|
== Vulnerability of automation and control systems ==
Automation and Control Systems (ACS) have become far more vulnerable to security incidents due to the following trends that have occurred over the last 10 to 15 years.
* HeavyIncreasing use of Commercial Off-the Shelf Technology (COTS) and protocols. Integration of technology such as MS Windows, SQL, and Ethernet means that process controlthese systems aremay now vulnerable tohave the same malwareor (viruses,similar wormsvulnerabilities and trojans) that affectas common IT systems.
* Enterprise integration (using plant, corporate and even public networks) means that process control systemsthese (legacy) aresystems may now beingbe subjected to stresses that they were not designed for.
* Demand for Remote Access - 24x7 access for engineering, operations or technical support meansincreases the attack surface, possibly leading to more insecure or rogue connections to control system.
* Increased awareness and understanding of industrial systems - As more and more people become aware of these systems, the strategy of [[Security through obscurity|Security Through Obscurity]] is no longer viable.
* [[Security through obscurity|Security Through Obscurity]] - Using non-standard, private or proprietary protocols or standards is detrimental to system security
The* Although the cyber threats and attack strategies on automation systems are changing rapidly . , Regulationregulation of industrial control systems for security is rare and is a slow-moving process. The United States, for example, only does so for the [[nuclear power in the United States|nuclear power]] and the [[chemical industry|chemical industries]].<ref name="gross201104">{{cite webmagazine|url=http://www.vanityfair.com/culture/features/2011/04/stuxnet-201104|title=A Declaration of Cyber-War|author=Gross, Michael Joseph |first=|date=2011-04-01| workmagazine=Vanity Fair|publisher=Condé Nast|archiveurl=https://web.archive.org/web/20140713082739/http://www.vanityfair.com/culture/features/2011/04/stuxnet-201104|archivedate=2014-07-13|accessdate=2017-11-29 |df=}}</ref> ▼
▲The cyber threats and attack strategies on automation systems are changing rapidly. Regulation of industrial control systems for security is rare and is a slow-moving process. The United States, for example, only does so for the [[nuclear power in the United States|nuclear power]] and the [[chemical industry|chemical industries]].<ref name="gross201104">{{cite web|url=http://www.vanityfair.com/culture/features/2011/04/stuxnet-201104|title=A Declaration of Cyber-War|author=Gross, Michael Joseph|first=|date=2011-04-01|work=Vanity Fair|publisher=Condé Nast|archiveurl=https://web.archive.org/web/20140713082739/http://www.vanityfair.com/culture/features/2011/04/stuxnet-201104|archivedate=2014-07-13|accessdate=2017-11-29|df=}}</ref>
== Government efforts ==
The U.S. Government [[Computer Emergency Readiness Team]] (US-CERT) originally instituted a [[control systems security program]] (CSSP) now the National Cybersecurity and Communications Integration Center (NCCIC) Industrial Control Systems, which has made available a large set of free National Institute of Standards and Technology (NIST) standards documents regarding control system security.<ref>{{cite web|url=http://www.us-cert.gov/control_systems/csstandards.html|title=Standards and References - NCCIC / ICS-CERT|website=ics-cert.us-cert.gov/|access-date=2010-10-27|archive-url=https://web.archive.org/web/20101026045026/http://www.us-cert.gov/control_systems/csstandards.html|archive-date=2010-10-26|url-status=dead}}</ref> The U.S. Government Joint Capability Technology Demonstration (JCTD) known as MOSIACSMOSAICS (More Situational Awareness for Industrial Control Systems) is the initial demonstration of cybersecurity defensive capability for critical infrastructure control systems.<ref>{{Cite web|title=More Situational Awareness For Industrial Control Systems (MOSAICS) Joint Capability Technology Demonstration (JCTD): A Concept Development for the Defense of Mission Critical Infrastructure – HDIAC|url=https://hdiac.org/articles/more-situational-awareness-for-industrial-control-systems-mosaics-joint-capability-technology-demonstration-jctd-a-concept-development-for-the-defense-of-mission-critical-infrastructure/|access-date=2021-07-31|language=en-US}}</ref> MOSAICS addresses the Department of Defense (DOD) operational need for cyber defense capabilities to defend critical infrastructure control systems from cyber attack, such as power, water and wastewater, and safety controls, affect the physical environment.<ref>{{Cite web|title=More Situational Awareness for Industrial Control Systems (MOSAICS): Engineering and Development of a Critical Infrastructure Cyber Defense Capability for Highly Context-Sensitive Dynamic Classes: Part 1 – Engineering – HDIAC|url=https://hdiac.org/articles/more-situational-awareness-for-industrial-control-systems-mosaics-engineering-and-development-of-a-critical-infrastructure-cyber-defense-capability-for-highly-context-sensitive-dynamic-classes-par/|access-date=2021-07-31|language=en-US}}</ref> The MOSAICS JCTD prototype will be shared with commercial industry through Industry Days for further research and development, an approach intended to lead to an innovative, game-changing capabilities for cybersecurity for critical infrastructure control systems.<ref>{{Cite web|title=More Situational Awareness for Industrial Control Systems (MOSAICS): Engineering and Development of a Critical Infrastructure Cyber Defense Capability for Highly Context-Sensitive Dynamic Classes: Part 2 – Development – HDIAC|url=https://hdiac.org/articles/more-situational-awareness-for-industrial-control-systems-mosaics-engineering-and-development-of-a-critical-infrastructure-cyber-defense-capability-for-highly-context-sensitive-dynamic-classes-par-2/|access-date=2021-07-31|language=en-US}}</ref>
== Automation and Control System Cybersecurity Standards ==
The international standard for cybersecurity of automation and control systems is the ISA/[[IEC 62443]]. In addition, multiple national organizations such as the NIST and NERC in the USA released guidelines and requirements for cybersecurity in control systems.
=== ISA/IEC 62443 ===
{{anchor|62443}}
{{Main|IEC 62443}}
The ISA/IEC 62443 cybersecurity standards define processes, techniques and requirements for Automation and Control Systems (ACSIACS). ResponsibilityThe forIEC these62443 standards liesand withtechnical areports collaborationare betweenorganized theinto ISA99four committeegeneral ofcategories thecalled International''General'', Society for Automation (ISA)''Policies and IECProcedures'', Technical''System,'' Committee''Component'', 65''Profiles'' Working Groupand 10''Evaluation''.
The ISA99 committee operates as an ANSI-accredited standards development organization (SDO) in the US. In IEC the standards creation process all national committees agree upon a common standard.
The ISA/IEC 62443 standards and technical reports are organized into four general categories called ''General'', ''Policies and Procedures'', ''System'' and ''Component''.
# The first category includes foundational information such as concepts, models and terminology.
# The third category includes work products that describe system design guidance and requirements for the secure integration of control systems. Core in this is the zone and conduit design model.
# The fourth category includes work products that describe the specific product development and technical requirements of control system products.
# The fifth category provides profiles for industry-specific cybersecurity requirements according to IEC 62443-1-5.
# The sixth category defines assessment methodologies that ensure that assessment results are consistent and reproducible.
===NERC===
===NIST===
{{Main|National Institute of Standards and Technology}}
The [[NIST Cybersecurity Framework]] (NIST CSF) provides a high-level taxonomy of cybersecurity outcomes and a methodology to assess and manage those outcomes. It is intended to help private sector organizations that provide [[critical infrastructure]] with guidance on how to protect it.<ref>{{cite web | url=https://www.nist.gov/cyberframework/ | title=NIST Cybersecurity Framework | accessdate=2016-08-02 }}</ref> ▼
▲TheAlthough it is not a standard, the [[NIST Cybersecurity Framework]] (NIST CSF) provides a high-level taxonomy of cybersecurity outcomes and a methodology to assess and manage those outcomes. It is intended to help private sector organizations that provide [[critical infrastructure]] with guidance on how to protect it.<ref>{{cite web | url=https://www.nist.gov/cyberframework/ | title=NIST Cybersecurity Framework | work=NIST | date=12 November 2013 | accessdate=2016-08-02 }}</ref>
NIST Special Publication 800-82 Rev. 2 "''Guide to Industrial Control System (ICS) Security''" describes how to secure multiple types of Industrial Control Systems against cyber attacks while considering the performance, reliability, and safety requirements specific to ICS.<ref>{{cite web | last=Stouffer | first=Keith | last2=Lightman | first2=Suzanne | last3=Pillitteri | first3=Victoria | last4=Abrams | first4=Marshall | last5=Hahn | first5=Adam | title=Guide to Industrial Control Systems (ICS) Security | website=CSRC | NIST | date=2015-06-03 | doi=10.6028/NIST.SP.800-82r2 | url=https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final | access-date=2020-12-29}}</ref> ▼
▲NIST Special Publication 800-82 Rev. 2 "''Guide to Industrial Control System (ICS) Security''" describes how to secure multiple types of Industrial Control Systems against cyber attacks while considering the performance, reliability, and safety requirements specific to ICS.<ref>{{cite webjournal | lastlast1=Stouffer | firstfirst1=Keith | last2=Lightman | first2=Suzanne | last3=Pillitteri | first3=Victoria | last4=Abrams | first4=Marshall | last5=Hahn | first5=Adam | title=Guide to Industrial Control Systems (ICS) Security | website=CSRC | NIST | date=2015-06-03 | doi=10.6028/NIST.SP.800-82r2 | url=https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final | access-date=2020-12-29}}</ref>
== Control system security certifications ==
| 