Plant cyber security

Cyber security of industrial plant contfol systems. 

The situation becomes more complicated when full lifecycle and maintenance activities are considered. Cyber security applies to all equipment suppliers and contractors, and also to any software maintenance and modification activities that may be done on the site to digital systems. In addition to the plant control and protection systems, there will be document management systems, work control systems and site access control systems, all of which have some relevance to safety. Hence Fig. 3.2 shows what a typical simplified information security architecture for an industrial plant site might look like. This shows a somewhat higher degree of complexity than Fig. 3.1. 

Plant cyber security is assessed according to plant domains, such as control systems, protection systems, and business systems. Business systems include document management, work control and site access control systems. In each domain, the full lifecycle needs to be considered (as portrayed in Fig. 2.1). This includes the following. 

For each environment, cyber secnrity needs to be assnred. Hence, in this simplified example we have three plant domains, each of which wiU have three lifecycle environments, so cyber security will have to be considered in nine different cases. 

The concern here is that a concerted cyber-attack on a site might pose a threat to the safety of the hazardous plant. The terminology here is important and a summary of basic information security terminology is provided in Table 3.1. 

Finally, the plant and business systems should be graded according to the potential impact of cyber-attacks. Within the nuclear industry, the International Atomic Energy Agency s (IAEA) publication 1527 makes reconunendations for minimum countermeasures according to security classification. A simplified version of the IAEA s classification is as shown in Table 3.4. 

---