Through the Industrial Revolutions
Terms such as ICS, SCADA, Modbus, OT and IT are relatively recent.
These terms were in fact coined to regulate business processes in all those areas not strictly tied to production, but more to its control and command.
Everything that has reached us today is the result of the evolution of industry over the centuries.
In particular, we can speak of Industrial Systems as early as the First Industrial Revolution.
However, with increased efficiency and connectivity came the first problems associated with them.
If you are not new to the sector, you will certainly have heard of the campaigns related to Stuxnet, Night Dragon, BlackEnergy or the recent Triton malware.
Industrial Control Systems
The Industrial – Automation and – Control System is referred to by the acronym ICS or IACS and is defined as:
“the collection of personnel, hardware and software that can affect or influence the safe, secure and reliable operation of an industrial process.”
In particular:
- Safety refers to the prevention of possible unintentional incidents that could compromise the system.
- Security refers to protection against deliberate attacks, usually carried out by criminals.
- Reliability is the ability of a system to maintain its functionality over time, also thanks to continuous updates.
In recent years the term Operational Technology (OT) has been used, which also includes the various technologies that interface with the process during operations, to distinguish the industrial domain from the information domain, namely Information Technology (IT).
First Industrial Revolution
The First Industrial Revolution began in 1765 and brought with it an entirely new concept: the Mechanisation of the Production Process.
This evolution, which lasted until 1900, introduced the need to control what these “new machines” were doing (an example being the pressure control valves in steam engines).
This is how the first, rudimentary elements of what would in the future become an Industrial Control System came into being.
Second Industrial Revolution
In 1870 Electricity arrived and with it a new Industrial Revolution.
The Mechanisation of the previous revolution increased the demand for energy.
The combustion engine, the telephone and the telegraph, the car and the aeroplane arrived, up to 1968 with the first Programmable Controller: Modicon (MOdular DIgital CONtroller).
In industry the concept of “negative feedback” was born and in the ’50s the first logic-sequential controls arrived.
The concept of “programming” a system begins to take shape.
Third Industrial Revolution
In 1969 a new Industrial Revolution arrived thanks to (or only in parallel with) the birth of Nuclear Energy.
The concept of ICS was born: in 1971 the Bulletin 1774, the first PLC (Programmable Logic Controller), was introduced; in 1973 the Modbus protocol (still in use today) was defined to connect different PLCs to one another; and in 1976 the concept of remote Input/Output arrived.
The Information Revolution took place in 1986, when PLCs were interconnected to PCs and Operational Technology and Information Technology met.
All the problems associated with IT arrived in OT.
Malicious software – a sort of Trojan Horse – attacked the SCADA system of a Siberian gas pipeline in 1982, believed to be the work of American Intelligence..
In 1992 Ethernet and TCP/IP began to provide connectivity to PLCs.
Terms such as SCADA (Supervisory Control And Data Acquisition) or DCS (Distributed Control System) describe very specific components within the system. However, they are often – mistakenly – used as synonyms for ICS.
Fourth Industrial Revolution
Today we are living through the Fourth Industrial Revolution.
Industry 4.0 and IoT Systems are taking connectivity to a new level.
It all happened extremely quickly compared with previous revolutions: consider that it was only in 2003 that PLCs began to include web servers, whereas today it is taken for granted, with all the risks arising from web application vulnerabilities.
Several documented incidents followed in the subsequent years, affecting different types of industry such as Automotive, Chemicals, Manufacturing, Food & Beverage, Metals, Mining, Oil and Gas, Pharmaceuticals, Energy, Paper, Transport.
The real turning point in raising awareness of security came in the 2010s. An example is Stuxnet, a worm capable of altering the normal operation of uranium enrichment centrifuges, an attack attributed to the American Government in opposition to Iran.
Conclusions
The current scenario is complicated by the need to operate along two different “roads”.
Interconnection is necessary in order to operate, but at the same time what is valuable must be isolated as much as possible.
IT updates are also extremely fast: until recently it was unthinkable to connect mobile devices.
OT systems, by contrast, are very slow and the protocols used are still those of 50 years ago.
A new protection paradigm is therefore needed, in which the lessons learned in IT security are integrated into OT paradigms.