Seven differences to consider when addressing cybersecurity for Industrial Control Systems

The ISA 62443 standard defines an Industrial Automation and Control System (IACS) as a collection of personnel, hardware, software and policies involved in the operation of the industrial processes that can affect or influence its safe, secure and reliable operation.

Control Systems are the hardware and software components of an IACS. These control systems can be a target of a cyber-attack. Cybersecurity measures taken to protect these control systems against unauthorised attack or access have to examine the objectives of these Industrial Control Systems, their operating environment, the security priorities and the consequences of a cyber-attack. Since these will differ from IT systems, the assumptions made when defining the cybersecurity measures for IT systems are not always valid for IACS.

Traditional IACS which were air-gapped to physically isolate the system from the internet and external networks were not considered to be cybersecurity targets. However, recent cybersecurity attacks like Stuxnet and Triton have demonstrated that this situation is no longer the case. In addition, SCADA and plant process control systems architectures are changing with the advent of IIoT devices, cloud and edge-based systems [See related Feedforvard article – “How Cloud, Fog and Edge computing are enabling solutions for Industrial IoT“] that are connected to large networks to enable the use of digital twins, predictive maintenance and other solutions that help in optimising the performance and maintenance of machines and equipment.

The following are seven important differences to consider when addressing cybersecurity for IACS.

1. Availability over Confidentiality

When security objectives in the CIA triad – Confidentiality, Integrity and Availability model for information security are considered, Availability has the highest priority over Integrity and Confidentiality for IACS. Loss of availability can lead to disruptions of plant operations creating unsafe conditions like fires or explosions that can have a serious impact on the personnel, equipment and production. Fault-tolerant systems [See related Feedforvard article – “Redundant or Stand-by, that is the question“] are essential for IACS to ensure safety and prevent data loss. Outages due to the failure of IACS are not tolerated and these critical systems cannot just be rebooted to recover a system, without affecting continuous operation. On the other hand, the loss of confidentially is not as severe since IACS data seldom contains personal or company-sensitive information. IT security measures of locking out an operator from access to the IACS if he/she enters the wrong login can lead to a more dangerous situation at a plant should there be a situation where operator intervention is critical to prevent an abnormal operating condition.

2. Real Time Performance

IACS operate in real-time and require precise control and monitoring of industrial processes for power generation, manufacturing or chemical processing. The response times of an IACS is critical for these facilities and a delay in response can lead to equipment damage and production shutdowns causing huge financial losses to the operating company. While delays can be tolerated for IT systems, for elements of the IACS that are safety-critical, deterministic response times are crucial to ensure the safe operation of the facility. Widely available IT protocols may be cheaper to implement, however, they are not designed for deterministic control systems and special industrial protocols like Ethernet/IP, Profinet and Modbus are used for IACS.

3. Data Integrity

Data integrity involves maintaining data consistency, accuracy and trustworthiness. Encryption of data is commonly used as a cybersecurity measure for IT systems to ensure that data stays confidential in transit and is not altered by unauthorised persons. For IACS, loss of data or data manipulation can lead to severe consequences as critical decisions are made based on the accuracy of the data. IACS prioritise the quality and accuracy of the data over data confidentiality. Encryption, while ensuring data integrity, introduces additional computational load at both ends of the communication channel and can increase the size of data packets leading to an increase in latency. This can be a challenge for IACS where the system’s timely response to changes in process and equipment conditions is essential. IACS cybersecurity measures need to give careful consideration to real-time performance requirements when selecting the encryption methods and network hardware to be used. Legacy hardware and software may not support modern encryption technologies and managing encryption keys and certificates for large IACS with several different systems, devices and communication protocols are some of the additional challenges.

4. Operations and Maintenance

Some of the recommended practices for monitoring and maintaining the cybersecurity of IT Systems cannot be applied to IACS. Port scanning and penetration testing of IACS can result in blockages and a lack of system availability. Excessive data encryption and software audits can interfere with the deterministic performance requirements of an IACS. In many IACS operations, control engineers have multiple responsibilities and system privileges that, in many instances, violate the security principle of separation of duties prescribed for IT systems. There is also a heavy reliance on suppliers who provide modified software and hardware for IACSs, resulting in non-standard implementations that are difficult to maintain without support from these suppliers.

5. Operating Environment

IACS are deployed in industrial environments that are harsher than offices and server room environments where IT systems are deployed. IACS hardware is designed to withstand extreme temperatures, dust, moisture, vibration and other harsh conditions present at a manufacturing or processing facility. These control systems are often installed at remote locations in the field with limited power and space availability, placing constraints on the processing, memory, and expansion capabilities of these systems. Therefore, most IACS use real-time embedded operating systems that are purpose-built to meet IACS performance requirements. These embedded operating systems have limited computing resources available to address software security.

6. Patch Management

Patch management is the process of updating and managing software patches or updates for IT systems. These patches contain fixes for known vulnerabilities, software bugs and other issues that could compromise the security and stability of the system. Microsoft releases security updates via patches on the second Tuesday of every month. Patches for IACS cannot be installed as easily and frequently as patches in IT environments, as the patches may impact safety, reliability, certification and performance. This can lead to serious and sometimes dangerous situations at a production facility. Any new patches must be thoroughly tested by the IACS product vendors at their premises to ensure they are compatible with the IACS software applications before they are approved. Only approved patches are deployed on systems at production facilities and the patches are verified at the site as part of the installation process.

7. Legacy Systems

Legacy IACS have outdated technology with limited computing resources and cybersecurity capability. They contain custom-built applications and communication protocols requiring specialised systems knowledge to maintain and upgrade. They are often built with maintenance back doors installed with weak authentication for remote maintenance and also use old networking equipment, which can be easy entry points to modify critical software and firmware with negative consequences. Upgrades must be carefully planned, taking several months of design and verification at a staging facility. The upgraded systems are usually deployed during a planned shutdown or turnaround, where there is a limited time window to perform the upgrade. Due to the several challenges faced in upgrading legacy systems [See related Feedforvard article – “Twelve points to consider when deciding to upgrade your control system“], the upgrades cannot be managed like IT systems and several manufacturing and processing facilities continue to operate using legacy IACS that are exposed to new cybersecurity threats.

It is important to note that IACS use IT technology like Windows and TCP/IP. For such systems, IT security technologies and practices can be borrowed and modified so that they are suitable for IACS. The cybersecurity threats and their impact on critical areas such as safety risks, system availability and real-time performance which rank low for IT systems must be evaluated before applying IT cybersecurity measures to IACS.