Industrial control systems are at the heart of plant operations. As automation systems become more connected, the consequences of a cyber intrusion can extend well beyond data or IT infrastructure. A compromised automation system, power supply system or package unit can lead to equipment malfunction, equipment damage or even a complete plant shutdown.

For industrial plants, cybersecurity therefore has a direct role in supporting safe, reliable and uninterrupted operations.

Building Cybersecurity into the Control System

Industrial automation systems often form part of critical infrastructure and need to remain both secure and reliable during normal plant operations. Cybersecurity is therefore an important consideration in the design of industrial automation and control systems.

A control system cybersecurity architecture generally brings together several complementary safeguards:

• Secure network strategy
• Firewalls
• System hardening
• Access control
• Antivirus and malware protection
• Backup and restore

Each addresses a different point of exposure within the control environment.

Secure Network Strategy: Creating Clear Boundaries

A secure industrial network begins with segmentation. Networks can be classified into internal trusted zones, internal semi-trusted zones or Demilitarised Zones (DMZs), and external or untrusted zones.

Trusted process networks sit behind a firewall, while a DMZ provides a controlled environment for applications that need to be accessible externally. This separation helps create defined boundaries between process systems and less-trusted networks.

Firewalls: Controlling What Crosses the Boundary

Network segmentation requires a barrier between trusted and untrusted environments. Layer 3 firewalls can provide this separation by monitoring and controlling incoming and outgoing network traffic according to predetermined security rules. Exceptions can then be configured according to the requirements of individual process applications.

Two firewall approaches are commonly used:

• Host-based firewalls, installed on individual computers or servers
• Network or dedicated firewalls, implemented as physical or virtual network-security devices to protect the wider network from unauthorised access and cyber threats

System Hardening: Reducing the Attack Surface

Not every function available within a control system needs to remain enabled.

System hardening reduces the potential attack surface by establishing a secure configuration across the complete system. This includes operating systems, industry-specific customised software and associated network devices.

Hardening can include removing insecure standard configurations, strengthening passwords using mixed-case alphanumeric characters and symbols, and running only the applications needed by the solution. Limiting unnecessary applications also reduces potential entry points for malware.

A comprehensive hardening strategy, planned and implemented at the appropriate phase of a project or process, is therefore an important component of a secure control system.

Access Control: Giving the Right Access to the Right People

Protecting a control system is also about controlling who can access it and what authorised users can do once access is granted.

Access control helps ensure that only authorised personnel can perform authorised operational tasks on automation systems and associated resources. Role-based access control can provide authentication and authorisation according to the responsibilities of different users.

These permissions may cover activities such as:

• Plant operation and control
• Engineering modifications to control systems
• System hardware and software-related activities

This provides a structured way to differentiate permissions based on the task being performed rather than providing unrestricted system access.

Antivirus and Malware Protection in a Control Environment

Malware protection can include technologies and security measures designed to detect and prevent system infections. Measures can range from malware-detection software to the deactivation of USB ports and other unused ports.

However, an industrial control environment is not identical to a conventional office IT environment.

Antivirus approaches used in office networks may also be applied to process networks and control systems, but they need to be adapted to the requirements and operating systems of the control environment. Antivirus or malware-software updates can potentially affect control-system behaviour or process-network performance.

Protection approaches can include blacklisting, associated with conventional antivirus protection, and application whitelisting, which allows approved applications to operate.

Backup and Restore: Preparing for Recovery

Cybersecurity also needs to address what happens when information or hardware is lost.

Backup and restore involves proactively copying data so that it can be recovered following hardware failure or data loss. Depending on the requirement, this may involve restoring large volumes of electronic media and files or recovering multiple smaller files.

Recovery may be required following:

• Accidental deletion or corruption of data
• Hardware failure
• Damage to facilities caused by natural events such as tsunamis, earthquakes, fire or flooding caused by heavy rainfall

Backup therefore contributes not only to cybersecurity preparedness, but also to the wider resilience and recoverability of plant systems.

Securing an Increasingly Connected Industrial Environment

Technology development is increasing the level of connectivity within industrial environments. Artificial intelligence is also being considered and implemented to improve plant efficiency and productivity, while Industrial Control Systems, or ICS, are becoming increasingly interconnected. This makes adequate cybersecurity measures important for maintaining safe, reliable and uninterrupted plant operations

In India, the Indian Computer Emergency Response Team (CERT-In) provides early warning and response to cybersecurity incidents and supports information sharing and cooperation on cyber-threat mitigation at national and international levels. CERT-In also regularly issues recommendations and security guidelines for protecting computer systems.

At the system level, Original Equipment Manufacturers are also improving cybersecurity within newer ICS environments through the identification of critical information, threat analysis, vulnerability assessment, risk assessment and implementation of countermeasures.

As industrial systems continue to become more connected, cybersecurity remains fundamental to protecting systems, networks and programs from digital attacks, preventing data loss and supporting uninterrupted plant operations.