Safety in the Plant
and data acquisition, or Scada) security standards. Over the next few years, these standards will become core international standards for protecting critical industrial infrastructures that directly impact human safety, health, and the environment; and, likely will be extended to other areas of application, even broader than those generically labelled Scada. “Based on this, it is essential that industrial companies
following IEC62443 standards know they will be able to stop the next Stuxnet. The work of the new ISA99 task group will have a significant impact on ensuring that automation facilities are secure in the future,” adds the ISA.
Instrument evaluation
In another development, the International Instrument Users Association (WIB), an organisation that provides process instrumentation evaluation and assessment services for its over 25 end-user members, has announced version 2 of Process Control Domain Security Requirements For Vendors – the first international standard that outlines a set of specific requirements focusing on cybersecurity best practices for suppliers of industrial automation and control systems. “We are pleased to announce today the second version of
our cybersecurity standard,” said Alex van Delft, competence manager process control at DSM and chairman of the WIB. “This is an important step in the ongoing process to improve the reliability of our critical manufacturing and production systems and provides end-users the ability to now communicate their expectations about the security of process automation, control and safety systems.” With industrial networks being increasingly connected to
the hostile IT world, and the frequency and sophistication of malware growing exponentially, industrial stakeholders must act today to protect their critical systems. Whether it is a targeted attack like Stuxnet, or an accidental disruption, a single cyber incident can cost millions of Dollars in lost revenue, jeopardise employee and public safety and potentially disrupt national critical infrastructure, warns the WIB. “Our increasingly connected production systems are facing
a growing threat on a daily basis and we must do all we can to ensure a safe and secure operational environment,” said Peter Kwaspen, strategy & development manager, EMEA control & automation systems at Shell Projects & Technology. “This document provides the common language we need to communicate our expectations around security to our suppliers and the framework to work together to help improve the overall security posture for our critical systems.” Lead by companies such as Shell, BP, Saudi Aramco,
Dow, DuPont, Laborelec, Wintershall as well as leading vendors such as Invensys and Sensus and multiple government agencies, the group spent two years developing and piloting the programme and revising the requirements which culminated in the new version. “The security requirements outlined in the document went
through a year of comments/revisions from over 50 global stakeholders and were subjected to a thorough pilot certification programme over the last eight months,” said Jos Menting, cybersecurity advisor GDF Suez Group. “We’ve now come to a truly functional cybersecurity standard based on the needs of end-users and it is now up to us, the end-user, to take advantage of this effort and insist that our vendors are certified.”
Members of the WIB plant security working group have already started implementing the requirements into their procurement processes and others around the world are heeding the call, too. “Shell has mandated conformance to the WIB standard
for all vendors supplying systems to be deployed in Shell’s process control environment starting 1 January 2011,” said Ted Angevaare, EMEA control & automation systems team leader. “These requirements will become a standard part of the procurement language saving us a significant amount of time and effort.” Leading suppliers of industrial process control and
automation systems are also starting the process of integrating the requirements into their organisations. “Adopting the WIB’s security requirements ensures that
Invensys has a set of measurable practices in place that enforce a safer and more secure critical infrastructure. Not only do the requirements provide current-state measures, they allow us to continue to improve and adapt to the ever-changing security landscape.” said Ernie Rakaczky, programme manager for control systems cybersecurity at Invensys Operations Management “From our perspective, this programme is a major shift, not only focusing on tactics, but one that puts into place strategic elements that address operational change.” The WIB standard is designed to fit the needs of the
end-user - the system owner/operator - and reflects the unique requirements for industries like petrochemical, energy including smart grid, transportation, pharmaceutical, and chemical among others. The goal was to address cybersecurity best practices and allocate responsibility at the various stages of the industrial system lifecycle: organisational practices, product development, testing and commissioning and maintenance and support. “Security is not a one-time application but rather a
process in which every stakeholder must contribute in order to achieve any significant improvement in operational reliability,” said Auke Huistra, project manager at National Infrastructure against Cyber Crime (NICC). “The WIB requirements are designed with this principle at its core and we are encouraging critical infrastructure stakeholders in The Netherlands to integrate the requirements into their cybersecurity plans.” The requirements were also constructed to address a
broad range of cybersecurity topics relevant to industrial stakeholders; from high-level requirements for vendors’ internal security policies, procedures, and governance, to specific requirements concerning access/authentication, data protection, default password protection and patch management. When a vendor’s solution complies with this set of
requirements, the solution is considered by the WIB to be process control domain security compatible. The requirements are further broken down into three levels designed to reflect various starting points of global suppliers and provide a scalable framework to plan improvements over time. In the programme, there are gold, silver and bronze levels, each consisting of a set requirements designed to verify applicable policies and practices are in place, enabled and practiced by the vendor. ●
www.engineerlive.com 25
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36