POWER June 2021 - 36

CYBERSECURITY
A Systematic Approach to
Checking Cybersecurity for
Critical Infrastructure
When securing network assets, a long and often complex list of configurations must
be performed to ensure industrial control systems have the appropriate cyber
protection. This article presents a systematic and automatic approach to those
security configurations, with an aim of decreasing the probability of implementing
incorrect or incomplete configurations that can occur when performed manually.
Felipe Sabino Costa
I
n recent years, there has been an
increasing number of cyberattacks
on critical industrial sectors including
energy, water treatment, hospitals, and
transportation. As all of these sectors
require electricity, the power generation
industry is vital to them, which makes it
a prime target of cyberattacks.
The Normative Approach
Recent studies have shown that the best
approach to protect critical infrastructure
from a regulatory perspective is
by using a hybrid adoption of standards
(vertical and horizontal). Horizontal standards
are characterized by a broader and
more flexible spectrum, such as the International
Society of Automation (ISA)/
International Electrotechnical Commission
(IEC) 62443, and can be applied to
a wide variety of critical infrastructure.
The vertical standards focus on a specific
sector, such as the North American
Electric Reliability Corp. (NERC) Critical
Infrastructure Protection (CIP) standards
for the electrical sector.
This recommendation is based on the
fact that applying both types of standards
brings greater procedural robustness to
the overall cybersecurity solution. As each
normative system focuses on the more
specific parts of their standards, their approaches
tend to complement each other
rather than oppose, bringing a highly multifocal
approach to the process.
Based on this approach, the ISA/IEC
62443 set of standards, hereinafter referred
to as " standard, " will be presented
as an applicable cybersecurity guide to
any critical industrial process. Included in
section 4 of the standard are lists of good
practices and requirements to which components
must adhere. There are different
levels of complexity defined by different
36
" security levels, " which detail the level of
resilience the components would be able
to offer in the event of a cyberattack.
Each security level has a clear definition
of the skills, motivations, intentions,
and resources that the level is able to
protect. Assuming that the standard already
presents best practices for predetermined
levels, the automatic security
verification system presented in this article
is based on the parameters elaborated
by it. Security level 2 (SL-2) was
defined as the minimum requirement for
critical infrastructure, and is capable of
handling the simplest and most common
intrusion attempts, including brute force,
network scanning, and weak authentication,
among others, by associating these
features with a graphical interface. Additionally,
more sophisticated attacks,
considered as higher levels (levels 3 and
4 that represent terrorism and nation
attacks, respectively), require a much
greater combination of resources (software
and hardware) as well as a much
longer development time.
The Importance of Systematization
The use of a systematic and mainly automatic
approach to implement configurations
is essential to ensure uniformity
and, more importantly, a consistent and
reliable repeatability of the configurations.
This approach aims to reduce human
interference during this process, as
the human factor is considered a major
cause of cyber incidents regardless of
whether they are intentional or not.
Performing configurations automatically
becomes even more important in
repetitive activities, as human beings
generally tend to make more mistakes
on this type of process. Thus, the aim is
to ensure that manual configurations are
performed only when absolutely neceswww.powermag.com
1.
Graphical architecture with color system
security status. Courtesy: Moxa
sary as this will significantly reduce the
possibility of mistakes.
Further compounding this problem
is the fact that vulnerabilities caused
by human error are difficult to detect,
because the detection often relies on
the audit process that the company has
implemented, which may not be 100%
reliable. This type of problem tends to
be exponentially greater if the audit processes
are purely manual. Unfortunately,
sometimes an employee will deliberately
attempt to sabotage a network. Whether
performed by accident or on purpose,
both are referred to as insider threats. It
is, therefore, crucial that cybersecurity
measures also be able to identify and
prevent those with malicious intent from
being able to disrupt normal operations.
It is important to give attention to not
only the methodologies themselves, that
is, " what to implement, " but also to the
way in which they are implemented-
" the how. " By taking a systematic and
automatic approach to implement the
configurations, these risks can be considerably
reduced, which increases the
reliability and security of the networks.
Although this article presents many
arguments that support implementing
an automatic and systematic approach
as opposed to an approach that relies
POWER | June 2021
http://www.powermag.com
POWER June 2021

Table of Contents for the Digital Edition of POWER June 2021
