IACS Cybersecurity.
exida helps mitigate security risks and assists in delivering intrinsically secure products.
ISA/IEC-62443/ISA-99 Based Industrial Automated Control System (IACS) Cybersecurity
Industrial Automated Control System (IACS) Cybersecurity has quickly become a serious issue for professionals in the process and critical infrastructure industries.
An unprecedented number of security vulnerabilities have been exposed in industrial control products and regulatory agencies are demanding compliance to complex and confusing regulations. Very few industries are actually regulated, and of those that are, the regulating agencies are demanding compliance to complex and confusing regulations. Those that are not regulated are dealing with a wide variety of vague and sometimes conflicting standards from multiple sources.
There are well established strategies and techniques that automation professionals can employ to discover and mitigate security vulnerabilities and improve the inherent security of their products and systems. Learning and adopting these strategies will help companies stay ahead of potential vulnerabilities.
exida is an ISA/IEC-62443/ISA-99 based industrial automated control system (IACS) and SCADA system security consulting and certification firm that focuses on the unique requirements of industrial automation and process control systems.
Speaking from Experience
exida staff has over 30 years of experience in industrial automation and control system safety and/or cybersecurity design, implementation and assessment. exida has experience in assessing and developing cybersecurity solutions in the Transportation, Oil & Gas, Electric Utility, Chemical, Water & Waste Water and other industries that rely heavily on the use of industrial automation and control systems.
At exida, we are familiar with the Department of Homeland Security (DHS), Transportation Security Administration (TSA), National Institute of Standards and Technology (NIST), and the American Public Transportation Association’s (APTA) guidelines, recommended practices, and standards.
exida has also led and participated in the definition of cybersecurity standards via: ISA 99 committee work – ANSI / ISA / IEC 62443 (formerly ISA 99), APTA recommended practices for passenger rail (Securing Control and Communications Systems in Transit Environments), and ICSJWG sub-group work.
exida is an industrial automation control system (AICS) and SCADA system security consulting and certification firm that focuses on the unique requirements of industrial automation and process control systems.
Services
exida is involved in each step of the cybersecurity lifecycle from Assessment to Design to Operate & Maintain. We provide a range of ISA/IEC-62443/ISA-99 based services that is customized to your site’s requirements while following the latest cybersecurity standards and guidelines. Here is a synopsis of what we offer.
1. Assess
You wouldn’t begin a journey until you know where you are starting from, where you want to go and how you are going to get there.
Planning the journey to secure your control systems is no different. It starts with understanding the risks that control system security (or insecurity) can have on your business. This is known as a risk assessment and it is used to quantify the threats that pose a danger to your business. exida ranks these risks so you know how to prioritize your security dollars and efforts.
exida can assist you with the following critical steps during the assessment phase:
- Assess and evaluate (cybersecurity training and awareness) - see course list below
- NIST Cybersecurity Framework gap assessment - NIST Interview, Current vs. Target Tier/Profile Analysis, NIST Framework gap report, Recommended future steps
- Cybersecurity Project Scope Definition and Setup - Analyze current profile and recommend steps forward, Analyze and/or create architecture drawing(s), Policy/Procedure development and/or review
- Cybersecurity Vulnerability Assessment (CVA) - Perform Cybersecurity Vulnerability Assessment, Review and evaluate Architecture Drawing(s), Evaluation of existing countermeasures, Network architecture and traffic assessment, Policy/Procedure Review
- High Level Cybersecurity Risk Assessment (HLCRA) - Development of High Level cybersecurity risk assessment procedure, Assist with inventory requirements, Criticality Assignments, Assist with Zone & conduit and Dataflow Information, Train staff on risk assessment procedure, Facilitate and Document Risk Assessment, Initial Security Level (SL) assignments, Threat Modeling
- Detailed Level Cybersecurity Risk Assessment (DLCRA) - Development of Detailed Level cybersecurity risk assessment procedure, Assist with inventory requirements, Train staff on risk assessment procedure, Facilitate and Document Risk Assessment, Documentation of assessment results, Security Level-Target (SL-T) assignment confirmation, Threat Modeling
- Process Control Network Defense-in-Depth Review - Zone and Conduit Modeling, Zone and Conduit – Review of corporate reference models, Zone and Conduit - High-level diagrams, Zone and Conduit - Detailed design, Zone and Conduit - design reviews, Barrier device training and commissioning
2. Design
The design phase starts with a structural assessment of your security system's architecture and configuration. A detailed study together with full, up-to-date documentation will be reviewed to discover potential cybersecurity vulnerabilities. Together with exida, the target design is compared in detail with your current network architecture. A road map with technical details and execution time schedule are then finalized.
exida conducts the following during the design phase:
- Cybersecurity Requirements Specification (CSRS) - Technical writing - Templates, Development of Requirements, Review of Cybersecurity Requirements Specification
- Cybersecurity Design Specification (CSDS) - Consultation, Review, Technology Investigation & Recommendation
- Defense-in-Depth Analysis - Analysis of effectiveness of defense layers, Detection-in-Depth Analysis (analysis of effectiveness of monitoring layers)
- User account Administration, Access, and Authorization Philosophy - Policy/Procedure Review, Policies/Procedures Development, ACL Review, Design Reviews
- Cybersecurity Factory Acceptance Test (CFAT) - Cybersecurity Factory Acceptance Test plan development, CFAT execution and reporting
- Cybersecurity Site Acceptance Test (CSAT) - Cybersecurity Site Acceptance Test plan development, CSAT Execution and reporting
3. Operate & Maintain
Even after your solution is put into place, exida assists you with the processes required to keep your process safe, secure, and reliable.
exida can assist you with the following during the operate & maintain phase:
- Cybersecurity Monitoring & Maintenance - Develop logging requirements, Assess monitoring methods, Assess Countermeasures, Assess Security Levels (SL) to requirements
- Modifications or Decommissioning of ICS - Impact Analysis Review
- Cybersecurity Vulnerability Assessment (CVA) - Perform Cybersecurity Vulnerability Assessment, Review and evaluate Architecture Drawing(s), Evaluation of existing countermeasures, Network architecture and traffic assessment, Policy/Procedure Review
Case Study
Regional Wastewater Treatment Facility Secures Network PLCs with Belden-exida Solution and Hands-on Training.
exSILentia Cyber - Industrial Control System Cybersecurity Risk Assessment Tool
exSILentia Cyber helps to streamline communication across an organization and between different departments when performing cyber risk assessments. It provides a standardize approach across all disciplines while aligning cyber security activities with overall corporate risk criteria.plant electronics technician - the city’s Department of Water Resources.
IACS Cybersecurity Courses
We offer a range of IACS Cybersecurity training courses for today's industry professional, from basic to advanced concepts. We also offer customized training options available upon request.
Students benefit from exida's in-depth knowledge and expertise , enabling them to fully understand cybersecurity and implement procedures in their organizations to ensure that they are not vulnerable to cyberattacks.