POWER June 2012 - 26

CYBERSECURITY
Ensuring the Cybersecurity of
Plant Industrial Control Systems
Industrial control systems (ICSs) manage global industrial infrastructures, including
electric power systems, by measuring, controlling, and providing a view
of control processes that once were visible to the operator but now are not.
Frequently, ICSs are not viewed as computers that must operate in a secure environment,
nor are they often considered susceptible to cybersecurity threats.
However, recent cybersecurity failures have proven these assumptions wrong.
By Joe Weiss, PE, Applied Control Solutions
I
ndustrial control systems (ICSs) are commonly
used throughout global industrial
infrastructures. The fundamental reason
for securing ICSs is to maintain the mission
of the systems, be it to produce or deliver
electricity, make or distribute gasoline, provide
clean water, or enable other vital societal
functions. We may not be able to fully
electronically secure ICSs from every possible
vulnerability. However, we can make
them much more secure than they are today.
Secure ICSs will minimize the possibility
of unintentional incidents like those that have
already cost hundreds of millions of dollars
in damages and taken a number of lives. The
three case studies discussed later in this article
demonstrate the difficulties of designing
a cyber secure environment for ICSs.
What Are ICSs?
ICS networks and workstations, including the
human-machine interface (HMI), are generally
similar to information technology (IT)
26
systems and may be susceptible to standard
IT vulnerabilities and threats. Consequently,
IT security technologies and traditional IT
education and training processes apply. But
that's not all. Field instrumentation and controllers
generally do not use commercial offthe-shelf
operating systems and are computer
resource constrained. They often use proprietary,
real-time operating systems or embedded
processors. These systems have different
operating requirements and can be impacted
by cyber vulnerabilities typical of IT systems
as well as cyber vulnerabilities unique to
ICSs (Figure 1).
Infrastructure owners continue to upgrade
their ICSs with advanced communication
capabilities and network connections
to improve process efficiency, productivity,
regulatory compliance, and safety. This
networking can be within a facility or even
between facilities that are continents apart.
Regardless, with increased system complexity
comes greater system vulnerability, and
www.powermag.com
Source: POWER
few qualified experts have a holistic view of
the complete system. When an ICS does not
operate properly, the results can range from
inconsequential to catastrophic.
Securing ICS and IT Systems
A properly secured industrial system requires
one part physical security, one part
Cyber Wars: Stories from
the Front Lines
Join other control system users and cybersecurity
experts as they discuss recent
events and intriguing case histories at the
12th annual Industrial Control System Cyber
Security Conference-hosted by the
Virginia Modeling, Analysis, and Simulation
Center-in Norfolk, Va., starting October
22, 2012. For more information, visit
www.icscybersecurityconference.com.
POWER | June 2012
http://www.icscybersecurityconference.com http://www.powermag.com
POWER June 2012

Table of Contents for the Digital Edition of POWER June 2012
