Asset Owners should have the risks mitigated and use the monitoring, detection, alarm, and response to assist the safe and secure operation. The detection, monitoring and response should not be used as the primary strategy to mitigate risk. Many companies are jumping directly to these tools without executing a risk assessment, design and proper mitigation. The risk is already there in the weak design.

Avoid creating external dependencies to the plant. The operation of the plant should not depend on external resources. Think about the CrowdStrike incident, which caused major damage to the global businesses and many countries. The operators are standing at the front seat maneuvering the critical processes, and they should never be bypassed by external systems or people, unless these are safety systems located in Purdue Level 0 or 1.

Many people wrongly believes that OT security is IT problem and responsibility, which is incorrect. If the cyberattack can cause a plant shutdown, a boiler explosion, an environmental damage, and such, it is a plant problem, and therefore OT responsibility.

Mitigated risks (Recommended): this activity can be carried out on zones and conduits that have all their risks mitigated. Potential (Intolerable) consequences can no longer occur. Cyber incidents can still happen. This doesn’t mean you shouldn’t be alert and respond to cyber incidents. It is said that a safe plant is a boring place.

Unmitigated risks (Not recommended): Potential consequences can occur, although we have already identified them. Response becomes crucial to protect on time. At least, you may be able to have a response plan that can be assertive. Risks should be mitigated as soon as possible. Monitoring should not be used as the primary initiative to mitigate risk, it should be used to assist the operators keeping their attention to the safe operation of the plant.

ZCM Analyzer: The different surveillance tools are developed near each zone and conduit. Intrusion detection, anomalies, threats, receiving syslog events generated by other devices (industrial firewall, smart switches, ZCM Agent,….), OPC Client for monitoring process variables, security sensors for physical access control (open/close, presence/movement), wireless network monitoring, and more.

The multiple ZCM Analyzers send notifications to the ZCM Server for management and assertive response, without false positives.

The ZCM Agent is a piece of software that works in conjunction with the ZCM Analyzer. ZCM Agents are installed on operator stations, servers, and other HOST-type devices. The ZCM Agent acts as a resident security agent in the HOST (Example: Microsoft Windows), monitoring the operation of the device, software applications, security policies, user actions, among other tasks. A series of 30 diagnostics that are executed by the ZCM Agent are sent to the ZCM Analyzer. After being processed by the ZCM Analyzer, they are sent in real time to the ZCM Server.

The RMS is responsible for real-time monitoring and diagnostics. It maintains plant safety by averting high-risk situations. Moreover, it accomplishes these tasks without requiring external assistance. There’s no necessity to transmit critical data or real-time information outside the plant.

The plant should have enough capabilities to respond to any type of event. The RMS system receives notifications from ZCM Agents, ZCM Analyzers, and third party devices. The RMS Systems also generates other types of events that require attention without false positives. There are two types of notifications: Alerts & Alarms. Alerts does not need a response, and are generated for information purposes only. Alarms must be responded in a timely manner and with a specific written and practiced response, list or instructions, or a procedure. All mandatory responses need to be managed and recorded.

KPIs and scheduled system reports are generated automatically. The results need to be analyzed for improvement, undergoing PDCA cycles.

Alarms must be responded in a timely manner and with a specific written and practiced response, list or instructions, or a procedure. All mandatory responses need to be managed and recorded.

With RMS, there is no need for “Learning Modes”. The system already has the knowledge for precise and timely responses. Every Alarm has a planned response, such as a list of instructions or a response procedure. Within a plant environment, there is no time for improvisation.

KPIs and scheduled system reports are generated automatically. The results need to be analyzed for improvement, undergoing PDCA cycles.

Every type of change in a control system over a running environment may bring additional risks to the safe and secure operation of the plant. Changes needs to be evaluated before deploying. A decision taking process is required, and therefore precise and accurate data must be used for taking these decisions. There are shared responsibilities within the different roles. The Asset Owner, Service Provider, and Product Manufacturer.

The Asset Owner phases the challenge to keep and maintain the safety of the plant and security of their systems. The systems will remain at the plant for an average of 20 years or more. Sounds processes and procedures needs to me established. These are: (1) Update and Patch Management, (2) Change Management Procedures, and (3) Backup and restoration.

The current dynamic environment of security is demanding the Asset Owners to process updates in a frequent basis, which means more risk to the plant. An agile and confident methods needs to be established to avoid additional risks.

The RMS System is capable of real-time monitoring and diagnostics. It is also capable of Notifications & Response Management. It maintains plant safety by averting higher-risk situations. Moreover, it accomplishes these tasks without requiring external assistance. There’s no necessity to transmit critical data or real-time information outside the plant.

Despite this, the end user may have an interest in additional supportive services. These could potentially contribute to a safer and more secure operation. Should this be the situation, we are amenable to scrutinizing the associated requests and requirements. This is done with the intent to facilitate any RMS/ZCM installation.

Remote support and diagnostics assistance: Our professional can access remotely to the RMS/ZCM System for diagnosis, performance, consultative, analysis, auditing, and suggestions.

Custom Developments: The ZCM Analyzer can run passive and active tools. We can also develop custom-made applications due to the rich and powerful ZCM operating system. Example: The ZCM Analyzer can also be converted into a powerful industrial firewall.

RMS API (Application Programming Interface) allows integrating with third party systems, such as SOC IT/OT, Q-Radar and other more elevated systems. Similarly, the RMS/ZCM System can manage and distribute discoveries, policies and procedural updates to the multiple RMS Servers.

Patches and updates are those types of changes on control systems that the end use is not willing to do. At least not willing to do on a frequent basis, and only by exception. Patches are changes and changes on control systems may end in undesired effects and risks to the operational environment. Changes on control systems are highly managed and costly, specially if they go wrong.

Match the patch/update with existing vulnerabilities, updating the vulnerability database. If the patch or update does change any of the essential functions or the design of the system in any way, then it should be managed as a change.

RMS/ZCM patch and updated management has a built-in process in compliance to ISA/IEC-62443-2-3 Technical Reference to grab all the necessary information to take decision, and create a plan to deploy the patch as it was decided. Follow-up with the results and monitor for after side effects, until the observation period is passed.

A change is something that the plant is willing to do, because it is good for the business, the safety or the security of the plant. It is justified by a desire of the plant. It may be technically or business driven. Anyway, the end user is expecting a benefit of that change. Changes can be risky as well. A change in the design of the zone, the conduit or the process, may bring a different SLT, recommendations, profile. A full set of risk scenarios needs to be reevaluated.

The changes proposed to the zones, conduits or industrial process, should not be approved until the affected nodes are re-evaluated from Cybersecurity perspective, as these changes may affect negatively the security of the system and finally the safety of the plant.

The RMS/ZCM systems allows creating a temporary copy of the previous Detailed Risk Assessment, including HLRA, so the user can simulate and evaluate the change in the zones and conduits before its approval. Additional countermeasures may be required.

Backup and restore is one feature that the RMS/ZCM Systems does for itself. The RMS/ZCM can generate and maintain backup and restorations processes and procedures for system, databases and user data. The RMS/ZCM system does not manage backups from control systems or any other vendor, by it can monitor and supervise third party backup systems at its corresponding zone.

The RMS Servers support redundant configuration, by having two RMS Servers with the same IACS Site. Does one Server fail, the secondary server continues working without interruption. RMS/ZCM Server also support failover storage discs array on each tolerant servers for additional security. The ZCM Analyzers configuration is kept on the RMS Servers. ZCM Analyzers can be easily tolerant to failures simply by adding a ZCM Analyzer to the same zone. Very little configuration will be required.

Sooner or later, recognized organizations will be required to certify the implementation of ISA/IEC-62443 series of standards by an Authority of Certification. This is valid for Asset Owners, Service Providers, and Product Manufacturers.

If the implementation of the ISA/IEC-62443 series of standards is not done correctly from the beginning, it may be the case they need to redo the work again. This is a lost of value in the investment. We encourage the Asset Owners and Service Providers to implement the ISA/IEC-62443 series of standards in compliance producing certifiable evidence, embracing perfection. With the RMS and WBS, we got this covered.

• Elaborate the Policies and Procedures meeting ISA/IEC-62443 series of standards requirements.
• Produce the auditable evidence that will be required by the certification authority.
• Keep and maintain traceable evidence with the rationals, include time stamping.

Failing to meet these premises may require to redo the work and a lost of value. Achieving these objectives guarantees the correct implementation of the standards and therefore the confidence that everything is being done correctly.

What can be audited and/or certified for compliance?

• The Cybersecurity Management Program (CSMS)
  • With the proven WBS Methodology, Critical Control Points.
• The security of any System under Consideration (SUC) through its lifecycle
  • New future system from basic engineering.
  • Existing system, recently installed or old legacy.
• Vendors and Suppliers
  • Solutions Providers.
  • Engineering/Service Providers.
  • Product Suppliers.
• Cybersecurity Professionals.
  • Activities performed by Security Professionals.

The RMS generates auditable reports from each module supporting the proven WBS Methodology. Generates all reports for each of the multiple IACS/SUCs in a normalized manner. This will easier the revision by any Certification Authority while keeping key critical sensitive data inside the plant.

The RMS can obtain the electronic signature or digital signature for those reports that are the result of multidisciplinary activities. Or collect feedback from them for corrections and revisions. Keep the entire process of generating auditable documents traceable, avoiding the incorrect manipulation of important and relevant decisions.

The RMS avoid dumping sensitive, critical information into reports, and avoid reverse engineering. Many reputable consulting firms produce step-by-step instructions on how the control system can be compromised to destroy the plant. Don’t fall victim to this extortion, which many companies use to get money out of you. This type of “Little Illustrated Hacker type of reports” should never be produced, creating an additional risk for the organization. All our RMS/ZCM system reports had been carefully designed to protect the plant, period.

With the RMS audit, any already installed SUC at a specified plant or operational environment. Alternatively, it can audit a new system that is currently in its engineering phases. Almost everything can be audited and reviewed for compliance with the standards and for effective and efficient risk mitigation.

The entire Industrial Cybersecurity Management Program can be audited for compliance, and continuous improvement.

At WiseSecurity, we offer a unique solution for JIT auditing and certification. This is done during the execution of projects to prevent rework. It also ensures faster mitigation. We use an effective audit and compliance methodology.