The focus for IT in planning security can be summarized as CIA Confidentiality, Integrity and Availability. For enterprise systems the priorities are :
- Confidentiality no matter what, protect the information on the server from loss or disclosure.
- Integrity maintain the accuracy and validity of the companys information assets.
- vailability an outage of a web server, email server or desktop PC can be tolerated for short periods of time. Some applications are routinely taken out of service in off-peak hours for maintenance or back-up purposes.
For real-time systems used to control process plants, the electrical grid or a pipeline the priorities are reversed :
- Availability the process being controlled is often continuous in nature and may be unstable if not supervised. It may involve potentially dangerous high current or high pressure conditions. Batch processes can run for many days and are often extremely valuable for example, a single batch could be worth hundreds of thousands of dollars to a biotech company. Therefore, the top priority for the control system is availability. It needs to operate 24x7 without interruption for long periods of time. Control systems are designed to operate at multiple levels, with redundant control computers backed up by local controllers that are in turn backed up by safety shutdown systems.
- Integrity most information in a control system is gathered automatically from sensors and is transitory in nature. Data will be replaced by another measurement on the next scan. The key requirement is to ensure its accuracy and validity as it travels from the sensor to the control computer and back out to an actuator. In SCADA systems, this may include transmission over slow speed serial links.
- Confidentiality in general, information in a control system is not considered proprietary, although there are exceptions such as a recipe for a patented process.
As the CIA triad is reversed for a control system, the security design for process control and SCADA systems require a different angle of perspective.
|
