Industrial Automation and Control System Security: A Component of a Nation’s Critical Infrastructure
As defined by ANSI/ISA-99.00.01, industrial automation and control systems (IACS) include (but are not limited to) distributed control systems (DCSs), programmable logic controllers (PLCs), remote terminal units (RTUs), intelligent electronic devices, supervisory control and data acquisition (SCADA) systems, networked electronic sensing and control, and monitoring and diagnostic systems.
A SCADA system provides the ability to obtain information from remote installations and to send limited control commands to those installations. Industrial control systems (including DCSs, PLCs, and intelligent electronic devices) comprise real-time elements that control critical industrial processes in a wide variety of applications.
Before the advent of local area networking, computer-based industrial automation and control systems were generally isolated from the outside world and used their own proprietary communication protocols. Eventually, as networking technology improved, interconnectivity among plants and other corporate units emerged as a way of obtaining increased knowledge of plant operations and more efficient management of resources.
With the maturation of the Internet and browsers, the TCP/IP protocol and Ethernet LANs found their way into supervisory control and data acquisition systems as well as process and manufacturing plant control systems.
In addition, computing platforms such as PCs running Windows were adopted for reasons of lower cost and standardization. However, with these advantages came the disadvantages of vulnerabilities and exposure to threats that plague these platforms.
There is also an emerging trend in many organizations toward consolidating some overlapping activities in IACS and corporate IT systems. This trend is motivated by the cost savings achievable by avoiding the use of disparate platforms, networks, software, and maintenance tools and by an increased capability to run the total organization more efficiently and effectively.
An important issue associated with the merging of these two systems is that, in many cases, both IACS and corporate IT environments use the same security model. This overlap introduces the possibility of the corporate Internet connection exposing critical operations to additional threats and compromising the real-time, deterministic requirements of plant control systems. The emergence of the Stuxnet worm, aimed specifically at PLCs that transmit and receive real-time control bits, highlights the sophisticated threats that exist today and the critical need for IACS-optimized system security methods. Follow-up malware such as the Flame or Flamer virus that have appeared portend a trend of future attacks on these critical systems.
This book develops a novel approach to securing industrial automation and control systems by generating applicable, useful, protection principles through the merging and adaptation of the best industrial and governmental standards and practices.