Cyber security issues take center stage in 2009

Many companies have been talking cyber security for quite a while, and now they'll have to do something about it.

By Control Engineering Staff January 5, 2009

While cyber security issues have been lurking in the background for some time now, 2009 will be the year they step into the light and probably your plant. Here’s why.

First and foremost, the NERC CIP (National Electric Reliability Corporation Critical Infrastructure Protection) regulations are coming into effect now. This may only affect power plants and larger utilities for the time being, but what happens through this implementation could hit you sooner than later.

This program has specific things that electrical producers must do to ensure the security of their systems and infrastructure, and this will likely serve as a model for other industries. The definition of “critical” will likely grow in scope as time goes on. Even if suspending the output of your plant will not cause the greater economy to grind to a halt, you might have things on your site that shouldn’t be released into the atmosphere, dumped into local waterways, set on fire, or detonated. Keeping those things from happening is critical.

Second, NIST (National Institute of Standards and Technology) will likely transition its NIST SP 800-82, DRAFT Guide to Industrial Control Systems (ICS) Security to an official release sometime in 2009. The comment period on the third and final draft closed on November 30, 2008. Unlike the NERC regulations, this is only a guide. However, it is already having a significant influence on security directions for industries that rely on industrial control systems, i.e., everyone. Publishing guides and standards is a crowded field, and there is no shortage of cyber security guides from a variety of organizations. This NIST guide is showing potential of emerging as the definitive work that can help tie together many of these standards written for specific industry verticals.

Third, the Control Systems Security Procurement Guidelines will be expanded to include some new technologies, including some wireless applications and advanced metering infrastructure. This document was started by the State of New York in an effort to create a practical guideline for how to add language to purchasing documents to specify a control systems that have security features built in. This has grown and become a very influential guide for evaluating existing systems as well as new purchases.

There are resources to help you as you sort through these issues.

Control Engineering now has an industrial cyber security blog that has already had extensive discussions of the NERC and NIST documents. If you follow that blog, you will receive useful and practical information. If you want to meet the bloggers, you can watch a video that introduces them, or if you can’t watch video online, listen to a podcast with the same discussion.

The SANS Institute will have its 2009 Process Control and SCADA Security Summit in Orlando, February 2-3. This will address many of these issues early in the year. The PCSF (Process Control System Forum) will likely also have a meeting later in 2009, but so far it has not announced a date.

The January issue of Control Engineering will contain a new article on the subject of changing cyber security issues, including a list of available resources with commentary.

Also, here are some earlier Control Engineering articles on the topic:

Cyber security for control systems: More tips, warnings from INL

Cyber security: Are you ready for federal interrogators? Cyber security: CIA warns about industry hacking, extortion risks

—Peter Welander, process industries editor, PWelander@cfemedia.com , Process & Advanced Control Monthly eNewsletter Register here and scroll down to select your choice of free eNewsletters .