Legacy technology: Will cyber security concerns shut down that old DCS?
Cyber security issues are becoming more critical, almost by the day. DCS vendors are working diligently on increasing the security provisions of current and new networking and control products, but what about old systems that are still operating and not slated for replacement? Can these be adequately defended in an increasingly threatening world? The answer is a heavily qualified yes.
Here are some of the possibilities:
Your original vendor may provide some security strategies. This is highly dependent on what you have and how old it is, but it never hurts to ask.
You can create perimeter defenses through firewalls or DMZs placed where the DCS connects to outside networks. This hardens your exterior.
To give yourself defense-in-depth, there are small device level firewalls and other devices that can be distributed at strategic points throughout the system. These can be effective and invisible when done correctly. When done poorly, they can add intolerable latency issues to a system.
If these other approaches aren't practical, your only choice is to isolate the system so it effectively cannot be reached at all from the outside.
At the recent PCSF event in Atlanta, Gary Finco, senior SCADA advisor from Idaho National Labs , said it all comes down to pocketbook issues. Adding "bolt-on" security to an operating DCS, even if the process is difficult, is probably much less expensive than scrapping it and bringing in something more up-to-date. A new system will be costly, especially when you consider the installation, commissioning, and training issues involved with a new DCS.
Gary and a group of cyber security experts from INL recorded a podcast about their work and resources they've made available to end users. Click here to listen .