HIMA outlines cyberthreat to critical infrastructure
Published by Nicholas Woodroof,
Editor
World Pipelines,
In late 2017 the International Control Systems (ICS) cybersecurity specialist Dragos announced that a safety controller (SIS) at a process facility in the Middle East had been targeted by a new malware attack and successfully hacked. The SIS was compromised, leading to a shutdown of the facility.
According to HIMA – which has offered to provide consulting on cybersecurity for safety-critical systems – the cyberattack, which was carried out on one of its competitors, represents a new dimension of cyberthreats to critical infrastructure; specifically planned to target the SIS of a prominent manufacturer, the attack on the SIS, the first of its type, was sophisticated and only possible with significant effort.
Dr Alexander Horch, Vice President Research, Development and Product Management at HIMA, said: “The incident with our competitor should serve as a wake-up call for all of us and further enhance awareness of the subject of cybersecurity in the industry. Work processes and organisational deficiencies are by far the most common areas of vulnerability for successful cyberattacks. System interfaces that remain open during operation and can be used to program the systems concerned, for example, give attackers a potential point of access. We urgently advise facility operators to not rely solely on cybersafe components, but instead to establish a comprehensive security concept for their own facilities.”
To achieve maximum safety and security, HIMA has advised that it is particularly important for facility operators to implement the requirements of the standards for functional safety and automation security (IEC 61511 and IEC 62443). Doing so will achieve physical separation between process control systems, and safety and security systems.
“For facility operators it is important to constantly keep an eye on potential forms of manipulation. In this regard, safety-critical applications are fundamentally different from other industrial PLC or Office applications. Considerable expertise is necessary to ensure cybersecurity in safety applications. Maintaining and constantly refining security often poses a challenge to facility operators. It is therefore advisable to draw on the services of experienced safety and security experts in order to jointly develop and implement effective concepts”, said Heiko Schween, a security expert at HIMA.
Read the article online at: https://www.worldpipelines.com/regulations-and-standards/12012018/hima-outlines-cyberthreat-to-critical-infrastructure/
You might also like
EIC appoints five new non-Executive board members
Energy Industries Council appoints five new non-Executive board members.