Inadequacy of IT Approaches to Manage Cyber Security in ICS Context

Abstract

The paper “Inadequacy of IT approaches to manage cyber security in ICS context” gives an overview of the application of different IT solutions to deal with cyber security for industrial control systems (ICSs). The real time aspect is important for ICSs to monitor and control effectively different processes. On the other hand, some traditional IT solutions for cyber security do not comply with it. After a careful analysis, it is concluded that there is no ISO 27001 requirement to meet the “non interference” cyber security goal, used by the working group PCSRF in the System Protection Profile for ICSs to ensure that the security functions are implemented in a non-interfering way and do not affect the performance constraints of ICSs. Therefore, a new component, called “Cyber Safety”, is proposed to be added to the existing ones (confidentiality, integrity and availability). Its role would be to check the safety requirements (controls or measures) before their implementations. It is proposed a new model for the management of the cyber security risks that reuses existing results issued from the safety risk analysis and may add safety requirements.