Build a cyber security incident response plan

PODCAST

https://tinyurl.com/yjtwxhw

Today’s modern industrial control systems are built on open system platforms and technologies. This means that what was once proprietary and closed is now more accessible—and therefore more vulnerable to intrusion. While we frequently hear reports about cyber security breaches in financial and consumer systems, we are now just starting to hear about such incidents reported on control systems. Many of these are the result of malicious activity, and others are the result of unintended consequences that result from a change made somewhere in the system, or an inappropriate use of the system.

It is best to be prepared and have an incident response plan in place. The purpose of the plan is to better prepare your organization for responding when there is suspicion of an incident to one of your control systems. This plan will allow you to properly respond to any type of cyber security incident—whether it is a failure of a critical cyber component, malicious software executing on your system or an intentional break-in to one of your control systems.

Components of the plan

An early part of the plan will be to describe the various types of incidents that may occur on your systems. These will range from simple failures such as a hard disk or CPU failure, infection of your system with a worm or virus, unintended consequences from changes made to the system, or a deliberate attack on the system from an insider or outsider.

The plan will describe who to call when such an incident occurs. The plan will include procedures for the responders to follow to determine the type of attack and how best to respond. The plan should also include procedures that will allow the process or plant to continue to operate while personnel are responding to the cyber security incident.

The plan should include definitions for additional responses where necessary. For example, if the security incident is the result of a virus or worm being introduced into the system, include actions that can be taken to delete the virus or worm, as well as procedures for how to prevent the incident from occurring again. This will require that an investigation be performed in order to determine how the virus or worm was introduced into the system.

Define forensics

The plan should also define what forensics are to be performed if the incident is intentional, and how to maintain the chain of custody of evidence gathered as part of the investigation. There are times when outside help is needed to resolve the problem, or to report the problem properly to comply with regulations. Therefore, reporting procedures and regulations should be documented in the plan as well. In many cases, the control system vendor has expertise in this area that can be very useful in creating the plan.

There are many more aspects to putting together a cyber security incident response plan for your industrial control systems. A good approach to use in creating the plan is to work with your IT organization as well as your vendors. Both will already have plans in place, and they will be able to assist in the creation of a plan for your industrial control systems. It is critical, as well, to get management support for the creation of the plan.

Once the plan is developed, all members of the organization will need to be trained on their role with respect to the incident response plan. Some may only need to know who to call, while others will require detailed training on how to respond.

One final note: Ensure the plan works. The execution of the plan should be practiced and updated with lessons learned. With a good cyber security incident response plan in place and understood, an organization can minimize the impact of an incident on its industrial control system.

References

www.security.honeywell.com/industrial/solutions/cyber/index.html

Author Information

Kevin Staggs is an Engineering Fellow with Honeywell Process Solutions and a member of the company’s global architecture team. This article is an excerpt from a Control Engineering podcast.

Do you have experience and expertise with the topics mentioned in this content? You should consider contributing to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.