The Unseen Threat at Factories and Plants

Traditionally, security assessments in factories have been focused on the inside of the premises and not to the more exposed perimeter of the actual factory or plant, including the perimeter wall of the structure and the fence line.

Similarly, security assessors look at the factory’s cyber network and examine the configuration of servers, switches, and human-machine interfaces, but pay less attention to the outside of the facility walls and physical grounds because they tend to fall outside the typical cyber or physical security boundaries.

However, with increased awareness of security weaknesses to industrial control systems, there has been an increase in requests for security and consulting companies to conduct combined cyber and physical security assessments of factories and critical infrastructure.

The shift towards an ESRM approach to threat analysis

The industry is now moving towards enterprise security risk management (ESRM)—which focuses on using risk assessments to inform an organisation’s security approach—beyond assessing just physical security. However, this can be a difficult shift for facilities that do not have a clear risk profile.

This gap in the security assessment process offers an opportunity for plant managers to take an integrated, ESRM-inspired, approach and better understand their security and infrastructure vulnerabilities to both physical and cyber threats.

Conducting an integrated analysis helps bring awareness of what crosses facility boundaries, whether it be in electronic or physical form. It encourages plant managers to document underground infrastructure and fill gaps in knowledge and provides enhanced planning for both physical and wireless treat of attack from modes ranging from surface injections to airborne threats. By mapping out both the physical and electronic perimeters, a facility’s security approach can be based on what can and cannot be seen.

Story credit: Security Management (A publication of ASIS International)

This is an abstract from an article originally published by ASIS International and written by Ernie Hayden, PSP, Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), SANS Global Industrial Cyber Security Professional (GICSP). Ernie is the ICS cybersecurity lead at BBA, a Canadian engineering company and a member of ASIS.

Source: https://sm.asisonline.org/Pages/The-Unseen-Threat.aspx (read the full article here)