There’s simply too much misinformation, ambiguity, and uncertainty out there—not to mention a wealth of conflicting opinions and a never-ending syntactical debate over terminology. You’ve heard the acronyms: SCADA, ICS, IACS, DCS, PCS, CI. You’ve caught the catch-phrases: air-gap defense, critical infrastructure, cyber war, advanced persistent threat. What does it all mean? The answer is a difficult one because the topic of industrial network security is broad and covers a diverse set of industries, network architectures, protocols, deployment methods, business goals, and security risks. A company that designs and manufactures ballistic missile systems operates differently from a company that manufactures extruded rubber weather stripping, and the production of bright-white laser jet paper is different from the production of energy. Right? Right?
Not necessarily. There are commonalities between all of these systems, not the least of which is some sort of control system: the “CS” in the majority of those earlier acronyms. The larger commonality, however, is one of intention.
An “industrial network” is made up of at least three distinct parts: an enterprise network (the “business” network, where Dilbert works), the Supervisory Control and Data Acquisition (SCADA) network (the “command center,” where Homer works), and the Control System itself (the “plant,” where Laverne and Shirley work). The three networks are absolutely co-dependent on each other, while at the same type operating in absolutely different ways.
Read on for a good read on understanding what's behind and around protecting industrial networks and critical infrastructure...