Audit Protocols For Industrial Cyber Security

AUDIT PROTOCOLS FOR INDUSTRIAL CYBER SECURITYby Paul BaybuttPrimatech Inc.paulb@primatech.com614-841-9800www.primatech.comAbstractCyber security for industrial manufacturing and process control systems has not beenconsidered in many facilities. Vulnerabilities to attack by terrorists, saboteurs,disgruntled insiders and others must be identified and measures taken to address them.This can be accomplished by performing vulnerability analysis. Alternatively, obviousweaknesses can be identified by performing a cyber security review or audit. In practice,both vulnerability analysis and audits are needed as part of a cyber securitymanagement program.Keywords: Terrorism, cyber security, vulnerability analysis, auditing.IntroductionHistorically, cyber security has meant the protection of information stored in computersystems. However, there are broader concerns for manufacturing and processcomputer control systems and industrial cyber security should be defined as theirprotection from threats of:C Cyber attack by adversaries who wish to disable or manipulate them.C Physical attack by adversaries who wish to disable or manipulate them.C Access by adversaries who want to obtain, corrupt, damage, destroy or prohibitaccess to valuable information.Cyber support systems and utilities should also be protected. Essentially, this is a newdiscipline. Security vulnerability analysis (SVA) can be performed to identify flaws andweaknesses in cyber systems. However, ...