Process Control Security Journey

Abstract

The issues associated with computer security are no longer the exclusive domain of information technology. The increasing use of commercial off-the-shelf (COTS) technologies in process control systems and networks makes them a potential target for various kinds of cyber attacks. The potential damage that can be caused if an attack is successful against a process control system can be substantial, if not catastrophic. Not only can production be impacted, but more importantly, safety can be compromised. It is therefore imperative that manufacturers understand the nature of potential threats, and that processes be put in place to prevent incidents as well as to deal with those that do occur. This paper will discuss one company's approach to understanding the nature of these threats, the risks associated with these threats, the business value of implementing a secure business to process architecture, and the experience gained by dealing with process control security. Discussed will be technology issues, organizational implications, and the recommended processes to put into place to insure that risks are minimized.