Chemical Engineering July 2016 - 37

Honeywell
and the damage due to a cyberattack of a
german steel mill reported in 2014 are evidence
that cyberattacks can have physical,
real-world impacts. but it is not necessary
to prompt an explosion to cause significant
disruption. A cyber attack on Ukraine's electric
power grid, and subsequent widespread
power failure last December, was evidence
of that.
As NSA's Ledgett put it, " you don't need
to cause physical harm to affect critical infrastructure
assets. "
Cybersecurity risks are not easily addressed,
however. one challenge is the
increasing sophistication of attacks. The
german government report on the steel
mill incident, for example, noted that the attackers
demonstrated not only expertise in
conventional IT security, " but also detailed
technical knowledge of the industrial control
systems and production processes used in
the plant. "
Moreover, once the tools and knowledge
to enable such attacks are developed, they
are often quickly commoditized and shared,
allowing others with fewer technical skills to
use them.
Another challenge, however, is simply the
increasing vulnerabilities introduced by the
growth of intelligent, connected devices in industrial
control systems. As Chris Hankin, director
of the Institute for Security Science and
Technology (ISST) at Imperial College, London
(www.imperial.ac.uk/security-institute),
remarked recently: " Almost every component
of such systems now has fully functional computing
capability and most of the connections
will now be ethernet, wi-Fi or will be using
Internet protocol. "
The growth of the Internet of Things -
and, more specifically the Industrial Internet
of Things (IIoT), in particular - is adding to
both the number of devices and their connectivity.
Today, the IT research and advisory
company gartner Inc. (Stamford, Conn.;
www.gartner.com) estimates 6.4 billion connected
devices are in use worldwide. by
2020, it forecasts, that total will reach 20.8
billion. Moreover, heavy industries such as
utilities, oil and gas, and manufacturing are
among the leading users. each device and
connection expands the possible attack surface
for cyberattacks.
Closely connected to the increasing number
of connected devices is the growth of
the network of remote computer servers
casually known as the " Cloud, " which provides
access to infinitely scalable computing
power and storage. The Cloud provides an
opportunity to store and process the large
volumes of data resulting from the proliferation
of connected devices, such as with the
IIoT. Again, however, it introduces new connection
and communication channels that
would-be cyberattackers will try to exploit.
Defense in depth
In fact, the security issues related to the IIoT
and Cloud storage result from the longerterm
challenges surrounding the convergence
between the IT and operational technology
(oT) worlds. open platforms and the
proliferation of third-party and open-source
software in industrial control systems has
long brought the power and efficiencies from
the enterprise side of the business to the
process side. but along with those benefits,
the convergence also brings associated security
concerns.
To complicate matters, while the vulnerabilities
on both sides - enterprise and operations
- may be similar, the solutions are
often not directly transferable. The priorities
of each are necessarily different: while confidentiality
can be prioritized in the enterprise;
availability and integrity must, for the most
part, take priority on the oT side. In practice,
a security solution cannot be allowed
to shutdown operator access to data or devices
that are essential to the safe running of
the plant, even if the security of those data is
at risk of being compromised.
ISST's Hankin acknowledged this reality in
his speech: " while there has been a convergence
between the two worlds [IT and oT],
particularly in the past five years, there are
major differences, such as the fact the industrial
control systems (ICS) tend to have
to operate in a time-critical way; they have to
ChemiCal engineering www.Chemengonline.Com july 2016
37
Figure 2. A layered approach
to cybersecurity, with several
types of different cyberdefenses
should be the objective
of industrial control
systems
http://www.imperial.ac.uk/security-institute http://www.gartner.com http://www.Chemengonline.Com
Chemical Engineering July 2016

Table of Contents for the Digital Edition of Chemical Engineering July 2016
