Intrusion Avoidance for SCADA Security in Industrial Plants

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Intrusion Avoidance for SCADA Security in Industrial Plants"

Transcription

1 Intrusion Avoidance for SCADA Security in Industrial Plants Athar Mahboob Department of Electronic and Power Engineering National University of Sciences & Technology Karachi, Pakistan Junaid Zubairi Department of Computer Science State University of New York at Fredonia New York, USA ABSTRACT In this paper we present an overview of security threats to the cyber infrastructure of industrial and power plants and the current state of affairs of industrial and SCADA cyber security. Control systems security is of prime importance especially for energy sector. North American Electric Reliability Council (NERC) has issued mandatory rules which must be complied by 2010 by all registered power operators in order to ensure control systems security for power plants. Cyber security assessment was conducted on ICS (Industrial control systems) of different companies for a period of four years and several vulnerabilities were identified. Main problems included use of weak encryption, standard protocols and information disclosure using unencrypted communication among ICS hosts on the network. Exploiting these vulnerabilities, a hacker could alter the communication between ICS and controlled equipment, resulting in malfunction. Overcoming these vulnerabilities is essential in order to protect the vital power sector in any country of the world. We present important guidelines and standards in cyber security and propose a simple intrusion detection scheme for SCADA networks. which have been Internet and web-enabled. The driving force behind this adoption has been the possibility of huge cost savings and the ease of use and familiarity with these interfaces [1]. One important aspect was overlooked during this wide-spread adoption of Internet Technologies. Industrial control systems hitherto had been operating in isolation with the world outside the industrial plant. This defacto isolation provided a security to these control systems which now stands withdrawn. Now these industrial control systems stand vulnerable to the same threats that the enterprise information systems have faced for decades. However, the consequences of these threats are much more severe in case of industrial and SCADA systems. What exacerbates the situation is that while Information Security has been well studied in Enterprise IT, in the industrial environment the problem has just started to be studied and addressed. At the same time the operations and maintenance staff of these systems is not fully prepared to face the challenges. The road to secure SCADA systems will be a long and arduous one. In this paper we present the current state of affairs and propose a simple technique for intrusion detection. 1.1 What is SCADA? KEYWORDS: SCADA Security, Industrial Cyber Security 1. INTRODUCTION The industrial environment has changed significantly in last two decades. Networked control systems have become ubiquitous. There is increasing use of standard protocols like TCP/IP and Ethernet. Many control and status monitoring systems have Human Machine Interfaces (HMI) SCADA (Supervisory Control and Data Acquisition) is a system to automate industrial control and monitoring. SCADA includes field sensors, Programmable Logic Controllers (PLC) and Remote Telemetering Units (RTU). SCADA use can be found in power generation, manufacturing automation, oil and gas exploration and utilities monitoring and control. A typical SCADA system is shown in figure 1. SCADA can turn ON and OFF equipment automatically under the control of software or remotely through human interface devices. SCADA can be used to monitor pa-

2 that many industrial control systems became insecure without their owners realizing this. Operator HMI Internet MTU RTU RTU To give a proof of concept of the threat to cyber infrastructure of industrial plants in March 2007, the Department of Energys Idaho National Laboratory made a video demonstrating the Aurora vulnerability. A series of on and off commands were sent to a large generator set connected to a TCP/IP network. These commands were timed so that the generator became out of phase and was destroyed. The video was released to the press and made the point that the use of open networking standards such as TCP/IP was creating system-wide vulnerabilities [1]. Sensor Sensor Sensor Figure 1. Typical SCADA System Components rameters such as temperature, pressure, flow rate, ph, etc. SCADA can set off alarms based on collected and observed data. SCADA remote access can be enabled through a web based interface or specialized software on networked machines. 1.2 IT Penetration in Industrial Plants and Cause of Problem Industrial process equipment is generally controlled by devices (PLCs, RTUs and DCS). These devices are monitored and controlled by Human Machine Interfaces (HMI). HMI increasingly use common commercial operating systems and standard PCs. The upside of this is that networking allows sharing of data for maintenance and management thus improving process and industrial productivity. The downside is that PCs can be hacked enabling intruder access to industrial process. An informative study of the problem has been done in [1] which highlights that utility control systems were originally designed for dependability and ease of safe use by operators. In the past they used completely private networks. For this reason their designers gave no attention to authentication or encryption. These networks tend to be organized in star topology, with many sensors and actuators connected to a control center. Use of protocols such as DNP and Modbus on these control networks enables anyone who can communicate with a sensor to read it and for anyone who can send data to an actuator to give it instructions. Private networks are generally expensive, and the prospects of mammoth cost reductions lured engineers to connect control systems to the Internet. The end result is 2. Industrial IT Systems versus Enterprise IT Systems Whereas cyber security has received considerable attention in enterprise information systems and that knowledge definitely needs to be applied to the industrial IT systems. The Industrial environment is inherently very different from enterprise IT environment. Intrusions in Industrial Environment can cause: Environmental damage Poor quality Safety risk Lost production Power outages We highlight some major contrasts between enterprise IT (IT) and industrial control systems (IC) below. For further detailed comparison the reader is referred to [2]. IT can tolerate delays; IC cannot IT malfunction causes loss of data; IC malfunction causes loss of lives and/or equipment IT can reboot to solve problem; IC must continue to function without interruption There are various peculiarities of industrial control systems which make the attaining cyber security objectives for them even more challenging. Industrial control systems have: Lock-in due to very long lifecycles. A typical power plant has an operating life in excess of 30 years. Complex supply chains: Heterogeneous OEM environment and complex vendor relationships.

3 2.1 Control Systems Security is Integrity Centric A major difference between IT and IC is that control systems security is fundamentally about integrity and availability rather than confidentiality. This requires cyber security specialist to focus effort on these aspects of cyber security assessment and implementation in industrial control systems. 2.2 Control System Security Needs to be Pro-active In enterprise information systems IT security is a reactive technology. As incidents get reported security patches are produced by vendors and system owners and operators apply these patches, periodically or reactively. Often these patches require a reboot of the system. Industrial cyber security needs to be proactive tainted water supplies, for example, cannot be reversed. Plugging the holes and securing the interfaces is required. In fact, in USA, the government is leading efforts to secure cyber infrastructure of industrial and power plants [3, 4, 2]. 2.3 System Longevity IT platforms like PCs get patched every month (PCs) through vendor released security updates. Mobile phones tend to get replaced frequently. Control systems on the other hand may remain in use for decades. Most of their components were not designed for remote upgrade. There may be a substantial cost to downtime for application of patches as many of these systems may have a requirement of % availability less than 6 minutes downtime per annum. The result may be that control systems may be patched late or not at all. Many organizations believe that vulnerability information should not be published, resorting to security through obscurity. 3. Vulnerabilities Industrial Control and SCADA systems face many vulnerabilities. These include: Organized criminals Saboteurs Disgruntled insiders Novice users Firmware malfunction To emphasize the fact of the above mentioned vulnerabilities we provide results of certain case studies in industrial cyber security. 3.1 Cyber Security Case Study-1 Timeline June 1999 Bellingham, WA, USA Incident Gas pipeline ruptured igniting fires killing 3 people and spilling 1/4 million gallons into the environment Culprit SCADA failure Cause Attempted update on live SCADA caused it to become unresponsive 3.2 Cyber Security Case Study-2 One of the best studied breaches include the Maroochy Water Breach [5, 6]. Australia Timeline Feb to April 2000 Target SCADA radio controlled sewage equipment in Queenslad Person Vitek Boden, ex-employee Method Issued a series of control commands to spill sewage around open areas like parks and playgrounds and disabled alarms at pumping stations 3.3 Cyber Security Case Study-3 Ohio, USA Timeline January 2003 Target Safety Monitoring System Davis-Besse Nuclear Power Plant Culprit Slammer worm Method Entered the business network through unprotected T1 line backdoor then spread to plant control network disabling SPDS (Safety Parameter Display System) 3.4 Cyber Security Case Study-4 23 states in USA

4 Timeline August 2003 Target Culprit signal and dispatch system CSX Railroad Worm infection Method Worm entered the network and infected signal and dispatch system halting passenger and cargo train traffic in 23 states 4. Top SCADA Security Issues Top cyber security issues include [7]: Inadequate security policy of the organization The organization does not define and enforce cyber systems security rules across the board. Even if the security policy is defined, it is not implemented, updated or reviewed regularly. Lack of Layered Defense The organization considers security enforcement at one level to be sufficient. For example, a perimeter firewall that protects from intruders at the entry point does not stop the unauthorized access of SCADA systems from inside. Missing logs of access In general, logs of access must be maintained for critical systems but the system manager may forget to backup the log files before these are periodically overwritten by the server. The system manager may not be familiar with forensic and audit methods and detection tools. The organization may not attach importance to obtaining something beyond the normal requirements. Internet based SCADA Users may like the convenience of accessing SCADA equipment remotely however opening Internet based access is always perilous for such systems. The chances of intrusion increase greatly when there is a link from worldwide network to the SCADA infrastructure. Non-related Software on PCs Games and non-related software may be installed by authorized users on control PC. The use of such software may interfere with the control function of the PC. Beta version software may not be stable and result in system crash. This could result in malfunction of the equipment. Control software not scrutinized Such software is not sold to millions of customers. Therefore, the initial testing and scrutiny that occurs in beta versions of general purpose software is missing. It may not be surprising that some failures and faults are discovered during the actual operation. Moreover, control commands and data not are not authenticated. CSSP (Control Systems Security Program) is a DHS agency that carried out detailed industrial cyber security assessment in 2009 [8, 9]. The results of this assessment were surprising. The top issue identified was the use of weak standard ITC protocols and lack of input validation in industrial control systems. Most of the ICS computers were found to be prone to buffer overflow mishaps as bounds check was not enforced in the software. Another point of concern was unencrypted protocol communication causing SCADA data and user credentials to become open to hacking. Even if encryption was enforced, it was weak as per the standard protocols being used. The third most prevalent issue found was none or weak password enforcement and improper security enforcement. 5. Addressing SCADA Security Concerns There has been substantial progress in addressing SCADA security concerns. Idaho and Sandia National Labs have developed SCADA power grid and wireless Testbed. Sandia Lab has established center for SCADA Security. Risk assessment for water utilities was performed recently by these agencies. US Government has issued guidelines for implementing industrial systems security. North American Electric Reliability Council (NERC) has issued mandatory rules for securing cyber infrastructure of power plants. These rules must be complied by 2010 by all registered power operators in order to ensure control systems security for power plants [4, 3]. Mitigation of SCADA security threats and vulnerabilities can be done by implementing a few rules consistently and across the organization. For example, keeping SCADA computers private can reduce the risk of intrusion considerably. If these computers are made accessible from the Internet, only the absolute minimum number of such machines should be connected. Wireless SCADA communications must be encrypted and authenticated with hardware signatures. If users are allowed to issue and execute commands from the Internet, a command subset should be defined that is much restricted than the original set. One important aspect of SCADA security is multi-layered defense or the defense in depth. Slay and Miller presented multiple layers of defense for SCADA systems in [5]. Their proposed architecture uses a DMZ (Demilitarized Zone) to

5 isolate SCADA systems from outside world. The arrangement is shown in figure 2. must be processed by the system administrator. Thresholds can be set by defining for each node N i : U i as utilization of upward transmission link Other connections directly to the SCADA network SCADA Application Server(s) HMI SCADA Control System Field Units (PLCs/RTUs) SCADA Network Gateway including a Firewall, IDS and Antivirus Shared Servers/Resources DMZ Gateway including a Firewall, IDS and Antivirus Corporate Network Figure 2. Firewall Protection for SCADA Network [5] The layers of protection include firewalls, IDS (Intrusion Detection System) and anti-virus software on SCADA PCs. It is recommended not to use default settings of firewalls but to go through all the configuration steps. It must be part of standard operating procedure to update all the software and firmware related to RTU (Remote Telemetry Unit) and PLC (Programmable Logic Controller). Multiple layers of defense should also include zoning where the users accessing the SCADA controllers would be granted command and control access rights as per their location. We suggest to restrict the sets and combinations of commands, that can result in drastic changes to the system parameters, to local zone only. Alternately, users may be asked to enter additional authentication information such as second password or their confidential PIN if they attempt to run the commands to reset the whole system or override alarm conditions. Log of such access must be maintained on permanent basis. One-way secure web servers can be installed for remote monitoring of the system. However, the web pages should not contain an interface to login for system console. An important signature of intrusion is increased level of network traffic between the SCADA machines and outside network. Since the SCADA commands are mostly simple and text format instructions, the network bandwidth utilization remains low. Triggers can be activated when the network bandwidth utilization increases above and beyond a threshold level. Increased traffic between the SCADA machines and the outside world signals something unusual and D i as the utilization of downward transmission link And for all nodes: (U i + D i ) T L (1) i where T L is defined by dividing max acceptable SCADA flow rate by available bandwidth. 6. CONCLUSION The threats to cyber infrastructure of industrial plants have been proven to be an emerging problem requiring the information security experts and industrial control systems designers to collaborate and incorporate information security best practices into the design and operation of new industrial control systems. Inevitably the new industrial control systems will utilize Internet and web based technologies. Proactive protective measures must be built into these systems because the stringent constraints placed on operational availability do not allow for reactive security measures to be practiced. REFERENCES [1] R. Anderson and S. Fuloria, Security Economics and Critical National Infrastructure, in Workshop on the Economics of Information Security 2009, [2] N. C. S. D. Control Systems Security Program, Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies, Homeland Security, Tech. Rep., [3] T. Nash, An undirected attack against critical infrastructure - a case study for improving your control system security, Lawrence Livermore National Laboratory, Tech. Rep., [4] K. Stouffer, J. Falco, and K. Kent, Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security, National Institute of Standards and Technology, Tech. Rep., [5] J. Slay and M. Miller, International Federation for Information Processing, Volume 253, Critical Infrastructure Protection. Springer, 2008, ch. LESSONS LEARNED FROM THE MAROOCHY WATER BREACH, pp

6 [6] M. Abrams and J. Weiss, Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia, MITRE Corporation, Tech. Rep., [7] P. Welander, 10 Control System Security Threats, Control Engineering, [Online]. Available: Control System Security Threats.php?q=10+Control+ System+Security+Threats [8] Control Systems Security Program (CSSP). [Online]. Available: systems [9] Strategy for Securing Control Systems, Department of Homeland Security, Tech. Rep., 2009.

Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks

Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Dale Peterson Director, Network Security Practice Digital Bond, Inc. 1580 Sawgrass Corporate Parkway, Suite 130 Sunrise, FL 33323

More information

SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP

SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP Today s Topics SCADA Overview SCADA System vs. IT Systems Risk Factors Threats Potential Vulnerabilities Specific Considerations

More information

INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION

INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION Prepared for the NRC Fuel Cycle Cyber Security Threat Conference Presented by: Jon Chugg, Ken Rohde Organization(s): INL Date: May 30, 2013 Disclaimer

More information

AUDITOR GENERAL S REPORT. Protection of Critical Infrastructure Control Systems. Report 5 August 2005

AUDITOR GENERAL S REPORT. Protection of Critical Infrastructure Control Systems. Report 5 August 2005 AUDITOR GENERAL S REPORT Protection of Critical Infrastructure Control Systems Report 5 August 2005 Serving the Public Interest Serving the Public Interest THE SPEAKER LEGISLATIVE ASSEMBLY THE PRESIDENT

More information

for Critical Infrastructure Protection Supervisory Control and Data Acquisition SCADA SECURITY ADVICE FOR CEOs

for Critical Infrastructure Protection Supervisory Control and Data Acquisition SCADA SECURITY ADVICE FOR CEOs for Critical Infrastructure Protection Supervisory Control and Data Acquisition SCADA SECURITY ADVICE FOR CEOs EXECUTIVE SUMMARY Supervisory Control and Data Acquisition (SCADA) systems are used for remote

More information

Defense-in-Depth Strategies for Secure, Open Remote Access to Control System Networks

Defense-in-Depth Strategies for Secure, Open Remote Access to Control System Networks Defense-in-Depth Strategies for Secure, Open Remote Access to Control System Networks A look at multi-vendor access strategies Joel Langill TÜV FSEng ID-1772/09, CEH, CPT, CCNA Security Consultant / Staff

More information

Designing a security policy to protect your automation solution

Designing a security policy to protect your automation solution Designing a security policy to protect your automation solution September 2009 / White paper by Dan DesRuisseaux 1 Contents Executive Summary... p 3 Introduction... p 4 Security Guidelines... p 7 Conclusion...

More information

Security for. Industrial. Automation. Considering the PROFINET Security Guideline

Security for. Industrial. Automation. Considering the PROFINET Security Guideline Security for Industrial Considering the PROFINET Security Guideline Automation Industrial IT Security 2 Plant Security Physical Security Physical access to facilities and equipment Policies & Procedures

More information

What is Really Needed to Secure the Internet of Things?

What is Really Needed to Secure the Internet of Things? What is Really Needed to Secure the Internet of Things? By Alan Grau, Icon Labs alan.grau@iconlabs.com The Internet of Things (IoT) has become a ubiquitous term to describe the tens of billions of devices

More information

Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems. Enzo M. Tieghi etieghi@visionautomation.

Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems. Enzo M. Tieghi etieghi@visionautomation. Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems Enzo M. Tieghi etieghi@visionautomation.it Security IT & Control System Security: where are we?

More information

GE Measurement & Control. Top 10 Cyber Vulnerabilities for Control Systems

GE Measurement & Control. Top 10 Cyber Vulnerabilities for Control Systems GE Measurement & Control Top 10 Cyber Vulnerabilities for Control Systems GE Proprietary Information: This document contains proprietary information of the General Electric Company and may not be used

More information

DeltaV System Cyber-Security

DeltaV System Cyber-Security January 2013 Page 1 This paper describes the system philosophy and guidelines for keeping your DeltaV System secure from Cyber attacks. www.deltav.com January 2013 Page 2 Table of Contents Introduction...

More information

Maruleng Local Municipality

Maruleng Local Municipality Maruleng Local Municipality. 22 November 2011 1 Version Control Version Date Author(s) Details 1.1 23/03/2012 Masilo Modiba New Policy 2 Contents ICT Firewall Policy 1 Version Control.2 1. Introduction.....4

More information

Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia

Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Marshall D. Abrams, The MITRE Corporation Joe Weiss, Applied Control Solutions, LLC Annual Computer Security

More information

Network Security in Power Systems. Maja Knezev and Zarko Djekic

Network Security in Power Systems. Maja Knezev and Zarko Djekic Network Security in Power Systems Maja Knezev and Zarko Djekic Introduction Protection control Outline EMS, SCADA, RTU, PLC Attacks using power system Vulnerabilities Solution Conclusion Introduction Generator

More information

The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808

The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808 cover_comp_01 9/9/02 5:01 PM Page 1 For further information, please contact: The President s Critical Infrastructure Protection Board Office of Energy Assurance U.S. Department of Energy 202/ 287-1808

More information

GE Oil & Gas. Cyber Security for NERC CIP Versions 5 & 6 Compliance

GE Oil & Gas. Cyber Security for NERC CIP Versions 5 & 6 Compliance GE Oil & Gas Cyber Security for NERC CIP Versions 5 & 6 Compliance Cyber Security for NERC CIP Versions 5 & 6 Compliance 2 Contents Cyber Security for NERC CIP Compliance... 5 Sabotage Reporting... 6 Security

More information

CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System

CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System Purpose CIP-005-5 R2 is focused on ensuring that the security of the Bulk Energy System is not compromised

More information

Security Solutions to Meet NERC-CIP Requirements. Kevin Staggs, Honeywell Process Solutions

Security Solutions to Meet NERC-CIP Requirements. Kevin Staggs, Honeywell Process Solutions Kevin Staggs, Honeywell Process Solutions Table of Contents Introduction...3 Nerc Standards and Implications...3 How to Meet the New Requirements...4 Protecting Your System...4 Cyber Security...5 A Sample

More information

Critical Infrastructure & Supervisory Control and Data Acquisition (SCADA) CYBER PROTECTION

Critical Infrastructure & Supervisory Control and Data Acquisition (SCADA) CYBER PROTECTION Critical Infrastructure & Supervisory Control and Data Acquisition (SCADA) CYBER PROTECTION ALBERTO AL HERNANDEZ, ARMY RESERVE OFFICER, SOFTWARE ENGINEER PH.D. CANDIDATE, SYSTEMS ENGINEERING PRESENTATION

More information

CYBER SECURITY POLICY For Managers of Drinking Water Systems

CYBER SECURITY POLICY For Managers of Drinking Water Systems CYBER SECURITY POLICY For Managers of Drinking Water Systems Excerpt from Cyber Security Assessment and Recommended Approach, Final Report STATE OF DELAWARE DRINKING WATER SYSTEMS February 206 Kash Srinivasan

More information

Vulnerabilities in SCADA and Critical Infrastructure Systems

Vulnerabilities in SCADA and Critical Infrastructure Systems International Journal of Future Generation Communication and Networking 99 Vulnerabilities in SCADA and Critical Infrastructure Systems Rosslin John Robles 1, Min-kyu Choi 1, Eun-suk Cho 1, Seok-soo Kim

More information

Innovative Defense Strategies for Securing SCADA & Control Systems

Innovative Defense Strategies for Securing SCADA & Control Systems 1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet

More information

Critical IT-Infrastructure (like Pipeline SCADA systems) require cyber-attack protection

Critical IT-Infrastructure (like Pipeline SCADA systems) require cyber-attack protection Critical IT-Infrastructure (like Pipeline SCADA systems) require cyber-attack protection Tobias WALK ILF Consulting Engineers GmbH Germany Abstract Pipeline Supervisory Control And Data Acquisition (SCADA)

More information

Plain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75

Plain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75 Plain English Guide To Common Criteria Requirements In The Field Device Protection Profile Version 0.75 Prepared For: Process Control Security Requirements Forum (PCSRF) Prepared By: Digital Bond, Inc.

More information

Remote Services. Managing Open Systems with Remote Services

Remote Services. Managing Open Systems with Remote Services Remote Services Managing Open Systems with Remote Services Reduce costs and mitigate risk with secure remote services As control systems move from proprietary technology to open systems, there is greater

More information

IT Security and OT Security. Understanding the Challenges

IT Security and OT Security. Understanding the Challenges IT Security and OT Security Understanding the Challenges Security Maturity Evolution in Industrial Control 1950s 5/4/2012 # 2 Technology Sophistication Security Maturity Evolution in Industrial Control

More information

SCADA Security: Challenges and Solutions

SCADA Security: Challenges and Solutions SCADA Security: Challenges and Solutions June 2011 / White paper by Metin Ozturk, Philip Aubin Make the most of your energy Summary Executive Summary... p 2 Protecting Critical Infrastructure Includes

More information

Information Security Services

Information Security Services Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual

More information

Cyber Security for SCADA and DCS systems A summary of the current situation and Key points to consider

Cyber Security for SCADA and DCS systems A summary of the current situation and Key points to consider Cyber Security for SCADA and DCS systems A summary of the current situation and Key points to consider April 2016 Authors: Robert Botezatu ICARE Cyber Security 1 Glossary DCS DMZ HMI ICS IDS IED IT LAN

More information

i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors

i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors March 25-27, 2014 Steven A. Kunsman i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors ABB Inc. March 26, 2015 Slide 1 Cyber Security for Substation

More information

SCADA SYSTEMS AND SECURITY WHITEPAPER

SCADA SYSTEMS AND SECURITY WHITEPAPER SCADA SYSTEMS AND SECURITY WHITEPAPER Abstract: This paper discusses some of the options available to companies concerned with the threat of cyber attack on their critical infrastructure, who as part of

More information

Best Practices in ICS Security for System Operators. A Wurldtech White Paper

Best Practices in ICS Security for System Operators. A Wurldtech White Paper Best Practices in ICS Security for System Operators A Wurldtech White Paper No part of this document may be distributed, reproduced or posted without the express written permission of Wurldtech Security

More information

Four Top Emagined Security Services

Four Top Emagined Security Services Four Top Emagined Security Services. www.emagined.com Emagined Security offers a variety of Security Services designed to support growing security needs. This brochure highlights four key Emagined Security

More information

Cyber Security Considerations in the Development of I&C Systems for Nuclear Power Plants

Cyber Security Considerations in the Development of I&C Systems for Nuclear Power Plants Cyber Security Considerations in the Development of I&C Systems for Nuclear Power Plants Jung-Woon Lee, Cheol-Kwon Lee, Jae-Gu Song, and Dong-Young Lee I&C and HF Research Division, Korea Atomic Energy

More information

Security in the smart grid

Security in the smart grid Security in the smart grid Security in the smart grid It s hard to avoid news reports about the smart grid, and one of the media s favorite topics is security, cyber security in particular. It s understandable

More information

S a f e t y & s e c u r i t y a l i g n m e n t b e n e f i t s f o r h i g h e r o p e r a t i o n a l i n t e g r i t y R A H U L G U P TA

S a f e t y & s e c u r i t y a l i g n m e n t b e n e f i t s f o r h i g h e r o p e r a t i o n a l i n t e g r i t y R A H U L G U P TA Unraveling the Jargon Between Functional Safety & Cyber Security Related to Industrial Control Systems ( ICS) S a f e t y & s e c u r i t y a l i g n m e n t b e n e f i t s f o r h i g h e r o p e r a

More information

Honeywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014

Honeywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014 Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Process Solutions (HPS) June 4, Industrial Cyber Security Industrial Cyber Security is the leading provider of cyber security

More information

Network/Cyber Security

Network/Cyber Security Network/Cyber Security SCAMPS Annual Meeting 2015 Joe Howland,VC3 Source: http://www.information-age.com/technology/security/123458891/how-7-year-old-girl-hacked-public-wi-fi-network-10-minutes Security

More information

Are you prepared to be next? Invensys Cyber Security

Are you prepared to be next? Invensys Cyber Security Defense In Depth Are you prepared to be next? Invensys Cyber Security Sven Grone Critical Controls Solutions Consultant Presenting on behalf of Glen Bounds Global Modernization Consultant Agenda Cyber

More information

TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY

TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY IT FIREWALL POLICY TABLE OF CONTENT 1. INTRODUCTION... 3 2. TERMS AND DEFINITION... 3 3. PURPOSE... 5 4. SCOPE... 5 5. POLICY STATEMENT... 5 6. REQUIREMENTS... 5 7. OPERATIONS... 6 8. CONFIGURATION...

More information

CYBER SECURITY. Is your Industrial Control System prepared?

CYBER SECURITY. Is your Industrial Control System prepared? CYBER SECURITY Is your Industrial Control System prepared? Presenter: Warwick Black Security Architect Operation & Optimization Software Activity Schneider-Electric Challenges What challenges are there

More information

N-Dimension Solutions Cyber Security for Utilities

N-Dimension Solutions Cyber Security for Utilities AGENDA ITEM NO.: 3.A. MEETING DATE; 08/18/2014 N-Dimension Solutions Cyber Security for Utilities Cyber Security Protection for Critical Infrastructure Assets The cyber threat is escalating - Confidential

More information

SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005

SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005 SCADA System Security ECE 478 Network Security Oregon State University March 7, 2005 David Goeke Hai Nguyen Abstract Modern public infrastructure systems

More information

Security Issues with Integrated Smart Buildings

Security Issues with Integrated Smart Buildings Security Issues with Integrated Smart Buildings Jim Sinopoli, Managing Principal Smart Buildings, LLC The building automation industry is now at a point where we have legitimate and reasonable concern

More information

future data and infrastructure

future data and infrastructure White Paper Smart Grid Security: Preparing for the Standards-Based Future without Neglecting the Needs of Today Are you prepared for future data and infrastructure security challenges? Steve Chasko Principal

More information

Data Security Concerns for the Electric Grid

Data Security Concerns for the Electric Grid Data Security Concerns for the Electric Grid Data Security Concerns for the Electric Grid The U.S. power grid infrastructure is a vital component of modern society and commerce, and represents a critical

More information

SCADA Cyber Attacks and Security Vulnerabilities: Review

SCADA Cyber Attacks and Security Vulnerabilities: Review SCADA Cyber Attacks and Security Vulnerabilities: Review Jinan Fiaidhi, Yvette E. Gelogo Department of Computer Science, Lakehead University, Hannam University, Korea jfiaidhi@lakeheadu.ca, vette_mis@yahoo.com

More information

SHOULD I BE CONCERNED ABOUT CYBER SECURITY? OR IS THE BETTER QUESTION WHAT IS CYBER SECURITY?!!!?

SHOULD I BE CONCERNED ABOUT CYBER SECURITY? OR IS THE BETTER QUESTION WHAT IS CYBER SECURITY?!!!? SHOULD I BE CONCERNED ABOUT CYBER SECURITY? OR IS THE BETTER QUESTION WHAT IS CYBER SECURITY?!!!? What we are not going to discuss: Understand, I am not a computer guru. My knowledge is probably more limited

More information

Security for NG9-1-1 SYSTEMS

Security for NG9-1-1 SYSTEMS The Next Generation of Security for NG9-1-1 SYSTEMS The Challenge of Securing Public Safety Agencies A white paper from L.R. Kimball JANUARY 2010 866.375.6812 www.lrkimball.com/cybersecurity L.R. Kimball

More information

AUGUST 28, 2013 INFORMATION TECHNOLOGY INCIDENT RESPONSE PLAN. 1250 Siskiyou Boulevard Ashland OR 97520

AUGUST 28, 2013 INFORMATION TECHNOLOGY INCIDENT RESPONSE PLAN. 1250 Siskiyou Boulevard Ashland OR 97520 AUGUST 28, 2013 INFORMATION TECHNOLOGY INCIDENT RESPONSE PLAN 1250 Siskiyou Boulevard Ashland OR 97520 Revision History Revision Change Date 1.0 Initial Incident Response Plan 8/28/2013 Official copies

More information

The Advantages of an Integrated Factory Acceptance Test in an ICS Environment

The Advantages of an Integrated Factory Acceptance Test in an ICS Environment The Advantages of an Integrated Factory Acceptance Test in an ICS Environment By Jerome Farquharson, Critical Infrastructure and Compliance Practice Manager, and Alexandra Wiesehan, Cyber Security Analyst,

More information

ISACA rudens konference

ISACA rudens konference ISACA rudens konference 8 Novembris 2012 Procesa kontroles sistēmu drošība Andris Lauciņš Ievads Kāpēc tēma par procesa kontroles sistēmām? Statistics on incidents Reality of the environment of industrial

More information

Performance Evaluation of Intrusion Detection Systems

Performance Evaluation of Intrusion Detection Systems Performance Evaluation of Intrusion Detection Systems Waleed Farag & Sanwar Ali Department of Computer Science at Indiana University of Pennsylvania ABIT 2006 Outline Introduction: Intrusion Detection

More information

Update On Smart Grid Cyber Security

Update On Smart Grid Cyber Security Update On Smart Grid Cyber Security Kshamit Dixit Manager IT Security, Toronto Hydro, Ontario, Canada 1 Agenda Cyber Security Overview Security Framework Securing Smart Grid 2 Smart Grid Attack Threats

More information

SCADA/Business Network Separation: Securing an Integrated SCADA System

SCADA/Business Network Separation: Securing an Integrated SCADA System SCADA/Business Network Separation: Securing an Integrated SCADA System This white paper is based on a utility example but applies to any SCADA installation from power generation and distribution to water/wastewater

More information

Securing Industrial Control Systems in the Chemical Sector. Roadmap Awareness Initiative Making the Business Case

Securing Industrial Control Systems in the Chemical Sector. Roadmap Awareness Initiative Making the Business Case Securing Industrial Control Systems in the Chemical Sector Roadmap Awareness Initiative Making the Business Case Developed by the Chemical Sector Coordinating Council in partnership with The U.S. Department

More information

Keeping the Lights On

Keeping the Lights On Keeping the Lights On Fundamentals of Industrial Control Risks, Vulnerabilities, Mitigating Controls, and Regulatory Compliance Learning Goals o Understanding definition of industrial controls o Understanding

More information

Cyber Security for SCADA/ICS Networks

Cyber Security for SCADA/ICS Networks Cyber Security for SCADA/ICS Networks GANESH NARAYANAN HEAD-CONSULTING CYBER SECURITY SERVICES www.thalesgroup.com Increasing Cyber Attacks on SCADA / ICS Systems 2 What is SCADA Supervisory Control And

More information

CYBER SECURITY: SYSTEM SERVICES FOR THE SAFEGUARD OF DIGITAL SUBSTATION AUTOMATION SYSTEMS. Massimo Petrini (*), Emiliano Casale TERNA S.p.A.

CYBER SECURITY: SYSTEM SERVICES FOR THE SAFEGUARD OF DIGITAL SUBSTATION AUTOMATION SYSTEMS. Massimo Petrini (*), Emiliano Casale TERNA S.p.A. 21, rue d Artois, F-75008 PARIS D2-102 CIGRE 2012 http : //www.cigre.org CYBER SECURITY: SYSTEM SERVICES FOR THE SAFEGUARD OF DIGITAL SUBSTATION AUTOMATION SYSTEMS Massimo Petrini (*), Emiliano Casale

More information

Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative

Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative November 2014 Disclaimer Current SCADA Vulnerability Factors Industrial Control Systems 101 Proposed Countermeasures

More information

FACT SHEET: Ransomware and HIPAA

FACT SHEET: Ransomware and HIPAA FACT SHEET: Ransomware and HIPAA A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily ransomware attacks since early 2016 (a 300% increase over the 1,000

More information

Network Security: 30 Questions Every Manager Should Ask. Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting

Network Security: 30 Questions Every Manager Should Ask. Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting Network Security: 30 Questions Every Manager Should Ask Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting Network Security: 30 Questions Every Manager/Executive Must Answer in Order

More information

Bellingham Control System Cyber Security Case Study

Bellingham Control System Cyber Security Case Study Bellingham Control System Cyber Security Case Study Marshall Abrams Joe Weiss Presented at at 2007 Annual Computer Security Applications Conference Case Study Synopsis Examine actual control system cyber

More information

Security Issues in SCADA Networks

Security Issues in SCADA Networks Security Issues in SCADA Networks by V. M. Igure, S. A. Laughter, and R. D. Williams Computers & Security, 25(7): 498-506, 2006 presented by Ruilong Deng Postdoctoral Research Fellow School of Electrical

More information

Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness

Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness CISP BULLETIN Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness November 21, 2006 To support compliance with the Cardholder Information Security Program (CISP), Visa USA

More information

What is Cyber Liability

What is Cyber Liability What is Cyber Liability Ubiquitous Warfare Espionage Media Operational Data Security and Privacy Tech 1 Data Security and Privacy Data Breach Response Costs Privacy Regulatory Action Civil Litigation INSURABLE

More information

OPC & Security Agenda

OPC & Security Agenda OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information

More information

Best Practices for DanPac Express Cyber Security

Best Practices for DanPac Express Cyber Security March 2015 - Page 1 Best Practices for This whitepaper describes best practices that will help you maintain a cyber-secure DanPac Express system. www.daniel.com March 2015 - Page 2 Table of Content 1 Introduction

More information

The State-of-the-State of Control System Cyber Security

The State-of-the-State of Control System Cyber Security The State-of-the-State of Control System Cyber Security Prepared for HTCIA September 19, 2012 Joe Weiss PE, CISM, CRISC, ISA Fellow (408) 253-7934 joe.weiss@realtimeacs.com Summary Control systems are

More information

White Paper. April 2006. Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks

White Paper. April 2006. Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks White Paper April 2006 Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks According to a recent Harris Interactive survey, the country s leading business executives consider

More information

SCOPE. September 25, 2014, 0930 EDT

SCOPE. September 25, 2014, 0930 EDT National Protection and Programs Directorate Office of Cyber and Infrastructure Analysis (OCIA) Critical Infrastructure Security and Resilience Note Critical Infrastructure Security and Resilience Note:

More information

Cyber Security for NERC CIP Version 5 Compliance

Cyber Security for NERC CIP Version 5 Compliance GE Measurement & Control Cyber Security for NERC CIP Version 5 Compliance imagination at work Contents Cyber Security for NERC CIP Compliance... 5 Sabotage Reporting... 6 Security Management Controls...

More information

Information Technology Cyber Security Policy

Information Technology Cyber Security Policy Information Technology Cyber Security Policy (Insert Name of Organization) SAMPLE TEMPLATE Organizations are encouraged to develop their own policy and procedures from the information enclosed. Please

More information

Security Testing in Critical Systems

Security Testing in Critical Systems Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base

More information

TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices

TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security

More information

A Strategic Approach to Protecting SCADA and Process Control Systems

A Strategic Approach to Protecting SCADA and Process Control Systems IBM Internet Security Systems White Paper A Strategic Approach to Protecting SCADA and Process Control Systems A Strategic Approach to Protecting SCADA and Process Control Systems 1 Table of Contents ABSTRACT..................................................................2

More information

Why Leaks Matter. Leak Detection and Mitigation as a Critical Element of Network Assurance. A publication of Lumeta Corporation www.lumeta.

Why Leaks Matter. Leak Detection and Mitigation as a Critical Element of Network Assurance. A publication of Lumeta Corporation www.lumeta. Why Leaks Matter Leak Detection and Mitigation as a Critical Element of Network Assurance A publication of Lumeta Corporation www.lumeta.com Table of Contents Executive Summary Defining a Leak How Leaks

More information

Cyber Security Risk Mitigation Checklist

Cyber Security Risk Mitigation Checklist Cyber Security Risk Mitigation Checklist Contents Building a Risk Management AMI Program MDM Cyber Security Policy Communication Systems Personnel and Training Scada Operational Risks In Home Displays

More information

Session 14: Functional Security in a Process Environment

Session 14: Functional Security in a Process Environment Abstract Session 14: Functional Security in a Process Environment Kurt Forster Industrial IT Solutions Specialist, Autopro Automation Consultants In an ideal industrial production security scenario, the

More information

Down the SCADA (security) Rabbit Hole. Alberto Volpatto

Down the SCADA (security) Rabbit Hole. Alberto Volpatto Down the SCADA (security) Rabbit Hole Alberto Volpatto Alberto Volpatto Security Engineer & Team Leader @ Secure Network Computer Engineer Application Security Specialist What is SCADA? Supervisory operators,

More information

SOFTWARE-IMPLEMENTED SAFETY LOGIC Angela E. Summers, Ph.D., P.E., President, SIS-TECH Solutions, LP

SOFTWARE-IMPLEMENTED SAFETY LOGIC Angela E. Summers, Ph.D., P.E., President, SIS-TECH Solutions, LP SOFTWARE-IMPLEMENTED SAFETY LOGIC Angela E. Summers, Ph.D., P.E., President, SIS-TECH Solutions, LP Software-Implemented Safety Logic, Loss Prevention Symposium, American Institute of Chemical Engineers,

More information

Seven Strategies to Defend ICSs

Seven Strategies to Defend ICSs INTRODUCTION Cyber intrusions into US Critical Infrastructure systems are happening with increased frequency. For many industrial control systems (ICSs), it s not a matter of if an intrusion will take

More information

White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers

White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.

More information

Verve Security Center

Verve Security Center Verve Security Center Product Features Supports multiple control systems. Most competing products only support a single vendor, forcing the end user to purchase multiple security systems Single solution

More information

Industrial Control Systems Vulnerabilities and Security Issues and Future Enhancements

Industrial Control Systems Vulnerabilities and Security Issues and Future Enhancements , pp.144-148 http://dx.doi.org/10.14257/astl.2015.95.27 Industrial Control Systems Vulnerabilities and Security Issues and Future Enhancements Hongseok Chae 1, AAmir Shahzad 1, Muhammad Irfan 2, HyangRan

More information

The Myths and Facts behind Cyber Security Risks for Industrial Control Systems

The Myths and Facts behind Cyber Security Risks for Industrial Control Systems The Myths and Facts behind Cyber Security Risks for Industrial Control Systems Eric Byres, P.E. Research Manager BCIT Internet Engineering Lab Burnaby BC, V5G 3H2 ebyres@bcit.ca Dr. Dan Hoffman Associate

More information

INSPIRE: INcreasing Security and Protection through Infrastructure REsilience

INSPIRE: INcreasing Security and Protection through Infrastructure REsilience INSPIRE: INcreasing Security and Protection through Infrastructure REsilience Salvatore D Antonio University of Naples Parthenope Consorzio Interuniversitario Nazionale per l Informatica 20th of May 2010

More information

Introduction to Cyber Security / Information Security

Introduction to Cyber Security / Information Security Introduction to Cyber Security / Information Security Syllabus for Introduction to Cyber Security / Information Security program * for students of University of Pune is given below. The program will be

More information

Protecting Critical Infrastructure

Protecting Critical Infrastructure Protecting Critical Infrastructure SCADA Network Security Monitoring March 20, 2015 Table of Contents Introduction... 4 SCADA Systems... 4 In This Paper... 4 SCADA Security... 4 Assessing the Security

More information

Evolutionism of Intrusion Detection

Evolutionism of Intrusion Detection Evolutionism of Intrusion Detection Jackie Lai The network technology changes with each passing day; and the attack technique of hacker also weeds through the old to bring forth the new. Worms such as

More information

SCADA Compliance Tools For NERC-CIP. The Right Tools for Bringing Your Organization in Line with the Latest Standards

SCADA Compliance Tools For NERC-CIP. The Right Tools for Bringing Your Organization in Line with the Latest Standards SCADA Compliance Tools For NERC-CIP The Right Tools for Bringing Your Organization in Line with the Latest Standards OVERVIEW Electrical utilities are responsible for defining critical cyber assets which

More information

Defense in Cyber Space Beating Cyber Threats that Target Mesh Networks

Defense in Cyber Space Beating Cyber Threats that Target Mesh Networks Beating Cyber Threats that Target Mesh Networks Trent Nelson, Cyber Security Assessment Lead, Idaho National Laboratory Jeff Becker, Global Wireless Business Director, Honeywell Process Solutions Table

More information

Improving SCADA Control Systems Security with Software Vulnerability Analysis

Improving SCADA Control Systems Security with Software Vulnerability Analysis Improving SCADA Control Systems Security with Software Vulnerability Analysis GIOVANNI CAGALABAN, TAIHOON KIM, SEOKSOO KIM Department of Multimedia Hannam University Ojeong-dong, Daedeok-gu, Daejeon 306-791

More information

Redesigning automation network security

Redesigning automation network security White Paper WP152006EN Redesigning automation network security Presented at Power and Energy Automation Conference (PEAC), Spokane, WA, March 2014 Jacques Benoit Eaton s Cooper Power Systems Abstract The

More information

GE Measurement & Control. Cyber Security for NEI 08-09

GE Measurement & Control. Cyber Security for NEI 08-09 GE Measurement & Control Cyber Security for NEI 08-09 Contents Cyber Security for NEI 08-09...3 Cyber Security Solution Support for NEI 08-09...3 1.0 Access Contols...4 2.0 Audit And Accountability...4

More information

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall

More information

Compliance. Review. Our Compliance Review is based on an in-depth analysis and evaluation of your organization's:

Compliance. Review. Our Compliance Review is based on an in-depth analysis and evaluation of your organization's: Security.01 Penetration Testing.02 Compliance Review.03 Application Security Audit.04 Social Engineering.05 Security Outsourcing.06 Security Consulting.07 Security Policy and Program.08 Training Services

More information

Information Security Policy

Information Security Policy Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems

More information

What Risk Managers need to know about ICS Cyber Security

What Risk Managers need to know about ICS Cyber Security What Risk Managers need to know about ICS Cyber Security EIM Risk Managers Conference February 18, 2014 Joe Weiss PE, CISM, CRISC, ISA Fellow (408) 253-7934 joe.weiss@realtimeacs.com ICSs What are they

More information