Why Robust Industrial Control System Security is Essential to Your Business

December 11, 2017

Automation is the name of the game for today’s manufacturers and operators of critical infrastructure. The global market for industrial control and factory automation is expected to grow steadily at a compound annual growth rate (CAGR) of 7.4 percent between 2017 and 2023, from its current value of USD 145 billion¹. Powering this growth is the Industrial Internet of Things (IIoT), which allows operators to connect a multitude of individual devices and control systems through wireless networks.

Automated industrial control systems (ICS) offer many benefits, including the ability for an organization to:

• Easily control and monitor assets remotely;
• Optimize efficiencies and achieve cost savings;
• Perform preventative diagnostics to predict failures;
• Improve scheduled maintenance routines; and
• Immediately detect and address any faults.

To reap the benefits however, these connected systems must be secure. Cyber-attacks are on the rise as more industries continue to invest in smart technologies. Control systems are also vital to the operation of critical infrastructure, such as our power grids, which are consistently targeted by sophisticated hackers. A breach of any of these systems can have dire consequences, not only to the businesses that operate them, but also their customers and surrounding communities. That’s why the ICS security market size is expected to grow from USD 10.24 billion in 2017 to USD 13.88 billion by 2022, at a CAGR of 6.3 percent².

In some cases, regular IT cybersecurity programs do not offer sufficient protection for ICS. That is because ICS applications control both digital and physical assets—so any malfunction or breach can have a direct impact on the physical world. The health and safety of workers and others nearby can be jeopardized, the environment may also be put at risk, and the businesses operating the system can suffer production losses or have their proprietary information compromised.

Since cybersecurity is essential to the safe and reliable operation of modern industrial processes, the International Electrotechnical Commission (IEC), International Society of Automation and National Institute of Standards and Technology (NIST) recommend that ICS security should always be part of broader ICS safety and reliability programs at both industrial sites and in enterprise cybersecurity programs³. Some elements of their recommended strategies for ICS security include:

• Developing security policies, procedures, training, and educational material
• Addressing security throughout the entire lifecycle of the ICSImplementing a network topology that has multiple layers, with the most critical communications occurring in the most secure and reliable layer
• Separating corporate and ICS networks
• Establishing separate authentication mechanisms and credentials for users of the ICS and corporate networks
• Restricting physical access to ICS networks and devices
• Building redundancies in system components and networks
• Designing critical systems for graceful degradation to prevent catastrophic cascading events

Evidently, both functional safety and cybersecurity are critical to ICS. A safety instrumented system ensures that a corrective device or mechanism is activated once a potentially dangerous condition is detected. That functionality needs to be mirrored by a strong cybersecurity program that can monitor and address potential cyber threats on an ongoing basis.

CSA Group—a leading standards development organization and global provider of testing, inspection, and certification services—offers both evaluation programs.

“In an increasingly digital world, companies are finding that they need both functional safety and cyber security,” says Adam Garner, CSA Group’s global business unit director for the industrial sector. “The two services go hand-in-hand to help ensure the safety of a company’s assets, information, and people, as well as the surrounding environment. You really can’t have one without the other anymore.”

The company’s functional safety evaluation aligns with IEC 61508, the umbrella standard for functional safety of industrial electrical, electronic, programmable electronic devices (E/E/PE) and other safety-related systems. The evaluation provides methods for assessing hazards and risks, establishing necessary safety functions, and defining the appropriate Safety Integrity Level designation to reduce risk to a specified acceptable level.

CSA Group’s cybersecurity services combine its well-established expertise in functional safety evaluation with its long history of working with emerging technologies. These services involve working closely with businesses of all sizes to develop tailored solutions that can help identify potential issues early in the product design phase, and implement security measures to mitigate potential cyber risk. The comprehensive set of tests and evaluations are also based on international standards, such as IEC 62433 Cybersecurity Standards, NIST Guide 800 series, and the ISO 27000 Security Management Standards.

Ultimately, these two evaluation programs work together to offer greater assurance that the products and systems being delivered to market can mitigate cyber threats and help protect the physical world around them.

Contact CSA Group to learn more functional safety and cybersecurity for ICS.

---

1 Markets and Markets, “Industrial Control and Factory Automation Market by Solution (SCADA, PLC, DCS, MES, PLM, PAM, Functional Safety), Component (Industrial Robots, Industrial 3D Printing, Control Valves, Machine Vision, HMI), Industry and Geography – Global Forecast to 2023”, October 2017.
2 Markets and Markets, “Industrial Control Systems Security Market by Solution (Firewall, Antivirus/Anti–Malware, Identity and Access Management, Security Information & Event Management, DDOS, UTM), Service, Security Type, Vertical, and Region – Global Forecast to 2022”, June 2017.
3 NIST, “Guide to Industrial Control Systems (ICS) Security”, May 2015.