Process Control Network Security

3 - Comparison with Special Publication 800-53 Revision 3, NISTNIST 800-53 controls PE-3, 4, 6, 7, 18 and 20 treat the subject of inadequatephysical access restrictions. The most relevant controls for physical accessrestrictions are PE-6 “Monitoring Physical Access”, which states that investigationof and response to detected physical security incidents, violations or suspiciousphysical access activities should be part of the organization’s incident responsecapability. PE-4 “Access control for transmission medium”, states that theorganization should control physical access to information system distribution andtransmission lines within organization facilities. PE-18 finally states that thepositioning of information system components within the facility is such thatpotential damage from physical and environmental hazards and the opportunityfor unauthorized access is minimized.7.3.4.1 SummaryThe table below summarizes the applicable controls from each of the availableframeworks. However, it is important to point out at this point, that althoughsome guidelines are useful (investigation of and response to detected physicalsecurity incidents, violations or suspicious physical access activities should bepart of the organization’s incident response capability), a lot of the proposedmeasures are simply not feasible for PCNs. For example: it is simply impossible tomonitor 800 miles of pipeline in Siberia. As such additional measures need to bethought up to address the issue of physical security for PCNs.Category CIP NISCC NIST 800-53Inadequate physical accessrestrictionCIP006 4.3.8, 4.3.9 AC-2, AC-11, AC-7, PE-3, 4, 6, 7,18, 207.4 Discussion – Specific versus General frameworksIt is important to note that although the frameworks we selected:- CIP (NERC)- Good Practice Guide Process Control and SCADA Security (NISCC)- Special Publication 800-53 Revision 3 (NIST).mentioned specific attention points and effective measures which could reducerisks for PCNs, we feel that the use of a general framework like ISO27001 orCoBIT could also have addressed the risks for PCNs as described in Section 7.3.7.4.1 Comparing ISO27001 with specific risks for PCNsIn our discussion we identified the following specific risks for PCNs:1 Unsupported systems2 Increased interconnectivity3 Inadequate logical access restriction4 Inadequate physical access restrictionWe will try to identify sections of ISO27001 which could also map to the identifiedrisks. Please note that we will first name the PCN specific risk (e.g. “1unsupported systems” followed by the various ISO 27001 sections which apply tothis PCN specific risk).Process Control Network Security Page 41