Industrial Control Systems (ICS): what to consider when protecting industrial assets from cyber threats? Part 1. Secure ICS Architecture design

This paper is aimed primarily at managers responsible for the cybersecurity of process control systems, and engineers who are beginning their career in the field of industrial control system cybersecurity. It is designed to help understand the peculiarities of the practical application of international and national standards for the cybersecurity of the industrial control systems to help avoid architectural and gross technical errors at the start of projects, to highlight the main features of the protection of ICS. This paper can also be useful for industry experts as it can offer a new perspective on familiar things.

I sincerely hope that this work will help the reader to better understand the specifics of ICS cybersecurity and make our world a little safer.

The author would like to thank:

• Hubertus Storck

• Alexey Kuzichkin

• Dmitriy Pravikov

• Artem Zhiganov

Without your help, my professional journey would have been much more difficult.

Special thanks for the professional translation:

• Margarita Nazarovskaya

The paper is based on the scientific article " Development of secure architectures for process control systems" DOI: http://dx.doi.org/10.26583/bit.2020.2.08

DCS – Distributed Control System

DMZ – De-Militarized Zone

HIDS – Host-based Intrusion Detection System

NIDS – Network Intrusion Detection System

IDS – Intrusion Detection System

HMI – Human to Machine Interface

IEC–International Electrotechnical Commission

ISO – International Standards Organization

OS – Operating System

SIS – Safety Instrumented System; equivalent to Instrumented Protective System (IPS)

USB – Universal Serial Bus

HDD – Hard Disk Drive

PLC – Programmable Logic Controller

DCS – Distributed Control Systems

PIZ – Process Information Zone

ICS – Industrial control Systems

BPCS – Basic Process Control Systems

IT – Information Technology

OT – Operational Technology

HSE – Health and Safety Executive (United Kingdom)

HMI – Human Machine Interface

SCADA – Supervisory Control and Data Acquisition System

MES – Manufacturing Execution System

APC – Advance Process Control

WSUS – Windows Server Update Services

DPI – Deep Packet Inspection

SIEM – Security Information and Event Management

WAF – Web Application Firewall

DCOM – Distributed Component Object Model

OPC – Open Platform Communications

EPP – End Point Protection

RD – Remote Desktop

NSA – National Security Agency (USA)

For a long time, industrial control systems were isolated from the outside world and solved local technological process control tasks. In the face of fierce competition, businesses have come to realize that it is possible to achieve greater production efficiency, reduce costs, improve product quality and increase productivity by integrating the process control systems with enterprise systems. Thus, began the fourth industrial revolution, which continues to this day. Today, it is almost impossible to imagine an industrial process without automation and only a small part of these systems operate in isolation from the Internet or the enterprise network (air-gaped).

In the modern world, a lot depends on the operation of control systems: stable power generation, heat and water supply, production of goods, mining, oil and gas extraction, and more. Almost all the services that we use every day are made possible with the use of control systems. Can a modern enterprise work effectively for a long time without a control system? The answer to this question depends on the industry. Some segments are less dependent on control systems and can be managed manually. However, most enterprises are unable to effectively operate for a sufficiently long time without control systems. In this context, the control system can be compared to the Internet, which is used by more than half of the world's population, and majority of us today cannot do our jobs and cannot imagine our lives without Internet access.