Securing Industrial Control Systems

Security of SCADA (supervisory control and data acquisition) and other industrial control systems (ICSs) is a complex subject, and one that has received much attention in recent years. While modern industrial control systems use many of the same computers, operating systems and networking components as conventional business networks, the two kinds of networks are managed very differently. As a result, what is “common wisdom” on business networks can be utter nonsense on control system networks. On the other hand, control system networks are notoriously vulnerable to certain kinds of attacks, and whether common security wisdom works on these networks or not, these vulnerabilities must still be addressed. This article looks at what the differences between control-system and business networks are, what is working and what is not, and at what leading security practitioners in the chemical process industries (CPI), as well as other industries, are doing to address these problems.   Safety first Cybersecurity concerns for business networks are prioritized according to “confidentiality, integrity and availability,” in that order. Most existing advice for industrial cybersecurity suggests that on industrial networks,…