Cyber security issues take center stage in 2009

Many companies have been talking cyber security for quite a while, and now they'll have to do something about it.


While cyber security issues have been lurking in the background for some time now, 2009 will be the year they step into the light and probably your plant. Here’s why.

First and foremost, the NERC CIP (National Electric Reliability Corporation Critical Infrastructure Protection) regulations are coming into effect now. This may only affect power plants and larger utilities for the time being, but what happens through this implementation could hit you sooner than later.

This program has specific things that electrical producers must do to ensure the security of their systems and infrastructure, and this will likely serve as a model for other industries. The definition of “critical” will likely grow in scope as time goes on. Even if suspending the output of your plant will not cause the greater economy to grind to a halt, you might have things on your site that shouldn’t be released into the atmosphere, dumped into local waterways, set on fire, or detonated. Keeping those things from happening is critical.

Second, NIST (National Institute of Standards and Technology) will likely transition its NIST SP 800-82, DRAFT Guide to Industrial Control Systems (ICS) Security to an official release sometime in 2009. The comment period on the third and final draft closed on November 30, 2008. Unlike the NERC regulations, this is only a guide. However, it is already having a significant influence on security directions for industries that rely on industrial control systems, i.e., everyone. Publishing guides and standards is a crowded field, and there is no shortage of cyber security guides from a variety of organizations. This NIST guide is showing potential of emerging as the definitive work that can help tie together many of these standards written for specific industry verticals.

Third, the Control Systems Security Procurement Guidelines will be expanded to include some new technologies, including some wireless applications and advanced metering infrastructure. This document was started by the State of New York in an effort to create a practical guideline for how to add language to purchasing documents to specify a control systems that have security features built in. This has grown and become a very influential guide for evaluating existing systems as well as new purchases.

There are resources to help you as you sort through these issues.

Control Engineering now has an industrial cyber security blog that has already had extensive discussions of the NERC and NIST documents. If you follow that blog, you will receive useful and practical information. If you want to meet the bloggers, you can watch a video that introduces them, or if you can’t watch video online, listen to a podcast with the same discussion.

The SANS Institute will have its 2009 Process Control and SCADA Security Summit in Orlando, February 2-3. This will address many of these issues early in the year. The PCSF (Process Control System Forum) will likely also have a meeting later in 2009, but so far it has not announced a date.

The January issue of Control Engineering will contain a new article on the subject of changing cyber security issues, including a list of available resources with commentary.

Also, here are some earlier Control Engineering articles on the topic:

Cyber security for control systems: More tips, warnings from INL

Cyber security: Are you ready for federal interrogators?

Cyber security: CIA warns about industry hacking, extortion risks

—Peter Welander, process industries editor, ,
Process & Advanced Control Monthly eNewsletter
Register here and scroll down to select your choice of free eNewsletters .

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
Each year, a panel of Control Engineering editors and industry expert judges select the System Integrator of the Year Award winners.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Learn how to create value with re-use; gain productivity with lean automation and connectivity, and optimize panel design and construction.
Go deep: Automation tackles offshore oil challenges; Ethernet advice; Wireless robotics; Product exclusives; Digital edition exclusives
Lost in the gray scale? How to get effective HMIs; Best practices: Integrate old and new wireless systems; Smart software, networks; Service provider certifications
Fixing PID: Part 2: Tweaking controller strategy; Machine safety networks; Salary survey and career advice; Smart I/O architecture; Product exclusives
The Ask Control Engineering blog covers all aspects of automation, including motors, drives, sensors, motion control, machine control, and embedded systems.
Look at the basics of industrial wireless technologies, wireless concepts, wireless standards, and wireless best practices with Daniel E. Capano of Diversified Technical Services Inc.
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
This is a blog from the trenches – written by engineers who are implementing and upgrading control systems every day across every industry.
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Case Study Database

Case Study Database

Get more exposure for your case study by uploading it to the Control Engineering case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.

These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.

Click here to visit the Case Study Database and upload your case study.