This ISA technical report provides a current assessment of various cyber security tools, mitigation counter-measures, and technologies that may effectively apply to the modern electronically based IACSs regulating and monitoring numerous industries and critical infrastructures. It describes several categories of control system-centric cyber security technologies; the types of products available in those categories; the pros and cons of using those products in the automated IACS environments relative to the expected threats and known cyber vulnerabilities; and, most important, the preliminary recommendations and guidance for using these cyber security technology products and/or countermeasures.

The concept of IACS cyber security as applied in this ISA technical report is in the broadest possible sense, encompassing all types of components, plants, facilities, and systems in all industries and critical infrastructures. IACSs include, but are not limited to:

• Hardware (e.g., data historian servers) and software systems (e.g., operating platforms, configurations, applications) such as Distributed Control Systems (DCSs), Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) systems, networked electronic sensing systems, and monitoring, diagnostic, and assessment systems. Inclusive in this hardware and software domain is the essential industrial network and any connected or related information technology (IT) devices and links critical to the successful operation to the control system at large. As such, this domain also includes, but is not limited to: firewalls, servers, routers, switches, gateways, fieldbus systems, intrusion detection systems, intelligent electronic/end devices, remote terminal units (RTUs), and both wired and wireless remote modems.

• Associated internal, human, network, or machine interfaces used to provide control, data logging, diagnostics, safety, monitoring, maintenance, quality assurance, regulatory compliance, auditing and other types of operational functionality for either continuous, batch, discrete, and combined processes.

Similarly, the concept of cyber security technologies and countermeasures is also broadly applied in this ISA technical report and includes, but is not limited to, the following technologies:

• Authentication and Authorization

• Filtering, Blocking, and Access Control

• Encryption

• Data Validation

• Auditing

• Measurement

• Monitoring and Detection Tools

• Operating Systems

In addition, a non-cyber technology—physical security control—is an essential requirement for some aspects of cyber security and is discussed in this report.

Purpose

The purpose of this ISA technical report is to categorize and define cyber security technologies, countermeasures, and tools currently available to provide a common basis for later technical reports and standards to be produced by the ISA99 committee. Each technology in this technical report is discussed in terms of:

• Security vulnerabilities addressed by the technology, tool, and/or countermeasure

• Typical deployment

• Known issues and weaknesses

• Assessment of use in the IACS environment

• Future directions

• Recommendations and guidance

• Information sources and reference material

The intent of this technical report is to document the known state of the art of cyber security technologies, tools, and countermeasures applicable to the IACS environment, clearly define which technologies can reasonably be deployed today, and define areas where more research may be needed.