Recently we looked at the state of ICS security according to the 2016 SANS survey and commented on how a broader set of tools is becoming available to secure industrial automation systems. Many industrial engineers will likely not be familiar with these new-to-ICS technologies, which include things like configuration compliance monitoring and threat intelligence engines.

Do you believe that your control system is in more danger from cyberattacks now than it was a year ago? How does this compare with what other organizations are experiencing? How does your company compare to others in terms of doing security assessments? What security initiatives are others prioritizing?

A common best practice in any field is to benchmark performance or results against industry norms. In the case of industrial control systems (ICS), security breach benchmarking is a challenge.

Two things that make ICS cybersecurity different from IT security are the use of industrial-specific protocols like DNP3 and the common usage of endpoints like PLCs, IEDs and RTUs that are 15+ years old. Both of these factors are significant in industries that depend on WAN communication networks, such as power, water/wastewater, transportation plus oil and gas systems.

An important best practice for industrial security is to implement a Defense in Depth strategy. With this approach, multiple layers of defense are implemented, in contrast to just one defense mechanism, such as a single firewall. A complementary best practice used as part of a Defense is Depth strategy is Zones and Conduits, as defined in the ISA IEC 62443 standard. This involves segmenting the network into zones of devices with similar security requirements and using conduits to restrict the communication between zones.