Safety in the Plant
and data acquisition, or Scada) security standards. Over the next few years, these standards will become core international standards for protecting critical industrial infrastructures that directly impact human safety, health, and the environment; and, likely will be extended to other areas of application, even broader than those generically labelled Scada. “Based on this, it is essential that industrial companies
following IEC 62443 standards know they will be able to stop the next Stuxnet. The work of the new ISA99 task group will have a significant impact on ensuring that automation facilities are secure in the future,” adds the ISA.
Instrument evaluation In another development, the International Instrument Users Association (WIB), an organisation that provides process instrumentation evaluation and assessment services for its over 25 end-user members, has announced version 2 of Process Control Domain Security Requirements For Vendors – the first international standard that outlines a set of specific requirements focusing on cybersecurity best practices for suppliers of industrial automation and control systems. “We are pleased to announce today the second version of
our cybersecurity standard,” said Alex van Delft, competence manager process control at DSM and chairman of the WIB. “This is an important step in the ongoing process to improve the reliability of our critical manufacturing and production systems and provides end-users the ability to now communicate their expectations about the security of process automation, control and safety systems.” With industrial networks being increasingly connected to
the hostile IT world, and the frequency and sophistication of malware growing exponentially, industrial stakeholders must act today to protect their critical systems. Whether it is a targeted attack like Stuxnet, or an accidental disruption, a single cyber incident can cost millions of Dollars in lost revenue, jeopardise employee and public safety and potentially disrupt national critical infrastructure, warns the WIB. “Our increasingly connected production systems are facing
a growing threat on a daily basis and we must do all we can to ensure a safe and secure operational environment,” said Peter Kwaspen, strategy & development manager, EMEA control & automation systems at Shell Projects & Technology.
“This document provides the common language we need to communicate our expectations around security to our suppliers and the framework to work together to help improve the overall security posture for our critical systems.” Lead by companies such as Shell, BP, Saudi Aramco,
Dow, DuPont, Laborelec, Wintershall as well as leading vendors such as Invensys and Sensus and multiple government agencies, the group spent two years developing and piloting the programme and revising the requirements which culminated in the new version. “The security requirements outlined in the document went
through a year of comments/revisions from over 50 global stakeholders and were subjected to a thorough pilot certification programme over the last eight months,” said Jos Menting, cybersecurity advisor GDF Suez Group. “We’ve now come to a truly functional cybersecurity standard based on the needs of end-users and it is now up to us, the end-user, to take advantage of this effort and insist that our vendors are certified.” Members of the WIB plant security working group have
already started implementing the requirements into their procurement processes and others around the world are heeding the call, too. “Shell has mandated conformance to the WIB standard
for all vendors supplying systems to be deployed in Shell’s process control environment starting 1 January 2011,” said Ted Angevaare, EMEA control & automation systems team leader. “These requirements will become a standard part of the procurement language saving us a significant amount of time and effort.” Leading suppliers of industrial process control and
automation systems are also starting the process of integrating the requirements into their organisations. “Adopting the WIB’s security requirements ensures that
Invensys has a set of measurable practices in place that enforce a safer and more secure critical infrastructure. Not only do the requirements provide current-state measures, they allow us to continue to improve and adapt to the ever-changing security landscape.” said Ernie Rakaczky, programme manager for control systems cybersecurity at Invensys Operations Management “From our perspective, this programme is a major shift, not only focusing on tactics, but one that puts into place strategic elements that address operational change.”
A holistic approach to cybersecurity
their control systems and applications are continuously playing a vital role in their safe and reliable operations.
W
Equally these same systems could have a huge potential of a possible cybersecurity risk if strong measures are not put into practice. According to Ernie Rakaczky, program manager for control systems cybersecurity at Invensys Operations Management, a holistic approach is needed to ensure the security of control systems.
32
www.engineerlive.com
ithin the identified critical infrastructures of nations around the world, control vendors with
This approach involves: viewing security from both management and technical perspectives; ensuring security is addressed from both an IT and control system perspective; designing and developing multiple layers of network, system and application security; ensuring industry, regulatory and international standards are taken into account; realising that prevention is critical in plant control systems, supported by detection; and providing support and guidance in the establishment of compliance with industry requirements currently being established.
“In general, view cybersecurity as a very
strong on-going operational requirement embedded in the everyday operational procedures: like physical safety we see cybersecurity becoming an operational way of life,” says Rakaczky.
For vendors, he says, this means ensuring that products and solutions are: developed utilising the best- in-class security development life-cycle programmes; tested through national labs testing programmes; implemented using security base-lining measures; supported by the required infrastructure during their lifetime; and capable of being improved by modernisation and migration programmes. ■
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52