Establishing a Comprehensive ICS Security Framework

Industrial Control Systems security can be a complex requirement for many businesses already faced with ensuring control systems uptime and resilience. Progressive technology convergence changes have led to an increase in the number of Industrial Control Systems (ICS) and Supervisory Control And Data Acquisition (SCADA) components using Commercial off-the-shelf (COTS) Microsoft Windows, Unix operating systems and IP network protocols.

The technological differences between IT and OT that had traditionally kept these different disciplines separate are now rapidly disappearing. It is no longer sufficient to rely on the proprietary nature of the technologies used within the industrial automation sector to provide an appropriate level of security. ICS systems now face increased threats from unauthorised users, misuse (including accidental employee behaviour) and malicious software, such as malware and ransomware. Consequently an ICS Cyber Security Control Framework needs to be an integral part of every organisations overall security strategy.

An ideal ICS/SCADA security control framework should have the following characteristics:

- Adaptive and comprehensive approach to deal with emerging cyber threats
- Address the ICS business requirements (Availability and Integrity) of control systems
- Meets the risk management and performance requirements typical of control systems
- Scalable to adhere to applicable industry standards (IEC 62443, NIST 800-82) and regulations

The Applied Risk’s proposed ICS security framework can be subdivided into the following key controls:

ics.png

The ICS security framework can be used by organizations to establish their control system security program, including OT operational security policies/procedural and risk control framework, which can be further used for security and risk assessments initiatives of the organization’s industrial assets.

Asset owners and operators can build upon the SCADA security framework to frame short-, medium- and long-term security plans by selecting appropriate tools, trainings and technologies to secure their OT infrastructures.

To help mitigate the negative effects of breaches and non-compliance, Applied Risk can help you reduce your industrial cyber security risk.

View our Industrial Cyber Security Services to learn more.