Chemical Engineering October 2016 - 68

system (SIS), the incident- response
protocol will have different steps and
degrees of urgency than protocols for
other systems, such as a data historian.
Discriminating between cyber
assets means having a method of
categorizing the systems so that each
can receive appropriate scrutiny and
responsiveness if an incident occurs.
Since few systems act independently
in a plant, it is also important
to understand how systems are related
to each other. Should the system
go down due to a cyber attack
or engineering mistake, personnel
can make better recovery decisions
based on knowing what other
systems are affected. Having this
information is a good engineering
practice that also allows cybersecurity
personnel to better manage risk
across the entire enterprise.
New device discovery. While a
simple " ping sweep " will identify new
assets on a network, finding new or
changed proprietary cyber assets
relies on a different tactic - digging
into the configuration files of proprietary
systems and finding system references
that are not currently inventoried.
Once an asset is recognized,
cybersecurity or engineering personnel
should ideally receive notifications
of a new device, as well as missing
ones (for instance, those resulting
from a system upgrade). Then, established
workflows can guide them
through the process of updating data
imports, policies, processes and
other cybersecurity functions.
C
M
Y
CM
MY
CY
Enabling new usage scenarios
An OT and IT inventory opens up
new ICS cybersecurity use cases
that were previously unavailable or
difficult to achieve. Cybersecurity
and operations personnel can now
perform the following tasks:
1. Identify exposure to published
vulnerabilities
Scenario: ICS-CERT (Box, p. 62) [2]
published a critical vulnerability advisory
in early 2015 concerning multiple
models and versions of a specific
transmitter. This transmitter works
across any manufacturer's control
system and not just the manufacturer's.
The advisory describes the vulnerability
as critical, noting that it has
the potential to impact operations if
left unaddressed.
Solution: If a comprehensive OT inventory
exists, a simple query will
CMY
K
immediately identify every control
system that has this transmitter.
Only an inventory that spans the
heterogeneous, proprietary control
systems in a plant will provide
complete results. Once the situation
is remediated, to prevent future
occurrences of this vulnerability, an
automated policy can look for and
flag instances of when that same
transmitter is
reintroduced into the
control environment (for example,
through the spares inventory).
2. Unauthorized change to a control
strategy
Scenario: An engineer connects to
a particular safety system to make
a simple change. The engineer mistakenly
removes the ability for the
operator to recognize the availability
of that safety system.
Solution: Inventoried configuration
data are analyzed for changes, with
unauthorized changes flagged for
ICS Cybersecurity. Safety. Compliance.
Circle 23 on p. 78 or go to adlinks.chemengonline.com/61500-23
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
OCTOBER 2016
63
http://adlinks.chemengonline.com/61500-23 http://WWW.CHEMENGONLINE.COM
Chemical Engineering October 2016

Table of Contents for the Digital Edition of Chemical Engineering October 2016
