Build a cyber security incident response plan

A plan lets everyone respond properly to a control system security breach, whether it's a failure of a critical cyber component or an intentional break-in.




Today’s modern industrial control systems are built on open system platforms and technologies. This means that what was once proprietary and closed is now more accessible—and therefore more vulnerable to intrusion. While we frequently hear reports about cyber security breaches in financial and consumer systems, we are now just starting to hear about such incidents reported on control systems. Many of these are the result of malicious activity, and others are the result of unintended consequences that result from a change made somewhere in the system, or an inappropriate use of the system.

It is best to be prepared and have an incident response plan in place. The purpose of the plan is to better prepare your organization for responding when there is suspicion of an incident to one of your control systems. This plan will allow you to properly respond to any type of cyber security incident—whether it is a failure of a critical cyber component, malicious software executing on your system or an intentional break-in to one of your control systems.

Components of the plan

An early part of the plan will be to describe the various types of incidents that may occur on your systems. These will range from simple failures such as a hard disk or CPU failure, infection of your system with a worm or virus, unintended consequences from changes made to the system, or a deliberate attack on the system from an insider or outsider.

The plan will describe who to call when such an incident occurs. The plan will include procedures for the responders to follow to determine the type of attack and how best to respond. The plan should also include procedures that will allow the process or plant to continue to operate while personnel are responding to the cyber security incident.

The plan should include definitions for additional responses where necessary. For example, if the security incident is the result of a virus or worm being introduced into the system, include actions that can be taken to delete the virus or worm, as well as procedures for how to prevent the incident from occurring again. This will require that an investigation be performed in order to determine how the virus or worm was introduced into the system.

Define forensics

The plan should also define what forensics are to be performed if the incident is intentional, and how to maintain the chain of custody of evidence gathered as part of the investigation. There are times when outside help is needed to resolve the problem, or to report the problem properly to comply with regulations. Therefore, reporting procedures and regulations should be documented in the plan as well. In many cases, the control system vendor has expertise in this area that can be very useful in creating the plan.

There are many more aspects to putting together a cyber security incident response plan for your industrial control systems. A good approach to use in creating the plan is to work with your IT organization as well as your vendors. Both will already have plans in place, and they will be able to assist in the creation of a plan for your industrial control systems. It is critical, as well, to get management support for the creation of the plan.

Once the plan is developed, all members of the organization will need to be trained on their role with respect to the incident response plan. Some may only need to know who to call, while others will require detailed training on how to respond.

One final note: Ensure the plan works. The execution of the plan should be practiced and updated with lessons learned. With a good cyber security incident response plan in place and understood, an organization can minimize the impact of an incident on its industrial control system.


Author Information

Kevin Staggs is an Engineering Fellow with Honeywell Process Solutions and a member of the company’s global architecture team. This article is an excerpt from a Control Engineering podcast.

No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2015 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
Safety for 18 years, warehouse maintenance tips, Ethernet and the IIoT, GAMS 2016 recap
2016 Engineering Leaders Under 40; Future vision: Where is manufacturing headed?; Electrical distribution, redefined
Strategic outsourcing delivers efficiency; Sleeve bearing clearance; Causes of water hammer; Improve air quality; Maintenance safety; GAMS preview
SCADA at the junction, Managing risk through maintenance, Moving at the speed of data
Safety at every angle, Big Data's impact on operations, bridging the skills gap
The digital oilfield: Utilizing Big Data can yield big savings; Virtualization a real solution; Tracking SIS performance
Applying network redundancy; Overcoming loop tuning challenges; PID control and networks
Driving motor efficiency; Preventing arc flash in mission critical facilities; Integrating alternative power and existing electrical systems
Package boilers; Natural gas infrared heating; Thermal treasure; Standby generation; Natural gas supports green efforts

Annual Salary Survey

Before the calendar turned, 2016 already had the makings of a pivotal year for manufacturing, and for the world.

There were the big events for the year, including the United States as Partner Country at Hannover Messe in April and the 2016 International Manufacturing Technology Show in Chicago in September. There's also the matter of the U.S. presidential elections in November, which promise to shape policy in manufacturing for years to come.

But the year started with global economic turmoil, as a slowdown in Chinese manufacturing triggered a worldwide stock hiccup that sent values plummeting. The continued plunge in world oil prices has resulted in a slowdown in exploration and, by extension, the manufacture of exploration equipment.

Read more: 2015 Salary Survey

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.
This article collection contains several articles on the vital role of plant safety and offers advice on best practices.
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.
This article collection contains several articles on strategic maintenance and understanding all the parts of your plant.
click me