Chemical Engineering October 2016 - 65

Engineering Practice
Cybersecurity: You Cannot Secure
What You Cannot See
Follow this guidance to understand today's cybersecurity risk landscape and take the
necessary steps to create a sound industrial control system cybersecurity program,
including the development of a comprehensive, in-depth cyber-asset inventory
David Zahn
PAS, Inc.
I
n industrial facilities, cyber incidents
typically result from three
basic scenarios: a malicious attack
from an outside individual or
group; a cyber incident that results
from an engineer making a mistake
that alters a control process or diminishes
safe operations; or the
work of a disgruntled employee or
ex-employee. No matter which of
these scenarios you believe is real
or presents the most risk, companies
must take steps to protect their
industrial control systems (ICS) from
cyber incidents. What should companies
do and how far should they
go to ensure that risk is managed
to a sufficient level? This article addresses
the fundamental elements
that an ICS cybersecurity program
must contain, and shares guidance
on how to develop an in-depth cyber
asset inventory.
Cyber incidents
A malicious attack from an outside
individual or group. Although
such attacks have affected physical
operations in a number of well-publicized
cases, most outsider attacks
to date have focused on proliferation
and reconnaissance (get in, spread,
gather information, and report back)
as their primary objectives. The passive
nature of these attacks has lulled
many into believing there is more
hype than reality in the likelihood of
a malicious attack. Most cybersecurity
experts would agree that attacks
of this type to date are merely
a prelude to attacks that will take
more directed action in the future.
The attack on a power plant in the
Ukraine in December 2015 in which
hundreds of thousands of people
60
FIGURE 1. Cybersecurity risks can arise from several scenarios - malicious attack, human errors and
the intentional actions of disgruntled current or former employees
lost power in the dead of winter is a
testament to what is to come.
A cyber incident resulting from
human error. These mistakes can
go undetected until it is too late.
Most engineers who have worked
in chemical process industries (CPI)
facilities long enough can share
stories of when such incidences
have occurred.
The work of a disgruntled employee
or ex-employee. With the
spate of layoffs during the last several
years
- particularly in the oiland-gas
sector - the potential for
an insider threat is a rising concern
for chief information security officers.
Georgia-Pacific recently incurred the
wrath of a fired employee who, soon
after being laid off, accessed and altered
control systems from his home.
The company required a significant
amount of time to recover from the
damage he had inflicted. That employee
was successfully prosecuted.
Know your cyber assets
In the race for better ICS cybersecurity,
CPI companies all face the same
challenge - knowing what cyber
assets they have in the plant. Operators
and managers tend to have
good insight into the non-proprietary
assets, such as workstations and
routers, but they often lack sufficient
visibility into the proprietary assets
that run critical processes and keep
plants safe. This lack of visibility introduces
a level of risk that negatively
impacts cybersecurity, safety
and compliance efforts.
To what extent does this lack of
visibility exist? In one real-world example,
an inventory at a plant site
showed that 20% of the cyber assets
were traditional information
technology (IT) systems that standard
protocols - for example, Windows
Management Instrumentation
(WMI) and Simple Network Management
Protocol (SNMP) - could interrogate
for detailed configuration
information. These systems include
Microsoft Windows workstations,
servers, routers and switches that
sit in front of the proprietary control
systems. An inventory of these is important
to have, but it only paints a
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
OCTOBER 2016

http://WWW.CHEMENGONLINE.COM

Chemical Engineering October 2016

Table of Contents for the Digital Edition of Chemical Engineering October 2016