Journal of Loss Prevention in the Process Industries, Volume 26, Issue
6, November 2013, Pages 982–993
Identification and application of security
measures for petrochemical industrial control systems
H.M. Leith, John W. Piper
AcuTech Consulting Group, 1919 Gallows Road, Suite 900, Vienna, VA 22182, USA1
Abstract
The financial success of the chemical and
petrochemical industry depends upon the security of process control systems. Authors
offer recommendations and insights gleaned from over 100 security risk
assessment (SRA) and process control analyses, using requirements baselines
extracted from the National Institute of Standards and Technology (NIST)
special publication 800-53 (and Appendix A), the Recommended Security Controls
for Federal Information Systems and Organizations, in conjunction with NIST
special publication 800-82,Guide to Industrial Control Systems(ICS) Security,
to provide the bridge in application of 800-53 controls to IC/SCADA.
Authors identify how current and projected
malevolent threats posed by insiders, outsiders, collusion, and system-induced
threats can erode system performance in terms of shut downs, sabotage,
production disruption, and contamination. They focus on application of
business-prudent controls and discusses how disparities in implementation of
controls can exacerbate system vulnerabilities. They examine the dynamics of
communicating information from process control systems to business IT systems
and the pressure from business operations to capture process data and make it
available in near real-time through administrative networks. They summarize the
process for establishing security for industrial control systems (ICS), and
addresses cyber security baseline requirements and expectations, within a risk
management framework that provides a decision basis, threat dynamics, common
vulnerabilities, and prudent mitigation measures.
Full Text Source (Subscription or Fee): http://www.sciencedirect.com/science/article/pii/S0950423013002015
No comments:
Post a Comment