Download

208 Chapter 6 • Protecting Critical Infrastructure: Process Control and SCADAIntroductionYou may not be aware of it, you may not even consider it, but critical infrastructure allowsfor all of the modern-day conveniences we are used to.The health of the nation depends onthe infrastructure that provides electricity, moves and controls water, provides gas and oil, andensures the operation of our transportation and communication networks. When we flick alight switch, when we get a glass of water, when we pump gas into our cars, when we dial9-1-1 in an emergency—all of these things that we may take for granted are available to usbecause of the infrastructure that supports the delivery of these goods and services.It is impractical to think that every time water needs to be redirected or electricity needsto be routed down a different line that someone would actually go on-site and physicallymake the change.That obviously wouldn’t make sense.This is where process control systemscome into play.These systems monitor and control critical infrastructures as well as anumber of other applications, such as automotive manufacturing plants and hospitals. In thischapter, we will explore how process control systems work, with an emphasis on the systemsused by the oil and gas industry.These systems are commonly referred to as SupervisoryControl and Data Acquisition (SCADA) systems. Most of the time when people are talkingabout process control systems they mention SCADA, although SCADA is a subset of thelarger process control system.This chapter will take a slightly different approach than some of the other use-caseschapters in the book.The first section examines process control and SCADA systems, followedby the reasons convergence is necessary and the challenges and threats that face theorganizations responsible for protecting the nation’s critical infrastructure. We will also hearfrom two industry experts in one-on-one interviews detailing real-world examples of problemsfound in process control networks.From a longevity perspective, protecting a nation’s critical infrastructure is far moreimportant than any business system, Web site, or individual organization. Without power,water, and oil, you may as well forget about the financial database or the Web server that gothacked, or even the personal information that disappeared on your laptop.There is a seriousthreat out there, especially from terror organizations that want to inflict the most damagethey can with no regard for human life.This is not at all meant to be a scare tactic, but thethreat is real and only through a converged solution between the infrastructure owners, thelogical security vendors, and the infrastructure control vendors will a nation’s infrastructurebe protected. After you read this chapter, the benefits of a converged monitoring and detectionsolution providing a single pane of glass into both physical and logical threats will beapparent.