third Cyber Security Assessment Netherlands - NCSC

Detailed section » 9 Industrial Control Systems
9 Industrial Control Systems
Security of ICS continues to be a major problem because
industrial systems are vulnerable and there is still too little
being done to effectively resolve this. Fortunately, the
known actors still lack both motives and capacity, but will
that continue to be the case? So the warning is repeated,
because things will go wrong one day.
9.1 Introduction
During the reporting period of the second Cyber Security Assessment,
a number of vulnerabilities in ICS ( including SCADA) reached the
media. Not only was there an increase in the number of vulnerabilities,
the threat of a targeted disruption to these systems became
more real. During this reporting period, a number of new
vulnerabilities in ICSs became known. Although there were no
major incidents, the threat continues to be high.
The current security status of ICS is getting worse but only gradually,
so there is a lack of awareness of the increasing seriousness of the
situation, and many organisations are taking insufficient action.
It should be noted here that in particular large operators of vital
infrastructures and some (large) providers of ICS/SCADA applications
do thoroughly comprehend the seriousness of the situation
and act accordingly.
9.2 The potential impact of cyber incidents
involving ICSs
ICSs are used in vital and (other) industrial sectors to control physical
processes. This means that if these systems are not operating as they
should, things can also go wrong in the physical world. It is this
physical impact of digital incidents that make it important for that
ICSs’ security to be in order.
Because ICSs are used in different ways and in different sectors, the
type and size of the impact per incident varies. An incident could
cause serious harm to the economy, the environment and/or the
lives of people and animals. To better explain the seriousness
of incidents involving ICSs, a distinction is made between the three
following levels at which these systems are used.
SOHO and individual applications
(for example climate control systems, access control)
Digital incidents at the Small Office/Home Office (SOHO) level are
irritating for those concerned but the damage is limited and
primarily practical and financial in nature. An example is a situation
where a company’s heating system is paralysed or the barriers to the
»
What are ICS?
Terms such as computers, digitalisation and the internet often
bring to mind the traditional IT environment: desktop computers
and laptops for home and office use. Information security and
cyber security soon bring the same ideas to mind. Within the
vital and (other) industrial sectors, however, a different type
of system is used for digitalisation: process control systems or
industrial control systems. These systems not only have a
different function and effect from traditional IT systems, there
are also different risks associated with them.
ICS are used in vital and (other) industrial sectors to automatically
monitor and control physical processes. ICS are used for
production, transport and distribution in the supply of energy
and drinking water. Production processes in refineries, the
chemical, pharmaceutical and food industry are also (largely)
controlled by ICS. Furthermore, ICS are increasingly being used in
the traffic infrastructure (traffic control, bridges, locks, tunnels)
in building management systems (climate control, fire alarms,
lighting) and for access control (barriers, electronic fencing).
In the past ICS communicated directly with one another in a
closed network, and the systems were not connected to the
internet or other networks. Nowadays, however, ICS are often
connected to the company’s office computers and also accessible
on the internet. This brings along certain risks, which are
not always taken into account.
The media frequently equates SCADA (Supervisory Control
And Data Acquisition) with ICS. For example, the news talks
about ‘security issues with SCADA software’ or about ‘SCADA
leaks’. However ICS is a general term that covers different types
of control systems, including SCADA. This Cyber Security
Assessment discusses the umbrella term ICS.
SCADA systems (computers with SCADA software on them) are
used to operate and visualise (industrial) processes. Monitoring
can take place from a single location (for example the control
room). Using the process data collated and saved, reports can
be generated which in turn can be analysed and used to optimise
the process.
Other important sub-groups of ICSs are DCSs (Distributed
Control Systems) and PLCs (Programmable Logic Controllers).
95