What is ICS Security? Industrial Control Systems Cyber Security 101

ICS Architecture, Security and Threats

As already explained above, the system architecture consists of lower levels of electronic hardware that comprises signal conditioners, amplifiers, galvanic isolators and so on that gather analog and digital signals coming from the plant, send it via DCS controllers to the operator stations, where they are displayed in the form of graphical user screens. The commands from the operator stations likewise travel from the operator stations, via the DCS controllers and so on until it operates a valve or a pump. Some operations are done manually while others may be done via control logic that uses the PID (Proportional Integral Derivative) or similar algorithms to sense changes in parameters and automatically adjust the outputs, so that the parameter remains near the desired value (called the set-point). This is shown in the picture below.

Note that these systems did not consider ICS security at all, when they were designed.

These systems face threats from a variety of adversaries including plain cyber criminals, ransomware seekers, bitcoin miners,  bot herders as well as state and non state actors that wish to damage a country’s critical infrastructure, since many of these systems are also used in water supply, sewerage management, running the electricity grid.

How did we land in this poor security situation ?

At the time that many of these systems were designed and built, the personal computer was a novelty, available in only a few homes and the internet was just beginning to become popular. Over the next two decades there were several developments. The internet became commonplace, as did computers, laptops and mobile phones that were connected to the internet. Likewise, business IT systems also became modern. They moved from old mainframes running COBOL and DB2 to newer systems like SAP and Oracle based systems. The management of many of these manufacturing companies saw value in connecting these business IT systems with the older legacy control systems.  Many of the business IT systems had web interfaces. However, either the managers were not informed properly, or did not budget for security of the older Control Systems. Now suddenly legacy ICS were connected to the internet and thus became vulnerable. But it was not just about systems that were directly connected to the internet.

Even those ICS that were modernized, were done so in a very superficial way. To save on upgrade costs, only the operator and engineering terminals were “upgraded” or “migrated” to better looking systems, with plant graphic displays and trends having thousands of different colors, the ability to use pointing devices like mice and the ease of having USB ports and CD and DVD drives for software backup.

Compromised Security

This however became the Achilles heel of these systems, because now malware could enter the system via these means and there was no mechanism that could detect and remove it. There have been several cases where such malware entered the ICS via uncontrolled use of USB drives, quickly leading to panic situations like blank screens, slow actions and so on, that had to lead to shutdown of the plant, associated downtime and what is worse, emergency situations where the plant had to be shut down.

These upgrades in fact, increased the attack surface of these systems because now malware could also enter the ICS via insecure serial connections, misconfigured firewalls and so on. Sometimes, the IT staff employed to maintain these systems had no idea of how fragile these Industrial Control systems really were (having little RAM and storage, not much processing power either, as compared to business IT systems) and discovered it the hard way after having inadvertently shutting them down while working on them.

Meanwhile the news that these systems were old and prone to being attacked got through the bad guys and they could now find these systems (many had insecure internet connections that could be breached).  This led to many more attacks on these systems.

ICS Cyber security training & protection of these systems

Here’s an easy way to learn all about Industrial Cybersecurity and qualify as a Certified Industrial Cybersecurity Professional (CICP) at a fraction of the cost that is charged by other training providers. Click the image below to know how.

Understanding this via the Abhisam CICP course is the first step to protecting your Industrial Control System from cyber threats.

Why has cyber security for ICS  become critical now? Can we do technology upgrades?

There are thousands of these legacy DCS, SCADA and SIS systems that are prone to being attacked from various entities such as general cybercriminals, cryptocurrency miners, hacker-activists (called hacktivists), various terrorist groups and even rogue states. These ICS security threats are real and several attacks have already taken place in the recent past, though you may not have heard of many of these, since they were not publicly reported.  Since it will be an enormous task to replace this old insecure automation architecture, with a completely new one (such as an Industrial Internet of Things based one) is next to impossible, it has become critical to understand ICS security, carry out a risk assessment of these systems and protect them. To do this we need a proper ICS security framework and ICS security best practices.

Which organizations are responsible for ICS Cyber Security?

Primarily the asset owner is responsible to secure their systems from attacks, since they own the Industrial Control System as well as the plant and equipment that the ICS controls. However, in order to do this, in addition to utilizing their own resources such as their Instrumentation & Control Systems engineers (who also have been trained in ICS cyber security via a program such as the CICP), they may also need to take the help of other professionals such as ICS vendors and system integrators and OT cyber security auditors.