functional safety and security: ics cyber security is part of functional safety
Post on 20-Oct-2014
589 views
DESCRIPTION
What are the real issues in industrial control system cyber security and what should we be doing about them? Is functional safety really safe unless it is cyber secure? Is physical security as important as cyber security?TRANSCRIPT
![Page 1: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/1.jpg)
FunctionalFunctionalSafety andSafety and
SecuritySecurityWhat Are the Real Issues and What Should We Be Doing About It?
Walt BoyesEditor in ChiefControl and ControlGlobal.com
ICS Cyber Security Conference 2013
![Page 2: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/2.jpg)
“Careful, we don’t want to learn from this!”
![Page 3: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/3.jpg)
FunctionalFunctionalSecurity, both Cyber Security, both Cyber
and Physical, is a and Physical, is a Subset of Functional Subset of Functional
SafetySafety
![Page 4: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/4.jpg)
Why are Security and Safety so HARD?
![Page 5: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/5.jpg)
Why is Safety so HARD?
![Page 6: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/6.jpg)
Insanity is doing the same thing over and over and expecting different results!
![Page 7: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/7.jpg)
Now, Back to BP…
Former BP CEO Tony Haywood
Clearly, it is not enough to “mean well”…
![Page 8: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/8.jpg)
…and the Olympic Pipeline Disaster…
A cyber incident that cost lives… and destroyed a company
![Page 9: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/9.jpg)
The problem isn’t just safety
SIS Security Alarm Management Operations Training Company Goals
![Page 10: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/10.jpg)
Building SIS in a vacuum
SIS has to be part of an overall proactive safety strategy—one that includes cyber security and training
![Page 11: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/11.jpg)
Building SIS in a vacuum
SIS must also be part of an overall proactive security strategy: Security is a safety issue!
![Page 12: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/12.jpg)
Alarm Management…really
Alarm management: cure or symptom?
Make the operator more effective
![Page 13: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/13.jpg)
Using operators correctly
Optimizing the HMI and using operators correctly are all part of what we’re calling alarm management
![Page 14: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/14.jpg)
Operators are professionals…
Operators need to be in charge of the process
Operators are not clerks or technicians
![Page 15: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/15.jpg)
Functional alarm management
Like safety, alarm management must be a continuous process…
![Page 16: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/16.jpg)
A Fish Stinks from the Head
For security as well as safety, there must be support from highest management levels…
![Page 17: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/17.jpg)
Physical Security
• Perimeter security• Personnel location
![Page 18: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/18.jpg)
Functional Cyber Security
How do you protect systems that were designed to be inherently open?
Call it “Functional Security” to differentiate its needs…
![Page 19: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/19.jpg)
Training that means something
90 days on nights isn’t enough
Training for the future…how?
…and who?
![Page 20: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/20.jpg)
Why are Safety and Security so HARD?
![Page 21: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/21.jpg)
Security is a Safety issue. If you didn’t believe that, now you do...or maybe not.
And Then There Was Stuxnet…
![Page 22: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/22.jpg)
What we know can be done Attacks from outside
Network attacksDevice attacksPhysical attacks
Attacks from insideNetwork, device and system
Combined cyber and physical attacks
![Page 23: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/23.jpg)
Is It Flight or Fight?
![Page 24: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/24.jpg)
So, just where does that leave YOU?
Why are Security and Safety so HARD?
![Page 25: Functional Safety and Security: ICS Cyber Security is Part of Functional Safety](https://reader034.vdocuments.site/reader034/viewer/2022051311/544536fab1af9fd3748b4613/html5/thumbnails/25.jpg)
Hero or Goat?