Pubblicazione scientifica

Process for Security and Requirements Development

FILONE TECNOLOGICO	TEMA
trasformazione e commercializzazione

RIASSUNTO

Control systems such as SCADA and DCS are part of the critical infrastructures of the oil and gas industry. These systems were originally designed to be in physically secured and isolated areas. However, the need of integrating the ICS with IT networks and the increased use of COTS (USB, Win?) have resulted in less isolation. In addition, the new industrial targeted cyber security attacks have demonstrated that the air gaps strategy is no longer a viable security model.
The first industrial cyber-attack was Stuxnet and was discovered in June 2010. Stuxnet is, until now, considered as the most complex and sophisticated malware. Stuxnet targeted specific SCADA systems are configured to control and monitor the Iranian uranium enrichment facilities. It targeted a special model of Siemens 400 PLC series which is commonly used in the oil and gas industry. In fact, it spread throughout the industry and according to statistics 40% of cyber-attacks in 2012 were against the energy industry.
Stuxnet represents a paradigm shift and verifies the need for a holistic preventive security strategy and model. One important aspect of this, is security policy and requirements. There are two core international cyber security standards for policy and requirements development:
• ISO/IEC 27001/27002
• ISO/IEC 15408.
ISO/IEC 27001/27002 covers the organizational and physical security, while ISO/IEC 15408 covers technical security.
This paper describes a process of how to properly address security throughout the lifecycle of the ICS. The process is built on the two cyber security standards mentioned above, and does a step wise development of policy and requirements. The process starts from system architecture, then defines security architecture and ends with development of security policies and requirements.
This process has four benefits:
1. Ensures the fulfillment of the three core security objectives: availability, integrity and confidentially
2. Produces documents aligned with international standards
3. Enables change and requirements tracking
4. Eases the product evolution

DATA

Data di pubblicazione: 01/01/2014

AUTORI

AARAB NAJOUA
HOUMB SIV HILDE
HULICK KENT
ENGUM ERLEND A

ENTE DI AFFERENZA

NATL OILWELL VARCO
SECURE NOK AS

RIVISTA

SPE International Conference on Health, Safety, and Environment, 17-19 March, Long Beach, California, USA

indietro