This is the second posting about Industrial Control System (ICS) cyber security topics discussed at last week's ARC Forum in Orlando. The first posting discussed the ICS Security Workshop on Monday Feb 8. On Tuesday, we spend another entire afternoon exploring three promising opportunities in ICS Cyber Security. The afternoon was broken into two sessions. The first session addressed the use of third party security services and the certification of ICS devices. This posting is about the first session.  Session 2, Energy and Chemical Industry Roadmaps will be covered in another posting.

Using Third Party Security Services for ICS

Several types of third party security services are available, including security assessments, system design, implementation, managing infrastructure, and others. Most services are project oriented and used commonly. However, it appears that services for ongoing ICS operations are underused relative to the value they offer. DuPont has been using third party services since 2002 for managing some of their process control network (PCN) firewalls, and we asked Tom Good of DuPont to present their perspective to us. 

DuPont wanted to achieve a step change in ICS security in 2002 and looked for third party security service provider with ICS experience, rather than wait until DuPont had built the necessary skills and processes internally.  In 2002, DuPont engaged the expertise of Industrial Defender who initially helped shape DuPont’s firewall segmentation architecture and strategy.  The first benefit was that it lowered their initial implementation cost. There were several other ongoing benefits, such as bring automated tools for monitoring and managing firewalls, and providing a discipline for change management, backups and emergency responses.  One key result was achieving 24/7 support under a formal service level agreement.  Importantly, DuPont and Industrial Defender developed a partnership approach with a co-management strategy that included sharing of expertise and ideas.  Industrial Defender is now managing about 150 DuPont firewalls in process control networks across 90 sites, and DuPont is refreshing their installed firewalls.

ICS Device Certification and Testing

Industrial control systems are the last line of defense against intrusions, but legacy systems were not designed with security in mind.  Even today, many control system components have not been thoroughly tested for vulnerabilities.  Furthermore, attacks change and new vulnerabilities are discovered all the time.  With this in mind, one opportunity for improving security is to develop formal security requirements with certification testing.  ExxonMobil developed an Industrial Automation and Control (IACS) security vision, including a “secure by design” goal, and we asked Johan Nye of ExxonMobil to tell us how compliance testing fits within that vision.

Johan first pointed out that not all ICS vulnerabilities are within the devices themselves.  Frequently, the systems do not adequately define roles, give admin privileges to operators, use passwords that cannot be changed online, and come with unused services enabled.  It is also common to protect the user interface but provide no protection for ICS servers. One of the reasons for all this is the lack of guidance for automation systems vendors.  Standards and compliance testing are one solution that will not only give vendors guidance but also will enable an independent verification process, specifically designed for ICS.  A key strength to this approach is that the process of developing standards and processes can utilize the best security expertise across the industry rather than each buy defining vendor requirements independently.

Panel Discussion

After their presentations, Tom and Johan joined a panel discussion with three other industry experts:  Andrew Ginter of Industrial Defender, Eric Byers of Byers Security, and Tyler Williams of Wurldtech Security Technologies.  Andrew added his experience-based perspective on security services and other IC security elements offered by his company; Eric, relatively new in the role of product vendor, discussed the history of compliance and testing; and Tyler talked about how WST has been helping secure ICS components while the industry waits for standards to be developed.  The panel also discussed issues such as why security services for ongoing operations were not more widely adopted, alternative to standards based compliance and testing processes, and who should bear the burden of testing.

Observations

I came away from the session believing more strongly that outsourcing security services, especially for ongoing activities, has great potential for improving the security of ICS systems.  Cyber security is getting increasingly complex, requiring higher levels of training to keep up.  It is difficult to imagine manufacturing, utilities and other such facilities being able to internally maintain highly trained security staff on multiple sites, and be vigilant 24/7 to monitor and react to problems.

The strongest case for certification and testing of ICS components appears to be in providing consistent expectations to ICS vendors.  But inevitably, there is a danger that some will believe that certification assures security. On the contrary, device level security measures must be surrounded by several other security measures and processes.  There is also a danger testing requirements may need to be broader and more dynamic than standards bodies are able to achieve with working groups staffed largely with volunteers.  Certainly thorough testing will improve the security of ICS components and systems, and both vendors and end users are on a path to do so, mostly stimulated by the success safety systems that addressed similar issues several years ago.  But it is only one piece of the very dynamic ICS security puzzle.

Actions

All of the session speakers, panel members and most of the session attendees have been contributing to ICS security communities for several years. They are true security experts and this enabled Forum discussions to start at a relatively advance level.  However, other owner-operators and end users are experiencing ISC security issues and can gain substantially by increasing their involvement in industry activities.  We intend to shape ARC ICS security research to help grow this community.  If you can participate in any way in future activities, please let me know bmick@arcweb.com.