Cybersecurity in your enterprise.

ISA/IEC 62443 provides a powerful tool to reduce the risk of financial, reputational, human, and environmental impact from cyber-attacks on Industrial Automation and Control Systems (IACS).

Topics in the paper
1. What is an IACS Cybersecurity Program?
2. Preparing an IACS Cybersecurity Program
3. How does an IACS Cybersecurity program relate to IT Cybersecurity?
4. Costs and Benefits of an IACS Cybersecurity Program
5. What to do next!

However, since it is a “horizontal standard”, 62443 is meant to address a wide range of industries, and any specific company is likely to find that while most of the standard applies to their IACS, parts of it may not. For example, some “normative requirements” that are appropriate for an interstate pipeline, may not be relevant to a chemical plant or a discrete manufacturing facility.

There are also obvious differences between a large-scale corporation with many sites and thousands of employees, and a small company with a few dozen staff.

This white paper, Implementing an Industrial Cybersecurity Program for Your Enterprise,  published by the ISA, is intended to address the needs of Owner/Operators of industrial facilities.

@ISA_Interchange @IrelandISA #Pauto #Cybersecurity

Three product development sites are world’s first to reach important industry benchmark.

Schneider Electric, a global specialist in energy management and automation, has received an ISASecure Security Development Lifecycle Assurance (SDLA) conformance certificate from exida, LLC, an ISASecure ISO 17065 accredited certification body.  This first-of-its-kind certificate applies to Schneider Electric’s Process Automation business product development centers in Foxboro, Mass., Worthing, U.K., and Hyderabad, India. It is based on international cybersecurity standards and was developed to accelerate industry-wide cybersecurity improvement for industrial automation and control systems (IACS). “The ISASecure SDLA certification demonstrates Schneider Electric’s long-standing commitment to secure industrial automation and control systems, and it sets a major benchmark for the industry as a whole,” said Andre Ristaino, Managing Director of the ISA Security Compliance Institute (ISCI). “We are proud to lead the way. Being the world’s first IACS provider to achieve this important benchmark is a testament to our commitment to delivering control and safety solutions that minimize system vulnerabilities and are resilient to cybersecurity threats,” said Raja Macha, vice president, research and development for Schneider Electric’s Process Automation business. “Addressing cybersecurity threats is a collaborative effort, however, so Schneider Electric continues to join forces with accredited certification and assessment bodies—like ISASecure and exida—to meet continuous cybersecurity demands.” Cybersecurity is fundamental to Schneider Electric’s principles of helping its customers achieve more with fewer resources in a more connected world. “The three certified Schneider Electric sites show they use a product development lifecycle in which cybersecurity considerations in all phases are part of their culture, demonstrating an institutionalized commitment to securing industrial automation and control systems,” said Chris O’Brien, principle partner at exida, an ISO 17065 certification body that is accredited by ANSI/ANAB to offer security certification of automation products per the ISASecure IACS Cybersecurity Assurance program.

Cybersecurity best-practices from the attacker's perspective.

The International Society of Automation (ISA) will jointly deliver a live industrial cybersecurity webinar in late September with one of its ISA Promotional Partners, Ultra Electronics, 3eTI®, a leading cyber-technology company with products and solutions that secure critical infrastructure and improve operational efficiency. The free, one-hour webinar with Q&A session, "Building Stronger, Smarter Industrial Control Systems: Cyber Security Best-Practices from the Attacker's Perspective," will be conducted at 1 p.m., Eastern Standard Time, on Wednesday, 30 September. To register, click here.  The webinar will examine: vulnerabilities of industrial control systems underpinning the world’s critical infrastructure and means to defend against industrial cyberattack; advanced methods for managing cyber risks, and robust architectures that can accommodate new and legacy systems.  Today’s ICS, experts contend, are designed for high reliability rather than cybersecurity. The vulnerability of these systems to cyber threats and the growing sophistication of industrial cyberattacks are increasing the likelihood of serious, adverse events. The webinar presenters—Alex Tarter, Ph.D., Director of 3eTI's Cyber Security Programs, and Adam Crain, Partner at Automatak and noted cybersecurity researcher—will consider these dynamics in evaluating how new developments in ICS architecture are contributing to more robust and secure ICS. At the core of ISA’s leadership in IACS cybersecurity is the ISA/IEC 62443 series  of standards. Developed by international cybersecurity experts from across industry, government and academia, the standards are designed to prevent and mitigate IACS security vulnerabilities across all key industry sectors and critical infrastructure—including  power generation, water treatment, petroleum and chemical processing, and other vital operations. "We're pleased to be working with ISA on this latest webinar project," said Frank Ignazzitto, Vice President of Sales & Marketing, 3eTI. "We've learned from past collaborations that ISA audiences are engaged, highly informed and ready to drive dynamic conversations on ICS security, standards and processes. We look forward to another excellent session." Jennifer Infantino Halsey, ISA's Director of Marketing & Communications, emphasized that the mounting threats of industrial cyberattack increase the need for industry and manufacturing leaders to stay informed on effective cybersecurity strategies and solutions. “This joint webinar is a convenient and highly accessible way our members and customers can better educate themselves about the risks of cyberwarfare and take proactive steps to minimize their exposure."

Integrated industrial cybersecurity courses and certificate programs.

Building on its global leadership in industrial cybersecurity and its commitment to help prepare a new generation of workers capable of preventing potentially catastrophic cyberattacks, the International Society of Automation (ISA) has introduced an expanded suite of industrial automation and control system (IACS) cybersecurity training, including three new technical training courses with associated certificate programs. The three new ISA industrial cybersecurity training courses include: Assessing the Cybersecurity of New or Existing IACS Systems (IC33) IACS Cybersecurity Design & Implementation (IC34) IACS Cybersecurity Operations & Maintenance (IC37) By combining these three new courses and aligned certificate programs with its current course offerings in IACS security—Using the ANSI/ISA-62443 Standards to Secure Your Industrial Control System (IC32); Cybersecurity for Automation, Control, and SCADA Systems (IC32E); and Introduction to Industrial Automation Security and the ANSI/ISA-62443 Standards (IC32C)—ISA is able to deliver a comprehensive set of industrial cybersecurity training solutions and address the complete “lifecycle” of cybersecurity training requirements. ISA’s cybersecurity certificate programs are offered to those who successfully complete the requirements of ISA’s cybersecurity courses. Passage of each of the three new certificate exams bestows specialist recognition—enhanced evidence and endorsement of a cybersecurity professional’s subject-matter proficiency. ISA already offers a first tier, introductory cybersecurity certificate exam—leading to the designation as ISA99 Cybersecurity Fundamentals Specialist—for those who complete ISA courses IC32 or IC32E. Those who complete all four core ISA cybersecurity courses (IC32, IC33, IC34 and IC37) and pass all corresponding certificate exams will achieve the designation level of ISA99 Cybersecurity Expert. However, individuals may explore the training and designation that are most appropriate based upon their current experience and job requirements. “No organization has a more complete set of industrial cybersecurity courses and certificate programs and is better capable of providing the all-encompassing, expert training needed to develop a highly skilled and well-prepared industrial cybersecurity workforce than ISA,” declares Dalton Wilson, ISA’s Director of Education Services. “We now provide everything from a general overview of industrial automation security to detailed instruction on how to best leverage ISA’s series of industrial cybersecurity standards through a full-circle exploration of IACS assessment, design, implementation, operations and management.” At the core of ISA’s marketplace leadership in IACS cybersecurity training is the ISA/IEC 62443 set of standards, which are proven to prevent and mitigate IACS security vulnerabilities across all key industry sectors and critical infrastructure. Reducing these vulnerabilities is critical since they can open the door to potentially devastating cyber damage to the industrial plant systems and networks used in power generation, water treatment, refineries and other vital industrial facilities. The ever-rising volume of industrial cyberattacks combined with the increasing diversity and sophistication of cyberwarfare tactics have generated a tremendous demand for qualified industrial cybersecurity professionals. In fact, the demand for cybersecurity professionals is growing 12 times faster than the overall job market. Outlined below are descriptions and other important information on each of the three new ISA cybersecurity courses and related certificate exams.