Build a cyber security incident response plan

A plan lets everyone respond properly to a control system security breach, whether it's a failure of a critical cyber component or an intentional break-in.

12/01/2009


 

PODCAST

tinyurl.com/yjtwxhw

Today’s modern industrial control systems are built on open system platforms and technologies. This means that what was once proprietary and closed is now more accessible—and therefore more vulnerable to intrusion. While we frequently hear reports about cyber security breaches in financial and consumer systems, we are now just starting to hear about such incidents reported on control systems. Many of these are the result of malicious activity, and others are the result of unintended consequences that result from a change made somewhere in the system, or an inappropriate use of the system.

It is best to be prepared and have an incident response plan in place. The purpose of the plan is to better prepare your organization for responding when there is suspicion of an incident to one of your control systems. This plan will allow you to properly respond to any type of cyber security incident—whether it is a failure of a critical cyber component, malicious software executing on your system or an intentional break-in to one of your control systems.

Components of the plan

An early part of the plan will be to describe the various types of incidents that may occur on your systems. These will range from simple failures such as a hard disk or CPU failure, infection of your system with a worm or virus, unintended consequences from changes made to the system, or a deliberate attack on the system from an insider or outsider.

The plan will describe who to call when such an incident occurs. The plan will include procedures for the responders to follow to determine the type of attack and how best to respond. The plan should also include procedures that will allow the process or plant to continue to operate while personnel are responding to the cyber security incident.

The plan should include definitions for additional responses where necessary. For example, if the security incident is the result of a virus or worm being introduced into the system, include actions that can be taken to delete the virus or worm, as well as procedures for how to prevent the incident from occurring again. This will require that an investigation be performed in order to determine how the virus or worm was introduced into the system.

Define forensics

The plan should also define what forensics are to be performed if the incident is intentional, and how to maintain the chain of custody of evidence gathered as part of the investigation. There are times when outside help is needed to resolve the problem, or to report the problem properly to comply with regulations. Therefore, reporting procedures and regulations should be documented in the plan as well. In many cases, the control system vendor has expertise in this area that can be very useful in creating the plan.

There are many more aspects to putting together a cyber security incident response plan for your industrial control systems. A good approach to use in creating the plan is to work with your IT organization as well as your vendors. Both will already have plans in place, and they will be able to assist in the creation of a plan for your industrial control systems. It is critical, as well, to get management support for the creation of the plan.

Once the plan is developed, all members of the organization will need to be trained on their role with respect to the incident response plan. Some may only need to know who to call, while others will require detailed training on how to respond.

One final note: Ensure the plan works. The execution of the plan should be practiced and updated with lessons learned. With a good cyber security incident response plan in place and understood, an organization can minimize the impact of an incident on its industrial control system.




References

www.security.honeywell.com/industrial/solutions/cyber/index.html


Author Information

Kevin Staggs is an Engineering Fellow with Honeywell Process Solutions and a member of the company’s global architecture team. This article is an excerpt from a Control Engineering podcast.




No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
Each year, a panel of Control Engineering editors and industry expert judges select the System Integrator of the Year Award winners.
Control Engineering Leaders Under 40 identifies and gives recognition to young engineers who...
Learn more about methods used to ensure that the integration between the safety system and the process control...
Adding industrial toughness and reliability to Ethernet eGuide
Technological advances like multiple-in-multiple-out (MIMO) transmitting and receiving
Virtualization advice: 4 ways splitting servers can help manufacturing; Efficient motion controls; Fill the brain drain; Learn from the HART Plant of the Year
Two sides to process safety: Combining human and technical factors in your program; Preparing HMI graphics for migrations; Mechatronics and safety; Engineers' Choice Awards
Detecting security breaches: Forensic invenstigations depend on knowing your networks inside and out; Wireless workers; Opening robotic control; Product exclusive: Robust encoders
The Ask Control Engineering blog covers all aspects of automation, including motors, drives, sensors, motion control, machine control, and embedded systems.
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
News and comments from Control Engineering process industries editor, Peter Welander.
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
This is a blog from the trenches – written by engineers who are implementing and upgrading control systems every day across every industry.
Anthony Baker is a fictitious aggregation of experts from Callisto Integration, providing manufacturing consulting and systems integration.
Integrator Guide

Integrator Guide

Search the online Automation Integrator Guide
 

Create New Listing

Visit the System Integrators page to view past winners of Control Engineering's System Integrator of the Year Award and learn how to enter the competition. You will also find more information on system integrators and Control System Integrators Association.

Case Study Database

Case Study Database

Get more exposure for your case study by uploading it to the Control Engineering case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.

These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.

Click here to visit the Case Study Database and upload your case study.