wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

19-4 Industrial Communication Systems
• How are the systems and tools selected to implement the security policy going to be used? There
will be cryptographic defenses and no cryptographic ones and it will be important to know the
different kinds of attacks and defenses.
• How much money could the organization afford to implement the policy? This data item gives
a great input to decide which way can be used to begin to implement the policy.
Once the security policy (or at least the first operating version) is built, it is necessary to start the
security process within the information security management system [7]. It can be structured in three
continuous phases:
1. Implementation phase: Every organizational measure of the policy must be activated, including
all the configurations for servers, routers, switches, firewalls, etc.
2. Monitoring phase: Audits and continuous monitoring of systems and networks must be done to
assure that the security restrictions are working and to investigate possible new security problems,
not previously detected or thought of.
3. Security adulting phase: Vulnerability audits and security tests must be done, especially to sensible
devices and servers, in order to get new possible technical or organizational vulnerabilities.
Adding the results of phases 2 and 3, we get new directions for updating the security policy building, say,
the operating version 2, that we must implement putting again in the first phase of the process, and so on.
To finish this section, it is important to point out a number of committees and standards that can help
to build a concrete security policy for a concrete industrial network:
• IEEE 1402 [9], a security standard for substations, especially devoted to physical security.
• Process Control Security Requirements Forum (PCSRF) [10], sponsorized by NIST. Its goal is to
build a quality and security standards set for building new industrial process control systems. It
has developed norms for DCS and SCADA systems, like the SCP-ICS (Industrial Control System
Security Capabilities Profile) or the SPP-ICS (Industrial Control System Security Profile).
• ISA SP99: The SP99 [11] committee of Instrumentation Systems and Automation (ISA) develops
“guide-alike” documents for introducing information security in automatized control systems.
• IEC TC65: Technical subcommittee 65C of the IEC is working since 2004 in security standards for
field buses and other industrial communication networks.
19.3 Quality of Service for IP Networks
Traditionally, the term “quality of service” refers to a series of techniques [12] and methodologies [2,3]
whose targets are to assign different priorities to different kinds of traffic in the IP network. Also refers
to implement management policies to handle the latency, delay, and bandwidth. These techniques try
to give a distinctive and preferential treatment to the traffic corresponding to the most critical applications
in the network. This treatment must be homogeneous, the same treatment in all the areas in the
network. The policy must allow the changes, must be dynamic because of the possible changing situations
of the services in the network. Nowadays, they are an essential component to assure the correct
performance of the applications in the network.
Any network may experience any of these network availability problems:
• Delay: Also named latency, is the amount of time that it takes a packet to reach the receiving
endpoint after being transmitted from the sending endpoint. This period can be broken into
two areas: fixed network delay and variable network delay. The fixed part includes encoding and
decoding times (for voice and video, for example) as well as the amount of time required for the
electrical and optical pulses to traverse the media to their destination. The variable part generally
refers to network conditions, such as congestion, that is going to affect the overall time required
for transit. For data networks it is usual to talk about packetization delay, the time that it takes to
© 2011 by Taylor and Francis Group, LLC