Article

Could cyber terrorists attack our company?

June 2010

Authors:

Deloitte & Touche Llp

The steps that are followed to prevent the control system cyber incidents occurring on a regular basis in industries around the world have been discussed. One way is through a service provided by the Security Incidents Organization. It maintains a database called the Repository Industrial Security Incidents (CRISIS) that tracks incidents of a cybersecurity nature that directly affect industrial SCADA and process control systems. RISI helps provide an assessment of the threats and vulnerabilities of industrial control systems. Viruses have even been a contributing factor to more serious incidents by preventing operators from seeing critical alarms in a timely manner. Several organizations have published standards and guidelines to help their constituents support the cyber-security of their installed systems. ISA99 has completed its ANSI/ISA-99.02.01-2009 standard, 'Security for Industrial Automation and Control Systems: Establishing an Industrial Automation and Control Systems Security Program' to ensure that companies adopt the security lifecycle of their automation systems.

ResearchGate has not been able to resolve any citations for this publication.

ResearchGate has not been able to resolve any references for this publication.

Thesis

Cyber security of the smart grid control systems: intrusion detection in IEC 61850 communication net...

June 2017

Maëlle Kabir-Querrec

Information and Communication Technologies have been pervading Industrial Automation and Control Systems (IACS) for a few decades now. Initially, IACS ran proprietary protocols on closed networks, thus ensuring some level of security through obscurity and isolation. Technologies and usages have evolved and today this intrinsic security does not exist any longer, though. This transition is in ... [Show full abstract] progress in the electricity domain, the power infrastructure turning into the "smart grid".The IEC 61850 standard is key to the smart grid development. It is aimed at making interoperability possible in ``Communication networks and systems for power utility automation''. It thus defines a common data object model and a stack of protocols answering different purposes.Although the cyber risk in IACS is now widely acknowledged, IEC 61850 does not address cyber security in any way whatsoever.This work tackles the question of cyber security through network intrusion detection in IEC 61850 networks, and more specifically in real-time GOOSE communications. The idea is to get the most out of the protocol specifications and system configuration while developing a tailored NIDS. This enables detection accuracy.

Article

Cyber security and the pipeline control system

February 2009

Eric J Byres

Internal surveys at several major oil companies indicated that managers often misunderstand the situation they face when it comes to SCADA security. Many believe that the IT group automatically looks after SCADA security as well. Many managers also assume that all cyber security problems arise from outside the company premises, generally from hackers. Another cause of SCADA insecurity is a flaw ... [Show full abstract] in SCADA network design. For many years, just keeping systems communicating was a primary challenge for the SCADA engineer. Communications technology was expensive and rather unreliable, so any network that promised to solve these issues was welcome. The company ensure the security of its SCADA system through a new standard called "ISA-99.02.01, Security for Industrial Automation and Control Systems: Establishing an Industrial Automation and Control Systems Security Program". The benefits for oil and gas companies that have followed the ISA-99.02.01 program (or a similar program) extend far beyond just reducing the possibility of attack from a hacker or virus. By cleaning up both the corporate processes concerning SCADA systems and better managing the actual traffic on the control system networks, many companies have realized significant improvements in overall system reliability.

Article

A survey of cyber security management in industrial control systems

March 2015 · International Journal of Critical Infrastructure Protection

Contemporary industrial control systems no longer operate in isolation, but use other networks (e.g., corporate networks and the Internet) to facilitate and improve business processes. The consequence of this development is the increased exposure to cyber threats. This paper surveys the latest methodologies and research for measuring and managing this risk. A dearth of ... [Show full abstract] industrial-control-system-specific security metrics has been identified as a barrier to implementing these methodologies. Consequently, an agenda for future research on industrial control system security metrics is outlined. The “functional assurance” concept is also introduced to deal with fail-safe and fail-secure industrial control system operations.