Motivation
Protection of process control data, networks, applications, and host operating systems, particularly in multi-vendor environments, is a critical, ongoing requirement for the Oil & Gas sector. The threat to a control system’s availability, integrity and access is real. Attack methods and tactics are diverse as evidenced by the recent StuxNet and Night Dragon attacks. A loss of control over a critical process potentially results in production loss, economic cost, environmental impact, facility damage, personnel injury, and loss of life.
The Host Protection Strategies (HPS) project proposes to investigate the effectiveness of existing and emerging automation system host protection technologies designed to ensure control system security in the face of mounting network or system vulnerabilities, unintended and/or malicious software additions, or changes to the control system.
Approach
Testing will entail installation of security solutions in a representative industrial control systems environment, and an evaluation of HPS solutions with respect to effectiveness and compatibility with the control system. The evaluation is not just for efficacy, but also for lifecycle, complexity, impact on the process application, change management, patching, and enhancement to the automation vendor’s integrated security solution. The evaluation will consider integration that has already taken place between security and automation vendors.
Findings
This project will provide insight into current initiatives by automation vendors to integrate HPS solutions in their product offerings, as well as encourage automation vendor accreditation of HPS solutions.
Contact
Program Manager: Greg Wigton - Biography