ICS security is not a copy and paste of IT systems
A large proportion of industrial control systems (ICS) are critical infrastructure underpinning our modern society. Some of them generate and distribute energy and heat to our homes, businesses and healthcare centres.
Others are fundamental in manufacturing, in oil and gas refining and production, and in the infrastructure that manages our water systems. These complex, interconnected and interdependent environments, made up of both legacy and modern information systems, are responsible for processes in the physical world and require additional considerations for modern cyber defence beyond traditional IT (Information Technology) security.
IT security practices cannot be applied directly to ICS environments
Although a vast body of knowledge is available for building a solid IT defence, “copying and pasting” traditional security into an ICS could have problematic or devastating consequences.
Incident response: what to do?
- Anomaly detection
- Problem identification
- Damage containment
- Threat eradication
- Recovery of information and operations
- Learning to prevent similar situations in the future
The principles of traditional incident response described above still apply in ICS; however, these remediation actions alone (standard in IT security systems) can have catastrophic results for the process and for the protection of physical assets, in particular the human lives involved in the system.
It is therefore necessary to develop an incident response capability for the Cyber-Physical Security of Industrial Control Systems.
While cyber incidents in IT environments can lead to unwanted data writes, data corruption or data loss, the physical impacts are very different. Incidents in ICS environments range from loss of visibility into physical processes to granting control to unauthorised users, which can lead to serious risks to personnel safety, injury or death.