Automation is the name of the game for today’s manufacturers and operators of critical infrastructure. The global market for industrial control and factory automation is expected to grow steadily at a compound annual growth rate (CAGR) of 7.4 percent until 2023, from its current value of USD 145 billion.[1] Powered by the rise of the Industrial Internet of Things (IIoT) and smart automation, companies are increasingly implementing industrial control systems (ICS) that connect disparate assets through wired and wireless networks. This level of connectivity helps companies:

• Easily control and monitor assets remotely;
• Optimize efficiencies and achieve cost savings;
• Perform preventative diagnostics to predict failures;
• Improve scheduled maintenance routines; and
• Quickly detect and address any faults.

To reap the benefits however, these connected systems must be secure. Cyber-attacks are on the rise as more industries continue to invest in smart technologies. Control systems are also vital to the operation of critical infrastructure, such as our power grids, which are consistently targeted by sophisticated hackers. A breach of any of these systems can have dire consequences, not only to the businesses that operate them, but also their customers and surrounding communities. That’s why the ICS security market size is expected to grow from USD 10.24 billion in 2017 to USD 13.88 billion by 2022, at a CAGR of 6.3 percent.[2]

In some cases, regular IT cybersecurity programs do not offer sufficient protection for ICS. That is because ICS applications control both digital and physical assets—so any malfunction or breach can have a direct impact on the physical world. The health and safety of workers and others nearby can be jeopardized, the environment may also be put at risk, and the businesses operating the system can suffer production losses or have their proprietary information compromised.

Best Practices in ICS Security

According to ICS-CERT,

“An organization’s cybersecurity strategy should protect the assets that it deems critical to successful operation. Unfortunately, there are no shortcuts, simple solutions, or “silver bullet” implementations to solve cybersecurity vulnerabilities within critical infrastructure ICS. It requires a layered approach known as Defense in Depth.”[3]

It’s a holistic approach that protects all assets and recognizes all of the interconnections and dependencies. This approach is also necessary because of the real world consequences of ICS, and security assessments must account for all possible operating conditions of each system component.

These overarching principles of ICS security are incorporated into various global standards and best practice frameworks. Specifically, the International Electrotechnical Commission (IEC), International Society of Automation, and National Institute of Standards and Technology (NIST) recommend that ICS security should always be part of broader ICS safety and reliability programs at both industrial sites and in enterprise cybersecurity programs.[4] Some elements of their recommended strategies for ICS security include:

• Developing security policies, procedures, training, and educational material
• Addressing security throughout the entire lifecycle of the ICS
  • The IEC 62443 series of standards offers guidance in this area. IEC 62443-2-4 defines requirements for solution providers and system integrators. IEC 62443-4-1 defines the secure development lifecycle for product manufacturers, and IEC 62443-4-2 and 62443-3-3 specify the security requirements for both the product and system.
• Implementing a network topology that has multiple layers, with the most critical communications occurring in the most secure and reliable layer
• Separating corporate and ICS networks
• Establishing separate authentication mechanisms and credentials for users of the ICS and corporate networks
• Restricting physical access to ICS networks and devices
• Building redundancies in system components and networks
• Applying stronger controls to safety systems in the ICS to help ensure that they can properly deploy risk reduction measures against major accident hazards
• Designing critical systems for graceful degradation to prevent catastrophic cascading events

Evidently, both functional safety and cybersecurity are critical to ICS. A safety system ensures that a corrective device or mechanism is activated once a potentially dangerous condition is detected. That functionality needs to be mirrored by a strong cybersecurity program that can monitor and address potential cyber threats on an ongoing basis.

CSA Group—a leading standards development organization and global provider of testing, inspection, and certification services—offers both evaluation programs.

“In an increasingly digital world, companies are finding that they need both functional safety and cyber security,” says Adam Garner, CSA Group’s global business unit director for the industrial sector. “The two services go hand-in-hand to help ensure the safety of a company’s assets, information, and people, as well as the surrounding environment. You really can’t have one without the other anymore.”

The company’s functional safety evaluation aligns with IEC 61508, the umbrella standard for functional safety of industrial electrical, electronic, programmable electronic devices (E/E/PE) and other safety-related systems. The evaluation provides methods for assessing hazards and risks, establishing necessary safety functions, and defining the appropriate Safety Integrity Level designation to reduce risk to a specified acceptable level.

CSA Group’s cybersecurity services combine its well-established expertise in functional safety evaluation with its long history of working with emerging technologies. These services involve working closely with businesses of all sizes to develop tailored solutions that can help identify potential issues early in the product design phase, and implement security measures to mitigate potential cyber risk. The comprehensive set of tests and evaluations are also based on international standards, such as IEC 62433 Cybersecurity Standards, NIST Guide 800 series, and the ISO 27000 Security Management Standards.

Ultimately, these two evaluation programs work together to offer greater assurance that the products and systems being delivered to market can mitigate cyber threats and help protect the physical world around them.

Download our white paper to learn more about functional safety and cybersecurity for ICS.

[1] Markets and Markets, “Industrial Control and Factory Automation Market by Solution (SCADA, PLC, DCS, MES, PLM, PAM, Functional Safety), Component (Industrial Robots, Industrial 3D Printing, Control Valves, Machine Vision, HMI), Industry and Geography – Global Forecast to 2023”, October 2017.

[2] Markets and Markets, “Industrial Control Systems Security Market by Solution (Firewall, Antivirus/Anti–Malware, Identity and Access Management, Security Information & Event Management, DDOS, UTM), Service, Security Type, Vertical, and Region – Global Forecast to 2022”, June 2017.

[3] U.S. Department of Homeland Security, “Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies,” 2016, pg. 2.

[4] NIST, “Guide to Industrial Control Systems (ICS) Security,” 2015.