April 2011 - Control Global

More documents

Recommendations

Info

S e c u r i t y S p o t l i g h t the public. These people have detailed intimate knowledge of the company’s systems and processes, and they will often know exactly how to cause the most damage to operations. They can build on this knowledge and determine how to best mitigate the attack vectors that they developed. The second perspective is from a traditional vulnerability assessment/evaluation arena. Critical infrastructure companies need to examine their systems looking for vulnerabilities; determine the consequences/impacts to the company’s operations of a successful exploitation of the vulnerability; determine the capabilities that are necessary to successfully exploit the vulnerability and cause the identified consequences; determine whether the capabilities needed to successfully exploit the vulnerability currently exist, and whether these capabilities are easy to use; and finally, tdetermine how to mitigate the vulnerability identified and to minimize the impact of a successful exploitation. The company should also answer all of these questions for the scenarios developed by its internal tiger team. Now the company can prioritize what it fixes by working through the results of the above analysis. Vulnerabilities with high/major impacts, where the capabilities to successfully exploit currently exist and are easy to use, should be fixed first. The overall goal is to improve the security of the system, and the above methodology only uses the vulnerabilities and consequences—information that is most likely known—rather than needing threat information which is typically unknown. (This is information that is definitely unknown at the tactical level and often considered not detailed enough at the strategic level.) Learning from Accidents One other area where critical infrastructure companies can gather information they can use to convince senior executives to authorize the implementation of cybersecurity defenses is to examine real-world industrial incidents/accidents, and see if they can extrapolate a purely cyber scenario that results in the same consequences. For instance, most industrial accidents involve three legs, including a physical issue/problem,some form of human error, and a cyber issue, such as a cyber system not running, cyber system running, but on incorrect data, or a malicious cyber attack, which are currently rare. For some industrial accidents, it is quite simple to extrapolate to a purely cyber vector to cause the same consequences as the original accident. However, this is normally done by considering two main assumptions. The first is that an electronic pathway exists from the targeted control system to the outside world. A disgruntled insider needs to be considered as well. The second assumption is that this electronic pathway is exploitable, and the likelihood of this is very high. You could simply assume a supply chain issue that allowed the adversary to implant his malicious access at an earlier stage. I believe that by undertaking the above three efforts, “Threat” vs. “Tactical” InFORMation The industry uses the general term “threat information.” However, during more detailed discussions, it seems the information companies want is more in line with the traditional military concept of “tactical information”; for example, individual “Able” from bad guy group “Baker” is planning on attacking critical infrastructure “Charlie,” specifically company “Delta,” on Friday at 1500 EST using technique “Echo.” The government has been providing strategic threat information for several years. But companies don’t need such specific information to prepare for threats. any critical infrastructure company will have developed/ acquired enough information to convince its senior executives that cybersecurity defenses must be implemented to ensure that the company can continue to carry out its mission safely, reliably and securely without needing tactical cyber threat information from the government before they are persuaded to act to adequately secure their control systems. There is one arena where tactical actionable cyber threat information of a potential attack is needed prior to making decisions to implement basic cyber defense mechanisms. Mechanisms must be developed and deployed that allow information to be shared when an attack is occurring, which will allow companies not under attack to ramp up their defenses to prevent the current attack from succeeding. This assumes, however, that the companies have already implemented cybersecurity defense measures and have developed the plans and procedures to rapidly increase their cybersecurity defense posture. The Bottom Line Critical infrastructure companies should not depend on tactical cyber-threat information to deploy cybersecurity defense. Instead, they should consider that the cyber threat is “1,” and focus on understanding their vulnerabilities and the consequences of a successful exploitation of them. Waiting for tactical cyber-threat information could delay critical them from examining their systems from a mission perspective and implementing appropriate defenses. The discussions concerning tactical cyber threats and the resulting expectations (and need for clearances for industry personnel) are primarily a distraction, and are being used to justify a lack of action for implementing cyber defenses. The government and the critical infrastructures need to get past this self-imposed roadblock. Michael Peters is an energy infrastructure and cybersecurit y advisor for the Federal Energy Regulator y Commission’s Of fice of Electric Reliabilit y. He specializes in analyzing cybersecurit y issues, including those af fecting control systems. This ar ticle is personal opinion and does not represent the opinion or position of the Federal Energy Regulator y Commission or the federal government. 16 www.controlglobal.com A p r i l / 2 0 1 1
® The “Big Easy” comes to guided wave radar. Easy to install. Easy to set up. Easy to use. All at an affordable price. TDR technology doesn’t get any simpler than our new Impulse level sensor. Just input tank height, material type and blocking height, then set your lower/upper range values. On the tank or on the bench, set-up’s a snap using its onboard keypad display or a laptop using HARTWin software. Plus, Impulse level technology’s low price brings Drexelbrook quality and reliability within easy reach. And its rugged housing design makes it an easy choice for tougher environments. DRE XELBROOK 1960-2010 A N N I V E R S A R Y All this, backed by an industryleading 2-year warranty plus 50 years of Drexelbrook experience and performance. Could your decision be any easier? Learn more at 800-553-9092 or: www.drexelbrook.com
Page 1 and 2: Information Wants to Be How ya gonn
Page 3 and 4: Where Do I Go for Automation Produc
Page 5 and 6: April 2011 • Volume XXIV • Numb
Page 7 and 8: April 2011 • Volume XXIV • Numb
Page 9 and 10: E D I T O R ’ S P A G E It’s Al
Page 11 and 12: C O N T R O L O N L I N E KATHERINE
Page 13 and 14: THE HIDDEN FIELDBUS NETWORK THE RIG
Page 15: Demands in tank gauging will only i
Page 19 and 20: You can win the battle with this ec
Page 21 and 22: o can help. ationDirect /Part Numbe
Page 23 and 24: O N T H E B U S Attack of the Mutan
Page 25 and 26: Harnessing The Power Process Gas Ch
Page 27 and 28: The Complete Control Cabinet Soluti
Page 29 and 30: Ohmart/VEGA is now proud to be VEGA
Page 31 and 32: R E S O U R C E S Where to Go for H
Page 33 and 34: T h e M o b i l e W o r k e r infor
Page 36: T H E M O B I L E W O R K E R Fred
Page 39 and 40: When accuracy counts, why settle fo
Page 41 and 42: When should I start to modernize my
Page 43 and 44: V200 V100 The “VAC PAC” A packa
Page 45 and 46: F l o w Even without these excursio
Page 47 and 48: S C A D A Remote Wind Energy SCADA
Page 49 and 50: S C A D A REMOTE WIND ENERGY SCADA
Page 51 and 52: The data acquisition that occurs is
Page 53 and 54: a s k t h e e x p e r t S cations s
Page 55 and 56: P r o d u c t i n t r o d u c t i o
Page 57 and 58: These Books Are Not For Sale ® The
Page 59 and 60: C O N T R O L T A L K Ultimate Limi
Page 61 and 62: A d i N D E X Advertiser Page No.
Page 63 and 64: Import your Modicon 984 ladder logi

April 2011 - Control Global

Create successful ePaper yourself

Delete template?

Save as template?