SAFETY & SECURITY - STRANGE BEDFELLOWS
31 October 2012
What is the difference between safety and security? Perhaps the best definition was aired at the recent Cyber Security: Transportation Systems conference in London, run by the IET (Institution of Engineering and Technology)
"Security,” said Tony Bull of Notitia Salu, "is the protection of the system from the environment, whereas safety is the protection of the environment from the system.” Looked at another way, safety is protection against accidental events; security is protection against intentional damage.
Safety systems in industrial facilities have become increasingly complex and essential. Safety systems are governed by stringent regulations and standards.
Designing for safety has increased reliability and integrating safety into machine and process design has become routine.
Physical security is equally highly regulated. But not so cybersecurity. It is a fast-moving field and neither the technical issues nor the implications are particularly well understood.
According to Adam Ogilvie-Smith, Chairman of the recently formed UK Aviation Security National Technical Committee (AvSecNTC), issues of physical security (perhaps understandably) are afforded the overwhelming majority of time.
AIR GAP MENTALITY
With cybersecurity, many engineers feel that if you don't connect a control system to the Internet, you are safe. This is called the ‘air gap’ mentality. But not all threats come over the wired network. Stuxnet propagated initially from USB sticks, while the growing use of wireless technology has raised concerns about how protected they are.
UNTESTED SOFTWARE CAN ALSO BE A VULNERABILITY WHEN A SECURITY ISSUE IN SOFTWARE AND FIRMWARE HAS NOT BEEN IDENTIFIED AND ADDRESSED
Almost all critical industrial infrastructures and processes are managed remotely from central control rooms, using computers and communications networks. The flow of gas, oil, water and electricity, the operation of chemical plants, and the signalling network for railways all use various forms of process control and 'supervisory control and data acquisition'.
Process control and SCADA systems are making use of, and becoming progressively more reliant on standard IT technologies.
These technologies, such as Microsoft Windows, TCP/IP, web browsers and increasingly, commercial off-the-shelf software (COTS) and wireless technologies are replacing conventional proprietary technologies.
Today, process control is one of the key issues for national infrastructure protection. In the UK, the Centre for the Protection of National Infrastructure CPNI (www. cpni.gov.uk) is tasked with helping the UK national infrastructure to understand and mitigate electronic attack risks to these systems.
SUSCEPTIBLE TO MANIPULATION
In the US, a report issued by the US Government Accountably Office alerts the FDA to the risks from this area to medical devices.
Unencrypted data transfer is also susceptible to manipulation.
Untested software can also be a vulnerability when a security issue in software and firmware has not been identified and addressed.
While process control systems were traditionally closed systems designed for functionality, safety and reliability, where the prime concern was one of safety and physical security, increased connectivity via standard IT technologies has exposed them to new threats which they are ill equipped to deal with. Many of the standard IT security protection measures normally used with these technologies have not been adopted into the process control environment. The risks to the process control systems from electronic threats continue to escalate while there may be insufficient security measures in place.
- Safety systems in industrial facilities have become increasingly complex and essential
- Process control is one of the key issues for national infrastructure protection
- Many standard IT security protection measures have not been adopted into the process control environment