Cyber security issues take center stage in 2009

Many companies have been talking cyber security for quite a while, and now they'll have to do something about it.


While cyber security issues have been lurking in the background for some time now, 2009 will be the year they step into the light and probably your plant. Here’s why.

First and foremost, the NERC CIP (National Electric Reliability Corporation Critical Infrastructure Protection) regulations are coming into effect now. This may only affect power plants and larger utilities for the time being, but what happens through this implementation could hit you sooner than later.

This program has specific things that electrical producers must do to ensure the security of their systems and infrastructure, and this will likely serve as a model for other industries. The definition of “critical” will likely grow in scope as time goes on. Even if suspending the output of your plant will not cause the greater economy to grind to a halt, you might have things on your site that shouldn’t be released into the atmosphere, dumped into local waterways, set on fire, or detonated. Keeping those things from happening is critical.

Second, NIST (National Institute of Standards and Technology) will likely transition its NIST SP 800-82, DRAFT Guide to Industrial Control Systems (ICS) Security to an official release sometime in 2009. The comment period on the third and final draft closed on November 30, 2008. Unlike the NERC regulations, this is only a guide. However, it is already having a significant influence on security directions for industries that rely on industrial control systems, i.e., everyone. Publishing guides and standards is a crowded field, and there is no shortage of cyber security guides from a variety of organizations. This NIST guide is showing potential of emerging as the definitive work that can help tie together many of these standards written for specific industry verticals.

Third, the Control Systems Security Procurement Guidelines will be expanded to include some new technologies, including some wireless applications and advanced metering infrastructure. This document was started by the State of New York in an effort to create a practical guideline for how to add language to purchasing documents to specify a control systems that have security features built in. This has grown and become a very influential guide for evaluating existing systems as well as new purchases.

There are resources to help you as you sort through these issues.

Control Engineering now has an industrial cyber security blog that has already had extensive discussions of the NERC and NIST documents. If you follow that blog, you will receive useful and practical information. If you want to meet the bloggers, you can watch a video that introduces them, or if you can’t watch video online, listen to a podcast with the same discussion.

The SANS Institute will have its 2009 Process Control and SCADA Security Summit in Orlando, February 2-3. This will address many of these issues early in the year. The PCSF (Process Control System Forum) will likely also have a meeting later in 2009, but so far it has not announced a date.

The January issue of Control Engineering will contain a new article on the subject of changing cyber security issues, including a list of available resources with commentary.

Also, here are some earlier Control Engineering articles on the topic:

Cyber security for control systems: More tips, warnings from INL

Cyber security: Are you ready for federal interrogators?

Cyber security: CIA warns about industry hacking, extortion risks

—Peter Welander, process industries editor, ,
Process & Advanced Control Monthly eNewsletter
Register here and scroll down to select your choice of free eNewsletters .

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Intelligent, efficient PLC programming: Cost-saving programming languages are available now; Automation system upgrades; Help from the cloud; Improving flow control; System integration tips
Smarter machines require smarter systems; Fixing PID, part 3; Process safety; Hardware and software integration; Legalities: Integrated lean project delivery
Choosing controllers: PLCs, PACs, IPCs, DCS? What's best for your application?; Wireless trends; Design, integration; Manufacturing Day; Product Exclusive
PLCs, robots, and the quest for a single controller; how OEE is key to automation solutions.
This article collection contains several articles on improving the use of PID.
Learn how Industry 4.0 adds supply chain efficiency, optimizes pricing, improves quality, and more.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Special report: U.S. natural gas; LNG transport technologies evolve to meet market demand; Understanding new methane regulations; Predictive maintenance for gas pipeline compressors
Cyber security cost-efficient for industrial control systems; Extracting full value from operational data; Managing cyber security risks
Drilling for Big Data: Managing the flow of information; Big data drilldown series: Challenge and opportunity; OT to IT: Creating a circle of improvement; Industry loses best workers, again