The emergence of the Stuxnet worm last summer has forced process companies to redouble their cybersecurity efforts. It has also provoked a lot of activity from various standards authorities.
On 3 March, for example, the International Society of Automation (ISA) announced that the ISA99 standards committee on Industrial Automation and Control Systems Security has formed a task group tasked to 'conduct a gap analysis of the current ANSI/ISA99 standards with respect to the rapidly evolving threat landscape'.
This primarily means Stuxnet, which was targeted mainly at Siemens programmable logic controllers (Fig.1).
The purpose of the analysis to determine if companies following the ISA99 standards would have been protected from such sophisticated attacks and to identify changes needed, if any, to the standards being developed by the ISA99 committee. The new task group intends to produce a technical report summarising the results of its analysis by mid-2011.
According to the ISA, Stuxnet is the first known malware to have been specifically written with the intent to compromise a control system and sabotage an industrial process.
"Stuxnet's capabilities are being well documented in the press, and some of these capabilities may migrate into new threats. Going forward, automation systems must be able to detect and either block or be able to recover from advanced Stuxnet-like threats," says the organisation.
The ANSI/ISA99 standards address the vital issue of cybersecurity for industrial automation and control systems. The standards describe the basic concepts and models related to cybersecurity, as well as the elements contained in a cybersecurity management system for use in the industrial automation and control systems environment. They also provide guidance on how to meet the requirements described for each element.
The standards form the base documents for the IEC 62443 series of industrial automation (sometimes generically labelled supervisory control and data acquisition, or Scada) security standards. Over the next few years, these standards will become core international standards for protecting critical industrial infrastructures that directly impact human safety, health, and the environment; and, likely will be extended to other areas of application, even broader than those generically labelled Scada.
"Based on this, it is essential that industrial companies following IEC62443 standards know they will be able to stop the next Stuxnet. The work of the new ISA99 task group will have a significant impact on ensuring that automation facilities are secure in the future," adds the ISA.
Instrument evaluation
In another development, the International Instrument Users Association (WIB), an organisation that provides process instrumentation evaluation and assessment services for its over 25 end-user members, has announced version 2 of Process Control Domain Security Requirements For Vendors - the first international standard that outlines a set of specific requirements focusing on cybersecurity best practices for suppliers of industrial automation and control systems.
"We are pleased to announce today the second version of our cybersecurity standard," said Alex van Delft, competence manager process control at DSM and chairman of the WIB. "This is an important step in the ongoing process to improve the reliability of our critical manufacturing and production systems and provides end-users the ability to now communicate their expectations about the security of process automation, control and safety systems."
With industrial networks being increasingly connected to the hostile IT world, and the frequency and sophistication of malware growing exponentially, industrial stakeholders must act today to protect their critical systems. Whether it is a targeted attack like Stuxnet, or an accidental disruption, a single cyber incident can cost millions of Dollars in lost revenue, jeopardise employee and public safety and potentially disrupt national critical infrastructure, warns the WIB.
"Our increasingly connected production systems are facing a growing threat on a daily basis and we must do all we can to ensure a safe and secure operational environment," said Peter Kwaspen, strategy & development manager, EMEA control & automation systems at Shell Projects & Technology. "This document provides the common language we need to communicate our expectations around security to our suppliers and the framework to work together to help improve the overall security posture for our critical systems."
Lead by companies such as Shell, BP, Saudi Aramco, Dow, DuPont, Laborelec, Wintershall as well as leading vendors such as Invensys and Sensus and multiple government agencies, the group spent two years developing and piloting the programme and revising the requirements which culminated in the new version.
"The security requirements outlined in the document went through a year of comments/revisions from over 50 global stakeholders and were subjected to a thorough pilot certification programme over the last eight months," said Jos Menting, cybersecurity advisor GDF Suez Group. "We've now come to a truly functional cybersecurity standard based on the needs of end-users and it is now up to us, the end-user, to take advantage of this effort and insist that our vendors are certified."
Members of the WIB plant security working group have already started implementing the requirements into their procurement processes and others around the world are heeding the call, too.
"Shell has mandated conformance to the WIB standard for all vendors supplying systems to be deployed in Shell's process control environment starting 1 January 2011," said Ted Angevaare, EMEA control & automation systems team leader. "These requirements will become a standard part of the procurement language saving us a significant amount of time and effort."
Leading suppliers of industrial process control and automation systems are also starting the process of integrating the requirements into their organisations.
"Adopting the WIB's security requirements ensures that Invensys has a set of measurable practices in place that enforce a safer and more secure critical infrastructure. Not only do the requirements provide current-state measures, they allow us to continue to improve and adapt to the ever-changing security landscape." said Ernie Rakaczky, programme manager for control systems cybersecurity at Invensys Operations Management "From our perspective, this programme is a major shift, not only focusing on tactics, but one that puts into place strategic elements that address operational change."
The WIB standard is designed to fit the needs of the end-user - the system owner/operator - and reflects the unique requirements for industries like petrochemical, energy including smart grid, transportation, pharmaceutical, and chemical among others. The goal was to address cybersecurity best practices and allocate responsibility at the various stages of the industrial system lifecycle: organisational practices, product development, testing and commissioning and maintenance and support.
"Security is not a one-time application but rather a process in which every stakeholder must contribute in order to achieve any significant improvement in operational reliability," said Auke Huistra, project manager at National Infrastructure against Cyber Crime (NICC). "The WIB requirements are designed with this principle at its core and we are encouraging critical infrastructure stakeholders in The Netherlands to integrate the requirements into their cybersecurity plans."
The requirements were also constructed to address a broad range of cybersecurity topics relevant to industrial stakeholders; from high-level requirements for vendors' internal security policies, procedures, and governance, to specific requirements concerning access/authentication, data protection, default password protection and patch management.
When a vendor's solution complies with this set of requirements, the solution is considered by the WIB to be process control domain security compatible. The requirements are further broken down into three levels designed to reflect various starting points of global suppliers and provide a scalable framework to plan improvements over time. In the programme, there are gold, silver and bronze levels, each consisting of a set requirements designed to verify applicable policies and practices are in place, enabled and practiced by the vendor
A holistic approach to cybersecurityWithin the identified critical infrastructures of nations around the world, control vendors with their control systems and applications are continuously playing a vital role in their safe and reliable operations.
Equally these same systems could have a huge potential of a possible cybersecurity risk if strong measures are not put into practice.
According to Ernie Rakaczky, program manager for control systems cybersecurity at Invensys Operations Management, a holistic approach is needed to ensure the security of control systems.
This approach involves: viewing security from both management and technical perspectives; ensuring security is addressed from both an IT and control system perspective; designing and developing multiple layers of network, system and application security; ensuring industry, regulatory and international standards are taken into account; realising that prevention is critical in plant control systems, supported by detection; and providing support and guidance in the establishment of compliance with industry requirements currently being established.
"In general, view cybersecurity as a very strong on-going operational requirement embedded in the everyday operational procedures: like physical safety we see cybersecurity becoming an operational way of life," says Rakaczky.
For vendors, he says, this means ensuring that products and solutions are: developed utilising the best- in-class security development life-cycle programmes; tested through national labs testing programmes; implemented using security base-lining measures; supported by the required infrastructure during their lifetime; and capable of being improved by modernisation and migration programmes.
