Process Control Network Security

environment more than 10 years ago and were not changed or patched unlessthere was a specific need from the production environment to do so. This isbecause PCNs can be considered to be mission critical and high availabilitysystems. Making updates to these systems might result in a direct loss ofproduction when systems need to be taken offline, or worse, if updates areinsufficiently tested and result in failures. Therefore, the statement “don’t fix it ifit ain’t broken” is often applied for PCNs.In the office IT environment, penetration testing is a regular method to identifyvulnerabilities in the IT infrastructure. However, this is not common and evendangerous for PCNs. The result of performing security testing on these systemsmight lead to unpredictable results in the process control systems. An examplewas given in footnote 1 at page 17. The risk for loss of production is most oftenunacceptable [NISC09].5.3.5 PCN root-cause overviewIn this section, all previously identified risks and issues in this thesis have beencategorized and summarized. We were able to cluster these risks into 8 mainroot-cause categories. We will describe these 8 categories in the nextsubsections.We will make use of the STRIDE model as introduced in Section 2.4 to identifypossible threats. Based upon these threats controls will be selected in Section 6.4titled “Frameworks used for evaluation in this thesis”.5.3.5.1 Unsupported systemsThe first category of root-causes for PCNs is related to the fact that most PCNsare unsupported systems. Because these systems were not designed to meettoday’s demands, this causes problems. There is not much which can be doneabout the fact that PCNs are often unsupported systems. It is important,however, to realize that these systems are limited in their use and must behandled with care. For the lifetime of the implemented PCNs, these properties ofPCNs have to be taken into account when considering security robustness or theability to audit these systems.Process Control Network Security Page 24