What could happen? Are you ready?
January 2022 saw the launch of the new security standard SEMI E187—Specification for Cybersecurity of Fab Equipment. SEMI E187 defines the overarching and fundamental cybersecurity baseline requirements to secure semiconductor fab equipment by design and support security protection in both operation and maintenance. This new baseline standard affects entities who provide equipment or services to semiconductor fabrication plants such as equipment suppliers and system integrators.
SEMI E187 releases after what could be described as the year of supply chain attacks, with software supply chain attacks tripling in frequency. While the SolarWinds supply chain attack grabbed most of the headlines, other major attacks in 2021 included Microsoft Exchange Server, Colonial Pipeline, Kaseya, Log4j, Codecov, and ua-parser-js. In each incident, one single breach, compromise, or vulnerability exploited the software supply chain process and led to multiple—sometimes thousands—of victims.
"To succeed, SRM leaders must:
Use automation to augment and accelerate processes and activities.
Gain a better understanding of the expanding attack surface.
Embrace as-a-service security capabilities."
-Gartner
Responsibility no longer solely rests on the suppliers. Buyers and fab operators must now follow stricter security procedures prior to purchase, deployment, and operation. While SEMI E187 represents the baseline cybersecurity requirements, it is strongly advised to leverage 3rd party security assessments and as-a-service cybersecurity vendors to significantly reduce risk and harden defenses.
Here is a quick start guide to help streamline your process.
Computer Operating System Security Requirements
While the OS requirements state suppliers shall not ship equipment with an end-of-life OS, equipment contracts are often longer than the life of an operating system; therefore, we recommend that all equipment run on an OS that is at the very most 2 years old.
We recommend you hire a 3rd party security service to evaluate the supplier’s documentation and process for upgrading and patching software. Currently, there is no way to automate this as each ICS is unique and faces its own challenges when confronting the downtime necessary to do this.
As equipment contracts are often longer than an operating system, a situation could occur where the equipment supplier would no longer be able to provide updates as the operating system reached its end-of-life date in the middle of the contract term. Therefore, the continuous monitoring and hardening of both your endpoints and network are still required to ensure the security of not only your digital environment but those of your partners in your supply chain as well. Leveraging cybersecurity solutions offering Detection and Response technologies coupled with continuous digital forensic capabilities help reduce risk through the continuous monitoring of your endpoints and network.
Network Security Requirements
The network security requirements cover basic security measures that should always be taken. In addition to assuring ports are properly assigned to default—HTTPS on 443, SFTP/SSH on 22—be sure to monitor network traffic to ensure packets aren’t traveling in clear text. Threat Intelligence Gateways allow organizations to monitor north/south traffic and should be able to block outbound traffic heading towards known malicious IPs or C2 servers.
These requirements also require documentation. Be sure your retained 3rd party security service not only evaluates the supplier’s documentation and process for upgrading and patching software but also network configurations, including network protocols/ports. Due to the unique architecture of your ICS, automating this process would be more difficult than hiring experienced human analysts—particularly when it comes to the required downtime for equipment software upgrades/patching. Ideally, your 3rd party security service should be familiar with ICS as well as the semiconductor ecosystem and supply chain.
Endpoint Protection Requirements
Although suppliers will perform vulnerability assessments and malware scans as well as provide documentation of this, it is strongly recommended that buyers/operators perform these cybersecurity assessments again prior to purchase, deployment, and operation. Instead of separate waves of security assessments, Detection and Response solutions could perform continuous digital forensics, providing operators with continuous visibility and insight into each step of the deployment process. To save time in researching Detection and Response vendors, we recommend retaining a MITRE ATT CK evaluated cybersecurity vendor as their opensource results will help reduce the time for your selection process.
Cybersecurity solutions from various vendors don’t always get along and could potentially cause integration problems—especially in ICS environments. Anti-malware (NGAV) solutions that come integrated into a turnkey MDR solution could be one way to circumvent this challenge.
Disabling input/output interfaces and unused operating system utilities help to limit the attack surface and reduce risk. That risk includes multiple kinds of threats, such as insider threats. Whether intentional or unintentional, insider threats are very real and could easily bypass even the most sophisticated security systems. Reducing attack vectors and your attack surface— such as by disabling unused operating system utilities and services—eliminates commonly exploited attack vectors leveraged by attackers.
AD-focused scans and AD critical path visualization tools don’t support segregation of duties but do help your SOC/IT team visualize them. Reducing the number of high-privilege accounts as well as their access burden attacks, prolonging their attacks, and increasing the probability of detection.
No system is impenetrable. Failsafe solutions such as Detection and Response or Continuous Digital Forensics are becoming more commonplace in enterprises and organizations worldwide as preventive solutions continue to be bypassed. However, not all cybersecurity vendors have experience—or tested their solutions—in ICS environments and equipment.
Security Monitor Requirements
While event logs can be monitored by a SIEM solution, the manual workforce necessary to maintain this can be extremely exhaustive. In the event of an attack, manually correlating billions of event logs—let alone directly responding to the attack—is not feasible. Instead, we recommend a lightweight Detection and Response agent capable of both recording event logs and performing automated continuous scanning and monitoring of your digital environment for malicious activity. Continuous Digital Forensic cybersecurity solutions are capable of correlating event logs and mapping out the attacker’s attack path, giving you insight into their activity, their objectives, and how to best respond.
