news as Shetland’s Spaceport has a more secure future.
SMEs warned on all internet-exposed systems
Disruptive cyber attacks are going beyond computers and into manufacturing and processing systems, Small to Medium-Sized Enterprises (SMEs) have been warned.
The National Cyber Security Centre (NCSC) has seen a concerted and increased number of attacks on what’s known as Operational Technology (OT) in numerous sectors both globally and domestically. These attacks have had real-world effects.
Hackers cut off a small gas-fired ‘peaker’ power station earlier this year. These UK plants have small local capacities, are remote with no employees and use OT to balance local baseload and feed into the national grid.
OT is both the hardware and software systems that monitor, control and automate infrastructure and processes across a variety of sectors.
The NCSC is warning that organisations should not assume their equipment is not internet-exposed. It said, “Against the backdrop of technology-enabled uplifts in cyber capability and increased geopolitical instability, the NCSC assesses that the threat from state use of offensive cyber, including outside of conflict, has almost certainly increased.”
Without organisations testing legacy structures, older equipment or misconfiguration, systems can be easy to exploit for state and non-state actors.
Companies should examine all their Programmable Logic Controllers (PLCs), Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems to ensure their security.
The NCSC has outlined a series of steps that should be taken.
- Build a definitive view of your OT architecture, including all assets, communications pathways and external connections. This will help identify internet-exposed systems, unmanaged assets and legacy connectivity that may introduce risk.
- Ensure OT devices are not directly exposed to the public internet.
- Change any default credentials and prevent the use of shared passwords on web interfaces, management interfaces, and management protocols.
- Use unique accounts for administrators and enable multi-factor authentication (MFA) wherever supported. Any stronger authentication mechanisms, such as public/private key authentication, are recommended.
- This includes the control of access to OT networks. The NCSC recommends updating systems efficiently. This also includes ensuring that the management of these devices is only possible from a segregated management network that is not connected to the internet.
The NCSC proposes updating certain industrial protocols and security applications, which it lists on its website, including procedures.
If it wasn’t important before, IT departments should ensure they log and monitor all connectivity to and within OT networks. As OT environments are typically static and predictable, baseline monitoring can be highly effective at identifying unauthorised activity, misconfigurations, or potential cyber compromise.
Monitoring is also important during normal operations. PLCs, in particular, should not be left in programming or maintenance modes and should be in write-protected mode where possible.
The NCSC also recommends the separation of networks; for example, the business and management system should be separated from OT and, come to that, security systems.
Don’t just keep backups; it is important to test the backups and your recovery procedures. Many organisations, including those regarded as ‘tech-savvy’, have been diligent in backup procedures but then hit problems when it came to restoring their data.
Government promises growth for space industry
The troubled Shetland SaxaVord Spaceportproject has been saved. The £30 million rescue package for the ex-RAF station in Unst was announced the day after a rapidly rolled-out new UK space strategy was presented by the government.
SaxaVord, the UK’s first fully-licensed spaceport, has regulatory approval for up to 30 rocket launches a year, with two German companies already signed up.
Scottish Secretary Douglas Alexander said, “Scotland already builds more satellites than anywhere else in Europe, and with a £30m UK government investment boost, SaxaVord is now poised to deliver up to three-quarters of the continent’s orbital launch slots.”
But SaxaVord exemplifies the problems facing the UK’s space industry.
Accounts showed a technical default on a £10 million loan last year, highlighting the financial and practical difficulties faced by the sector. Unst has limited five-week ‘launch windows’ reduced by bad weather.
Regulatory limitations have also held back the industry. Following the failure of the UK’s first commercial space launch from Cornwall in January, the Parliamentary Science and Technology Committee heard that it cost one satellite company more money to get a launch licence than to physically put the satellite into space.
The importance of the space and related sectors ought not be underestimated. Government figures show the space industry generated £18.5 billion for the UK and employed over 55,000 people.
Landmark missions benefit from UK know-how, such as the UK-built Rosalind Franklin Mars Rover.
UK Space Strategy
The new UK Space Strategy policy is backed by £7.8 billion of investment until 2030. Its mission is to safeguard the UK’s national security and defence capabilities, while exploiting technology opportunities. It brings the government’s space investment and activity under one plan.
Ministers said they wanted to create jobs and help Britain and its partners launch satellites without relying on countries ‘further afield’. The new policy formally replaces the previous National Space Strategy, published in 2021.
The new UK Space Strategy expropriates existing policies and financing, including some that up until now were not regarded as being space-related.
Space Domain Awareness, the study and monitoring of objects like satellites, rockets and debris orbiting our planet, is being backed by projects including £149 million for the European Space Agency’s (ESA) Vigil mission and £85 million for the National Space Operations Centre.
UK funding will see British tech offer earlier warnings of potential satellite collisions, hostile activity and solar storms, helping protect the power, communications and navigation services people rely on every day.
Another £880 million will help beef up the UK’s space control and intelligence, surveillance, and reconnaissance capabilities, funding technologies that can track military activity on the ground and potential attacks on satellites. This should improve responsiveness and decision-making in protecting the country and its space assets.
A further £2.8 billion will strengthen connectivity, including the Connectivity in Low Earth Orbit and SKYNET defence communications programmes. This plays a pivotal role in keeping the UK’s Armed Forces connected globally.
The new joined-up thinking is ambitious on announcements but less so on funding. The £7.8 billion has been pulled together from existing funding projects and brought under one umbrella.
Initiatives include £57 million already allocated by the Department for Transport to improve rail connectivity, £190 million from UK Research and Innovation (UKRI) for astronomy and space science research and £9 million from the Met Office which is funding that was already announced.