Cybersecurity Fundamentals - Not Just for Industrial Control Systems When Guidance and Direction are Available

Industrial Control Systems (ICS) are important to supporting US critical infrastructure and maintaining national security. ICS owners and operators continue to face threats from a variety of adversaries whose intentions include gathering intelligence, stealing intellectual property, obtaining financial compensation through ransom, and disrupting national critical infrastructures. The ICS discussed do not just include control systems but often include electrical assets (microprocessor-based relays, trip units, etc.) which have been networked together using various communication protocols. Previous IEEE PCIC papers have mentioned cybersecurity without providing details on how to secure an ICS. This paper describes the issues that ICS owners and operators face and introduces the International Society of Automation (ISA)/International Electrotechnical Commission (IEC) 62443 [1] –[10] series of standards as the basis for an effective cybersecurity program. These standards have been developed by the ISA99 committee of the International Society of Automation and IEC Technical Committee 65 Working Group 10.