Cyber security issues take center stage in 2009

Many companies have been talking cyber security for quite a while, and now they'll have to do something about it.


While cyber security issues have been lurking in the background for some time now, 2009 will be the year they step into the light and probably your plant. Here’s why.

First and foremost, the NERC CIP (National Electric Reliability Corporation Critical Infrastructure Protection) regulations are coming into effect now. This may only affect power plants and larger utilities for the time being, but what happens through this implementation could hit you sooner than later.

This program has specific things that electrical producers must do to ensure the security of their systems and infrastructure, and this will likely serve as a model for other industries. The definition of “critical” will likely grow in scope as time goes on. Even if suspending the output of your plant will not cause the greater economy to grind to a halt, you might have things on your site that shouldn’t be released into the atmosphere, dumped into local waterways, set on fire, or detonated. Keeping those things from happening is critical.

Second, NIST (National Institute of Standards and Technology) will likely transition its NIST SP 800-82, DRAFT Guide to Industrial Control Systems (ICS) Security to an official release sometime in 2009. The comment period on the third and final draft closed on November 30, 2008. Unlike the NERC regulations, this is only a guide. However, it is already having a significant influence on security directions for industries that rely on industrial control systems, i.e., everyone. Publishing guides and standards is a crowded field, and there is no shortage of cyber security guides from a variety of organizations. This NIST guide is showing potential of emerging as the definitive work that can help tie together many of these standards written for specific industry verticals.

Third, the Control Systems Security Procurement Guidelines will be expanded to include some new technologies, including some wireless applications and advanced metering infrastructure. This document was started by the State of New York in an effort to create a practical guideline for how to add language to purchasing documents to specify a control systems that have security features built in. This has grown and become a very influential guide for evaluating existing systems as well as new purchases.

There are resources to help you as you sort through these issues.

Control Engineering now has an industrial cyber security blog that has already had extensive discussions of the NERC and NIST documents. If you follow that blog, you will receive useful and practical information. If you want to meet the bloggers, you can watch a video that introduces them, or if you can’t watch video online, listen to a podcast with the same discussion.

The SANS Institute will have its 2009 Process Control and SCADA Security Summit in Orlando, February 2-3. This will address many of these issues early in the year. The PCSF (Process Control System Forum) will likely also have a meeting later in 2009, but so far it has not announced a date.

The January issue of Control Engineering will contain a new article on the subject of changing cyber security issues, including a list of available resources with commentary.

Also, here are some earlier Control Engineering articles on the topic:

Cyber security for control systems: More tips, warnings from INL

Cyber security: Are you ready for federal interrogators?

Cyber security: CIA warns about industry hacking, extortion risks

—Peter Welander, process industries editor, ,
Process & Advanced Control Monthly eNewsletter
Register here and scroll down to select your choice of free eNewsletters .

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Robotic safety, collaboration, standards; DCS migration tips; IT/OT convergence; 2017 Control Engineering Salary and Career Survey
Integrated mobility; Artificial intelligence; Predictive motion control; Sensors and control system inputs; Asset Management; Cybersecurity
Big Data and IIoT value; Monitoring Big Data; Robotics safety standards and programming; Learning about PID
Featured articles highlight technologies that enable the Industrial Internet of Things, IIoT-related products and strategies to get data more easily to the user.
This article collection contains several articles on how automation and controls are helping human-machine interface (HMI) hardware and software advance.
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Mobility as the means to offshore innovation; Preventing another Deepwater Horizon; ROVs as subsea robots; SCADA and the radio spectrum
Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Big Data and bigger solutions; Tablet technologies; SCADA developments
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me