CSIA 2014: Everyone has responsibilities for cyber security

Product suppliers, project service providers and system integrators, asset owners, and operators all need to be involved in cyber security, said Johan Nye, control systems commercial technology leader at ExxonMobil Research and Engineering, Fairfax, Va. Nye presented at the 2014 CSIA Executive Conference in San Diego on April 25.


Johan Nye, control systems commercial technology leader at ExxonMobil Research and Engineering, Fairfax, Va., presented on cyber security at the 2014 CSIA Executive Conference in San Diego on April 25. Courtesy: Control Engineering, CFE Media, Mark T. HosEveryone has responsibilities for cyber security: Product suppliers, project service providers and system integrators, asset owners and operators all need to be involved, according to Johan Nye, control systems commercial technology leader at ExxonMobil Research and Engineering, Fairfax, Va. Nye presented at the 2014 CSIA Executive Conference in San Diego on April 25. His comments and advice follow:

  • Vendors must deliver products secure by default and should not deliver products wide open. [A recent Control Engineering site poll results suggested most devices recently installed did not require a password reset, even though that's the recommended delivery practice for vendors.]
  • More than 90% of cyber security intrusions could be thwarted if human-machine interfaces were not delivered in administrator mode.
  • The tools ExxonMobil uses include the NIST Cybersecurity Framework, ISA99/IEC 62443 industry standards, and ISASecure, and system integrators have a role to play, as well.

Best practices framework

The NIST Cybersecurity Framework executive order is involved in many critical infrastructure sectors in development. It references ISA/IEC 62443 standards and can be used as a high-level framework within asset/owner and operator companies. The five elements of the framework are to identify, protect, detect, respond, and recover.

The ISA and IEC have a simultaneous submission process for cyber security efforts. ISA/IEC 62443-1-1 is the overall concept and terminology document covering foundational requirements, security terms, and security levels. Edition 2 is now underway. The audience for these standards includes product suppliers, service providers, and asset owners.

ISA/IEC 62433 Security levels are modeled after safety integrity levels, explained Johan Nye, control systems commercial technology leader at ExxonMobil Research and Engineering, who presented on cyber security at the 2014 CSIA Executive Conference in SanThe document is based on the ISA84 safety instrumented systems (SIS) concepts of safety levels, where security levels are modeled after SIS. Security level is based on four adversary capabilities: means, resources, skills, and motivation. (See photo.)

  • 2-1 covers asset-owner audience based on risk assessment.
  • 2-4 covers requirements for solution suppliers with concept of maturity levels and is of the greatest interest to system integrators.
  • 3-2 and 3-3 are system-level documents. 3-2 covers security zones and security levels based on the risk assessment process, and 3-3 covers technical requirements, helping the product suppliers, based on foundational requirements and security levels.
  • 4-1 and 4-2 cover components, including host computers, network, and embedded devices and applications. 4-1 covers development lifecycle for product suppliers, with patching requirements. 4-2 explains technical requirements for suppliers. 

Cyber security certification

The ISA Security Compliance Institute (ISCI) offers a product certification, and they may not cover things that haven't been discovered yet, which are considered zero day threats. The process tests points for boundaries and inside the security zones.

The three types of certifications are:

  • A EDSA embedded device security assurance
  • A SDLA security development lifecycle assessment (coming later this year).
  • A SSA system security assurance system.

Security zones and conduits, for example, can divide the system into a safety zone, control zone, and operations zones, according to Johan Nye, control systems commercial technology leader at ExxonMobil Research and Engineering, who presented on cyber secSystem integrator advice

System integrators should:

  • Establish company policies and procedures
  • Take a lifecycle attitude.
  • Use ISA/IEC 62443 standards.
  • Not leave surprises behind for your customers. You must train employees, letting them know you have zero tolerance for unsafe cyber security behaviors.
  • Encourage suppliers to get the ISASecure certifications. Select secured products when you have a choice.
  • Role-based access control should have the least privileges.
  • Meet the NIST Cybersecurity Framework.
  • Don't connect the industrial automation control system (IACS) to the Internet. Hacker tools can map the control system if it is connected. If you connect, it will get found and exploited. 

Questions and answers

Q. Certification training for products and system: Is it about process or the technology?

A. Both, but really the certification attempts to establish trust among vendors, service providers (SIs), and asset owners, since they may not have the in-depth knowledge required.

Q. If the system is certified, how long does it last? What about next month when an unforeseen threat emerges?

A. We spent a lot of time talking about that. To get a certification, the production supplier must have a work process in place and must get a security patch to address that vulnerability. They also must do this for third-party components in their systems. Test the security patch. The certification isn't forever. A trigger includes a product revision. Time limit on certification; I think it's two years. Timeframe differs by program.

Q. What about budgets? This isn't free. It requires training and compensation; asset owners need to pay more. Are they willing?

A. Is system reliability an add-on option? Safety? Security is an inherent part of the industrial control system. For legacy systems, there also are mechanisms to add security around them.

Q. How do you handle external connections?

A. ExxonMobil sees connections as the highest threat. If you give view only, risk is less. If you give administration trust to a third party, then all bets are off.

- Mark T. Hoske is content manager, CFE Media, Control Engineering, mhoske@cfemedia.com.


See related cyber security articles, research and webcasts below.

ROBERTO , TX, United States, 04/29/14 09:59 AM:

Hi Johan,

Good to see you are still keeping busy with EMRE and working on new technology. I have been following cyber security for some time now and find it complex yet very interesting.
Good luck with everything.

Bob Rodriguez
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2015 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
2016 Top Plant; 2016 Best Practices on manufacturing progress, efficiency, safety
2016 Product of the Year; Diagnose bearing failures; Asset performance management; Testing dust collector performance measures
Safety for 18 years, warehouse maintenance tips, Ethernet and the IIoT, GAMS 2016 recap
Big Data and bigger solutions; Tablet technologies; SCADA developments
SCADA at the junction, Managing risk through maintenance, Moving at the speed of data
Safety at every angle, Big Data's impact on operations, bridging the skills gap
Ensuring SCADA/HMI cybersecurity; Optimize manufacturing value in real-time; Simplifying drive-based and controller-based automation
Tying a microgrid to the smart grid; Paralleling generator systems; Previewing NEC 2017 changes
Package boilers; Natural gas infrared heating; Thermal treasure; Standby generation; Natural gas supports green efforts

Annual Salary Survey

Before the calendar turned, 2016 already had the makings of a pivotal year for manufacturing, and for the world.

There were the big events for the year, including the United States as Partner Country at Hannover Messe in April and the 2016 International Manufacturing Technology Show in Chicago in September. There's also the matter of the U.S. presidential elections in November, which promise to shape policy in manufacturing for years to come.

But the year started with global economic turmoil, as a slowdown in Chinese manufacturing triggered a worldwide stock hiccup that sent values plummeting. The continued plunge in world oil prices has resulted in a slowdown in exploration and, by extension, the manufacture of exploration equipment.

Read more: 2015 Salary Survey

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.
This article collection contains several articles on the vital role of plant safety and offers advice on best practices.
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.
This article collection contains several articles on strategic maintenance and understanding all the parts of your plant.
click me