Background
Most control systems are at present rather isolated from the outside world, including intranets and the Internet. This isolation has worked well and the number of reported security attacks is insignificant.
However, as the possibilities of control systems expand, so do the security risks. One of the most occurring subjects is the matter of connecting control systems to the Internet and the increasing spread of viruses.
Types of security risks
The different types of security risks can generally be described as follows:
-
Viruses
-
Hackers
-
Accidental
-
Disgruntled Employees
-
Nature Catastrophes
Viruses is the most influential of the above because of their ability to uncontrollably spread. Viruses only act with indirect intent, meaning that nobody actually has to specifically wish to infect your control system. On the contrary it simply might happen because of absent or insufficient security.
Known Viruses
1986 1 virus
1989 6 viruses
1990 80 viruses
1999 20.500 viruses
2001 50.000 viruses
2004 15 viruses discovered every day
Hackers are the second most significant security risk. As opposed to viruses, a hacker acts with intent, which is - until recently - not commonly seen on a control system. Recent studies at the British Columbia Institute of Technology shows that control systems are earning increasing interest from hackers, because the effect of a successful hacker attack on a control system can have widespread consequences.
Accidental security attacks include employees that harm a control system because of their recklessness. A common example of this, are operators installing computer games on control systems, which are very likely to render the control system overloaded or in some cases, completely crash the system.
Disgruntled Employees are people who, for some reason or another, intentionally try to damage the control system or a dependency thereof. This is often hidden and unspoken of, but nevertheless it is a security risk that must be accounted for.
Nature Catastrophes (fires, earthquakes, hurricanes and lightening etc) is out of our control, but we can work to prepare ourselves to suffer the least of the consequences possible. Thereby, natural catastrophes become an important matter in relation to the security subject. In the computer industry preparation for natural catastrophes has been around for years, but there will always be room for improvements.