Control Systems Security
The nation's critical infrastructure sectors, including chemical plants, transportation systems and telecommunication networks rely on sophisticated computer control systems to monitor, control and perform daily tasks. These automated systems collect data from the field, process and display information for operators and send control commands to local and remote equipment such as pumps, valves and circuit breakers.
Originally designed to be isolated, non-networked devices, most control systems were never equipped with modern cybersecurity features such as encryption, authentication and unique password management. Without layered security, control systems are vulnerable to cyberintrusions by virus and worms, hackers, disgruntled employees and foreign intelligence services that can compromise, disable or disrupt their essential functions.
To overcome these challenges, engineers and scientists at the U.S. Department of Energy's Idaho National Laboratory are working closely with infrastructure owners, equipment manufacturers, government agencies and international partners to aggressively develop security enhancements, conduct vulnerability and risk assessments, and provide comprehensive awareness and mitigation training.
Department of Homeland Security's Control Systems Security Program
Under the direction of the Department of Homeland Security's National Cyber Security Division, cyber researchers and control system experts from several national laboratories, universities and standards organizations are working to identify, prioritize and respond to infrastructure cybervulnerabilities based on their impact to public safety, security and economic stability.
The goal of the program is to guide a cohesive effort between government and industry to reduce the risk to critical infrastructure control systems. To lead this effort, researchers, scientists and engineers execute a strategy composed of two interrelated objectives, on both national and international fronts, and work with other government entities and the control systems community.
The first objective is to provide expertise and guidance to the control systems community. To do this, cyber researchers from INL work closely with the United States Computer Emergency Readiness Team, maintain a technical support center for conducting vulnerability assessments, and provide strategic recommendations to standards organizations and research firms that provide incident management support and development and testing of next-generation control systems.
The second objective involves the development of partnerships with public and private entities, national laboratories, government agencies, industry and technical professionals. This cross-sector coordination effort improves cybersecurity features in the nation's control systems by creating an information-sharing and situational-awareness environment. The program currently sponsors several training and awareness workshops, including the Process Control Systems Forum and the U5 International Training Summit. Recently, the program launched an online training package, which assists control system engineers in understanding cybersecurity for control systems. In addition, program researchers work closely with trade organizations, such as the Instrument Society of America (ISA) and the Institute for Information Infrastructure Protection (I3P), to distribute timely information, provoke discussion and distribute emerging technology solutions.
The program incorporates the ability to provide private industry - which owns more than 85 percent of the nation's critical infrastructures - with a necessary resource for conducting vulnerability assessments, technology development and advanced cybertraining. This strategy ensures that effective solutions are actively being developed to increase the resiliency of the nation's most important resources.
- Download the CSSC program pdf -
- Visit the official program site -
Department of Energy's National SCADA Test Bed Program
Today's energy infrastructure, including the electric power grid and oil and natural gas facilities, are steadily becoming more secure against cyberthreats because of a unique industry and government partnership known as the National SCADA Test Bed program. This collaborative program aims to increase the security of the nation's critical energy infrastructures by increasing cybersecurity measures in the computer-based control systems that operate energy infrastructures.
A Collaborative Effort
Since the mid-1990s, control system manufacturers, utilities and the federal government have recognized the existence of potential vulnerabilities in the electronic systems that monitor and control our energy infrastructure. As control systems have become increasingly interconnected with other control networks and with corporate data networks, the potential for cyberintrusions has increased.
While this greater connectivity provides the high level of responsiveness required in today's dynamic energy networks, each additional connection potentially represents an opportunity for unauthorized access - unless properly protected. At the same time, would-be extortionists, terrorists and disgruntled employees have gained access to increasingly sophisticated tools for exploiting potential system weaknesses.
In order to develop a solution to this growing concern, the Department of Energy recommended that Idaho National Laboratory and Sandia National Laboratories jointly develop a partnership with key manufacturers of SCADA systems, utility companies and industry peers. This partnership is known at the National SCADA Test Bed (NSTB) program.
The program focuses heavily on a process for assessing the security of current control systems in a realistic, yet controlled and protected environment. Knowledge gained through these assessments has led to expanded efforts into new technology development, training, standards and outreach.
INL's SCADA Testing Capabilities
Situated on 890 square miles of isolated landscape, Idaho National Laboratory has designed, built and relied on control system technology for more than 50 years. The laboratory also manages its own utility-scale electric power grid that consists of more than 60 miles of 138 kV transmission loop. This functioning power grid provides power to many INL facilities, but also includes a dual-fed portion allowing our researchers to leverage and test control systems, emerging technology and new network topologies in a realistic environment. Within the loop there are multiple feeders, transformers and independent substations.
Similarly, INL houses a dedicated SCADA testing facility which consists of multiple control systems supplied by leading national and international manufacturers. Within the test bed, INL researchers systematically examine control system components, including remote terminal units, programmable logic controllers and intelligent electronic devices, and work to identify vulnerabilities in areas such as system coding, firewall configurations and network protocols.
Additionally, NSTB researchers provide in-depth analysis, training and tool development to industry partners and equipment manufacturers at conferences and user groups, and they review and provide insight into the development of control system standards.
Success and Progress
Today, at least 50 control systems currently in use and more than 80 percent of control systems now on sale for the U.S. electric sector have been evaluated and reinforced against unauthorized cyberintrusion. Control system manufacturers such as ABB, AREVA, GE and Siemens have all taken a proactive stance against SCADA intruders.
Electric utilities have been similarly responsive in applying the security fixes, patches, upgrades and guidance provided by the vendors and NSTB. Collectively, these vendors and electric utilities are continuously advancing the security of our critical energy infrastructure.
- Download the program pdf -
- Read the March 2007 article in T&D World
- Visit the official program site
SCADA Procurement Project
Scientists from Idaho National Laboratory, the New York Office of Cyber Security and Critical Infrastructure Protection and the SANS Institute have teamed up with utilities and manufacturers of process control systems to offer advice on how to make cybersecurity an integral part of critical infrastructure operations.
Founded in 2006, the SCADA Procurement Project is a joint industry-government partnership that is working to increase control systems cybersecurity by drafting a set of voluntary procurement guidelines that allow utilities and control system manufacturers to ensure that minimum security features are built into newly manufactured control systems at the factory.
Funded by the Department of Homeland Security's National Cyber Security Division, the goal of the project is for federal, state and local asset owners and regulators to obtain a better understanding of control systems cybersecurity using the procurement guidelines as a common basis for requesting advanced security measures such as intrusion detection systems, user authentication and advanced firewall configurations. The guidelines also provide recommendations to SCADA users on how to remove unnecessary or third-party software, create a single user account and remove administrator-enabled guest accounts.
The current project working group is comprised of 172 public and private-sector entities from around the world representing asset owners, operators and regulators. In addition, more than 20 vendors participate in the working group to assist in reviewing and producing the procurement language.
Due to the rapid evolution of cybervulnerabilities, the procurement guidelines are frequently reviewed and updated with new recommendations. The current version was released in January 2008 during the Process Control and SCADA Summit.
- download the current procurement guidelines
- visit the official project site