Analysis of the Functionalities of a Shared ICS Security Operations Center

The basic step in the design of a security operations center (SOC) is identifying the necessary functions it needs to perform. The article offers an analysis of the ICS SOC functionalities and is focused to create a part of the concept of operations before the real design of Shared ICS SOC. We offer a complex of functionalities of Shared ICS SOC and analyze their effectiveness. The survey is based on a review of the legal framework, the ICS security incidents, research on the gaps between cybersecurity products and real needs for the ICS and SCADA community. Shared SOC performs role of community service hub with integrated experience, supplying security services for multiple ICS. By outsourcing these services, a company can reduce security staff and focus on its core business.

I. Introduction

The growing issue of cyber security and its impact on Industrial Control Systems (ICS) highlights fundamental risks to the national critical infrastructure. Although the attacks targeted IT infrastructure, their consequences also affected operational technology used for production. The data that proves it is gathered from Supervisory Control And Data Acquisition (SCADA) servers; data storage servers (Historian); data gateways according Open Platform Communication (OPC) standard; stationary and mobile workstations of engineers and operators; Human Machine Interface (HMI). The statistics analyzed also include data received from computers of industrial control network administrators and software developers who develop software for industrial automation systems [1]. The ICS cyber security landscape goes complicated after synergy with IoT. Both parties have specific disadvantages concerning cyber security [2]–[4].