ICS: What is the Industrial Control System?
ICS or Industrial Control System is a generic term used in production. It refers to the combination of hardware and software with network connectivity in order to support critical infrastructures. It can vary in size according to requirements, ranging from models with just a few modular controls on a single panel to large interconnected, interactive control systems.
ICS technologies include (but are not limited to) supervisory control and data acquisition (SCADA) and distributed control systems (DCS), industrial automation and control systems (IACS), programmable logic controllers (PLC), programmable automation controllers (PAC), remote terminal units (RTU), control servers, intelligent electronic devices (IED) and sensors.
ICS development and fusion of OT and IT
In the past, most critical infrastructures (electrical power stations, plumbing and waste systems, transport industries etc.) were ‘mute’, in other words without any kind of internet connection, while the few computerised parts were limited to the internal network and therefore isolated from the outside world.
Nowadays however, almost all the components in the engineering or mechanical sections of such infrastructures are directly or indirectly connected to the internet. Thanks to this technological progress, ICS has become a perfect fusion of OT (operational technology) and IT (information technology).
OT includes all the hardware and software systems which supervise and control physical devices present in the infrastructure. The functions of Operational Technology vary according to the sector, for example sensors which measure temperature in industrial environments.
The gradual integration of information technology offers some advantages, such as a wider overview of the supply chain, helping companies to remain competitive. In any case, largescale use of the internet by the more modern ICS also presents several security risks.
Safeguarding the security of Industrial Control Systems is crucial
Terrorist attacks on Industrial Control Systems pose a significant risk to most nations. While the remote telemetry used to insert the variables is becoming more effective at local control and the Internet of Things (IoT) along with the Industrial IoT continue to grow, adequate strategies need to be developed in order to protect Industrial Control Systems from security threats.
Protecting industrial systems is not a trivial matter. The majority of them were built before cyber threats existed, so their design does not incorporate external security checks.
Understanding and identifying the most common risks to the industrial control system is the first step that every organisation must take in order to safeguard its network. Currently these are:
- External threats and targeted attacks: if we consider that ICS are often used in chemical engineering and production and in healthcare assistance and distribution, it is no surprise that they are often targeted by terrorist organisations, hacktivists and other malicious groups. Industrial espionage and IP theft are also included in this category;
- Internal threats: the limited availability of authentication and cryptography systems make Industrial Control Systems particularly vulnerable to internal threats. Discontented employees or dissatisfied contractors may have almost unlimited access to any apparatus that forms part of the ICS network. With a simple pen-drive they could easily steal sensitive data or install dangerous malware;
- Human error: making mistakes is only human but nevertheless, when errors are made involving an industrial control network, they can be costly and have a huge impact on operations and company reputation (in many cases, human error is considered the greatest risk for an ICS network). Such errors include configuration mistakes, PLC programming errors and forgetting to monitor the key metrics or alarms.
Translated by Joanne Beckwith
