Industrial automation and control systems security
Industrial automation and control systems (ICS and Supervisory Control And Data Acquisition systems - SCADA) are the key components in the infrastructure of information systems of the organizations in various sectors of the economy (fuel and energy complex, metallurgical industry, chemical industry, etc.). These systems attract the attention of intruders both from the industrial espionage and for the purposes of vandalism and cyberterrorism.
Russian legislation establishes special requirements for the security of such systems. The regulatory requirements of the Russian Federation, aimed at securing key systems of information infrastructure (KSII), formulated in the federal regulation 256-FZ "On safety of Fuel and Energy facilities" and in a number of documents of the Security Council and the FSB of the RF, and also in the Order No. 31 of FSTEK of the RF.
Industrial automation systems of the modern generation widely use a transmission medium TCP/IP over the Ethernet and server virtualization. PLC controllers are constantly improving and supporting different communication protocols (Profibus DP/PA/FMS, Profinet, TCP-IP/RT/IRT, Modbus TCP/RTU, IEC 60870-5-101/104, CANbus, PLC, (KNX, X10). This requires the development of new approaches to the security of such systems. As of today, there has been a wide range of standards and world’s best practices developed and applied for APCS security (IEC 62443 (ISA 99) and 61850, NERC CIP, NIST SP 800-82, NIST SP 800-53 Rev 3, ANSI/ISA-99, etc.), which allow solving the tasks of monitoring the correct implementation and consistency of technological processes, protecting the processed information and combating fraud and theft.
Below are the main elements of the industry network infrastructure, which require protection against possible malicious internal attacks and interference:
- real-time systems (RTS)
- industrial control systems (ICS)
- distributed control system (SCADA)
- communication channels and data communication equipment
- corporate systems and business applications for commercial accounting
- instrumentation and telemetering equipment
- assistance in the development of guideline procedures in the field of the information security.
AIM SYSTEMS has many years of experience in implementing complex projects in the field of the information security, IT, designing and building the engineering systems.
AIM SYSTEMS offers the following services in ensuring the APCS security:
- APCS audit, including identification and classification of assets, conducting penetration tests, incidents review, risk assessment, issue of the information security development strategy
- building a comprehensive system of the APCS security in line with the international standards and best practices; development of design and detailed documentation, implementation and maintenance of the system
- bringing the APCS security system in line with the regulatory requirements of the Russian Federation
- comprehensive technical support of security systems.
Building the APC complex security includes:
- ICS audit. Collection and analysis of initial data. Preparation of audit results.
- Identification of threats and vulnerability. Building security threats models
- Development of technical specification for building the APCS security.
- Selection of key technical solutions. Determination of security methods
- Design of system protection
- Installation of software and hardware
- Commissioning, certification and maintenance.
