Examining the industrial control system cyber risk gap
The missing link that may put your organization in jeopardy
Industrial control systems (ICS) are command network and systems devices designed to monitor and control industrial processes. As an enabler of business innovation and efficiency, more of these systems are connected to the Internet. As a result of this increased connectivity, the threat of exposure has risen and so have the corresponding business and compliance risks.
Industrial control systems and cyber risk
The ICS family includes supervisory control and data acquisition (SCADA) systems, distributed control systems, and other control system configurations. ICS were initially designed for, and deployed in, isolated networks, running on proprietary protocols with custom software. As a result, the exposure of these systems to cyber threats was limited.
Today, as an enabler of business innovation and efficiency, more ICS systems are connected to the Internet, either directly or through the corporate networks, and are remotely accessible to allow remote process monitoring, system maintenance, process control, and production data analysis. Accordingly, the threat of exposure has risen and so have the corresponding business and compliance risks.
These business needs have led to the convergence of enterprise resource planning systems, manufacturing execution systems, and SCADA systems. By providing increased access to industrial process data, these innovations allow manufacturers to make better business decisions. In addition, manufacturers have extended their manufacturing and supply chain processes and systems beyond their own organization to include supplier and customer processes and systems.
Although these developments improve business productivity, they have also made companies more reliant on the security posture of their suppliers and consumers. In addition, disruption to these systems can directly impact the process flow between the supplier and consumers. IT security specialists often do not fully understand the industrial processes supported by ICS, and ICS specialists do not always fully understand modern IT security risks. As a result, companies are often not aware of, or prepared to address, the full range of security and business-related risks that stem from the connected ICS environment.
This lack-security awareness and safeguards can have serious consequences. While years of effort may be invested in reaping the benefits of convergence, a serious cyber incident—in a matter of minutes, hours, or days—could erode these gains by causing revenue loss; brand damage; and loss of customer trust, theft of intellectual property, safety issues, and even loss of life. These costs can be far-reaching. While the direct costs of analyzing and repairing technical damage can be significant, the ongoing litigation and loss of operational productivity can be even greater. This paper will discuss common ICS cyber risks in greater detail, and presents important steps companies may need to take toward a more comprehensive cyber risk program.
We have found it highly effective to think about cyber risk management using the following paradigm:
- Secure: Effective risk management begins by preventing system breaches or compromises. This may include controls of many layers, types, and approaches, because the potential attacks are quite effective at exploiting weaknesses never imagined by their creators. We lock our doors because thieves might enter through them. Similarly, we physically “harden” sensors on power plants to protect them from accidental or deliberate assaults, and install software firewalls to keep out hackers.
- Vigilant: The nature and intensity of attacks can change in ways that render previously effective security measures obsolete. No degree of security is perfect. Best efforts still leave any system vulnerable. Consequently, security must be complemented by vigilance, monitoring to determine whether a system is still secure or has been compromised.
- Resilient: When a breach occurs, limiting the damage and reestablishing normal operations are much more easily and effectively done when there are processes in place to quickly neutralize threats, prevent further spread, and recover.
Cyber risk programs built on this framework can help manufacturing companies innovate with greater confidence by giving balanced attention to the cyber risks inherent in a connected ICS environment.