COMPREHENSIVE CYBER SECURITY VULNERABILITY ANALYSIS FOR MANUFACTURING PLANTS
Paul Baybutt · 2005
Manufacturing plants use computer systems to control manufacturing processes, store information, and manage value chain activities. All these computer systems can be attacked by cyber means and used to cause harm. Cyber security is an established discipline for information technology (IT) security but not for control systems or the value chain where the risk has only recently been recognized. Many approaches to IT security use checklist-based assessment methods to identify controls needed to manage cyber security risks. However, such methods are not risk analyses per se. They focus attention on comparing existing controls with an idealized set. Similar approaches are sometimes used in safety analysis. While they play an important role in ensuring that codes and standards are met, they do not provide the means for evaluating novel threat scenarios that are not covered by the codes and standards. This is especially an issue for cyber security where new exploits are constantly being devised by attackers. Some of the IT methods are not open or transparent. The details of the analysis are contained within computerized tools. Risk assessment approaches make explicit the basis on which decisions are made with regard to the implementation of cyber security measures. Ideally, IT, control system and value chain cyber security should be addressed by the same methods, and possibly even within the same study. Even better is the ability to incorporate physical security into the analysis. Three security vulnerability analysis (SVA) methods have previously been described by the author and applied to computer control systems. SVA is a form of risk assessment. The methods employ structured brainstorming, a technique that has a long history of success in the safety field. The methods can be used to study cyber security for any type of computer system including the manufacturing value chain and IT systems. This paper describes such applications. Studies using the methods described can be performed as adjuncts to existing SVAs