OT Cyber FAT/SAT

Why choose Cyber FAT/SAT?

Between the design & engineering phase and the operation & maintenance phase, there are other important phases, like implementation and commissioning. Especially between these phases, a factory- and site acceptance test is performed to verify that all design requirements are met.

A FAT occurs at the vendor’s premises before the completed systems are shipped to site. A FAT involves extensive testing of all components to verify compliance with the design and project specifications, and to check if the system meets all functionality and performance requirements. The tests are facilitated by the vendor or system integrator and executed by the asset owner.

A site acceptance test (SAT) is similar, but takes place at the customers site and only after the complete commissioning/installation of the system. It ensures the system is installed in a proper, reliable, and safe operating state.

While cyber security requirements are often part of the design specifications, they are regularly neglected during a conventional FAT or SAT. For the owner or operator, it is often too difficult to verify the complex nature of all these cybersecurity controls. And the vendor, integrator or EPC contractor can’t be expected to independently check their own design. Secura’s Cyber FAT/SAT bridges this gap: we deliver support as an independent security provider.

The Cyber FAT/SAT (CFAT/CSAT) is an extension of the conventional FAT/ SAT with a focus on cyber security. It can be planned in parallel or after the regular FAT/SAT. The goals are similar, but focus on digital security.

How vulnerability assessments and penetration testing (VA/PT) help build resilience

A Vulnerability Assessment and Penetration Test (VA/PT) for OT systems requires a specialized approach. With a vulnerability assessment, the aim is to find as many vulnerabilities as possible by scanning and manually reviewing systems, network devices and application configurations. In contrast, a penetration test is performed from an attacker’s perspective. Its aim is to exploit these vulnerabilities to illustrate what the consequences of these security issues would mean to the digital resilience of the environment. The outcome of both assessments can be used to solve potential security issues before the system is put in production.

A major benefit of performing these tests as part of the FAT and/or SAT is the ability to do more rigorous testing. It is commonly known that many ICS systems are less resilient against vulnerability scans, and therefore it is more difficult to perform these kinds of tests when the system is in production. So, these FAT and SAT phases are the ideal time to perform an in-depth VA/PT assessment. It is also the perfect opportunity to verify if the defensive and monitoring controls were effectively implemented.

Also Read: Industrial Vulnerability Assessment / Pentesting Service

Outcome of the Cyber FAT/SAT

Secura will match the existing FAT/SAT process if possible. We add our findings to the punch list. Based on priority, these issues could be solved by the vendor and retested during the FAT/SAT, while Secura could support by providing recommendations.