POWER June 2012 - 28

CYBERSECURITY
IT security, and one part ICS security to
properly function. Physical security is
generally well-understood and is often
addressed by experts coming from the
military or law enforcement. IT security
typically deals with commercial off-theshelf
hardware and software and connections
to the Internet, with experts coming
from IT and the military. ICS security, in
contrast, is an engineering problem requiring
engineering solutions. Resilience and
robustness are the critical factors in the
survivability of compromised ICSs.
ICS security requires a balanced approach
to technology design; product development
and testing; development and application
of appropriate ICS policies and procedures;
analysis of intentional and unintentional security
threats; and proactive management of
communications across view, command and
control, monitoring, and safety. It entails a
lifecycle process, beginning with conceptual
design and ending with retirement of the systems.
In other words, ICS security is not only
more difficult to design than physical and IT
security, but it also requires an added level of
expertise not usually held by physical and IT
security experts.
The triad of confidentiality, integrity, and
availability (CIA) effectively defines the attributes
needed for securing systems. In the
IT domain, cyber attacks often focus on the
acquisition of proprietary information. Consequently,
confidentiality is the most important
attribute, which usually dictates that
encryption is required.
However, in the ICS domain, cyber attacks
tend to focus on the destabilization of assets.
Moreover, most ICS cyber incidents are unintentional
and often occur because of a lack
of effective message integrity and/or appropriate
ICS security policies. Consequently,
integrity and availability are much more important
than confidentiality in ICSs, which
lessens the importance of encryption and
significantly raises the importance of authentication
and message integrity. That is why
ICS security research and education should
focus on technologies that address integrity
and availability over confidentiality.
Differences Between IT and ICS
Systems
Cybersecurity in the U.S. is generally viewed
in the context of traditional business IT systems
and Department of Defense systems. IT
systems are " best effort " in that they complete
the task when they get the task completed. Unlike
IT systems, ICSs are not general-purpose
systems and components but are designed for
specific applications. The ICS design criteria
are performance and safety, not security. ICS
systems are " deterministic " in that they must
28
do their jobs immediately; they cannot wait,
because later is too late.
Legacy ICSs were not designed to be
secured or easily updated. Nor were they
designed to enable efficient security troubleshooting,
self-diagnostics, and network
logging. A security-not a design or safety-flaw
was exploited by the Stuxnet virus.
(Enter " Stuxnet " in the search box at www
.powermag.com for POWERnews coverage
of related events.) The same flaw exploited
by Stuxnet is inherent in all of the programmable
logic controller (PLC) designs and
cannot be easily fixed. It was never a problem
because it did not affect performance or
safety. This leads to a double negative conundrum
for the IT security practitioner: When it
comes to security, control systems don't do
what they weren't designed to do.
The table compares key characteristics of
business IT systems and ICSs. These differences
can have very dramatic impacts on ICS
operation and education.
Unfortunately, the distinctions between IT
systems and ICSs are not recognized by regulators
and politicians, and the consequences
of this are grave. The smart grid initiative is
already providing real case histories of what
happens when those without an understanding
of the operational domain try to set the
rules for systems they do not understand.
The smart grid today is actually two domains
" bolted together. " The first is the
" smart home, " including smart meters and
(in some cases) home area networks. This is
where the majority of smart grid security efforts
are being focused by industry and the
National Institute of Standards and Technology
smart grid program. The second piece is
the electric grid and power plants. There is
significantly less research and investment focused
on these critical facilities.
1. Control system basics. This diagram shows the different aspects of an ICS using a
Windows-based workstation with secure field elements but with generally little to no security
in the overall control system. Source: Applied Control Solutions
Sensors
Control
valves
Programmable logic
controllers (PLC)
Motor
controls
I/O
Meters
Sensors
Field
devices
Field devices
Remote
PLC
IED
RTU
Controller
Comms
Protocols
Ethernet
Serial
Wireless
Master
SCADA
server
HMI
EMS
DCS
Control center
Comparison of typical IT system and ICS characteristics. Source: Applied
Control Solutions
Attribute
Confidentiality (privacy)
Message integrity
Availability
Authentication
Time criticality
High
Low-medium
Medium
Medium-high
Delays tolerated
Security skills/awareness Usually good
Security education
Good
Engineering education
Certification
Life cycle
Forensics
Impacts
Usually none
Certified Information Systems Security
Professional (CISSP)
3-5 years
Available
Business impacts
www.powermag.com
Information technology
Low
Very high
Very high
High
Critical
Usually poor
Usually poor
Required
Professional Engineer (PE)
15-25 years
Minimal
Business impacts, safety, environmental
POWER | June 2012
Industrial control systems
Human machine
interfaces (HMI) and
operator displays

http://www.powermag.com http://www.powermag.com

POWER June 2012

Table of Contents for the Digital Edition of POWER June 2012