Information security is usually taught using three principles: confidentiality, integrity and availability. In IT, they are generally prioritized in that order.
The model works well for information. A leaked customer database is a serious incident, while the same database being briefly unavailable is an inconvenience.
In a control room, the priorities are different.
The worst outcome for a plant is not that someone reads the historian data. It is that the plant stops. A stopped plant loses money quickly, and depending on the process, an uncontrolled stop can also be a safety incident.
A plant therefore reverses the order: availability, integrity and then confidentiality.
This difference explains many of the disagreements between IT departments and control room staff. Once it is understood, most of those disagreements are easier to resolve.
What this changes in practice
The difference affects specific decisions. Three of the most important are described below.
A control that can stop the process is the wrong control
In an office, a security tool that quarantines a suspicious file is working as intended, and the cost is usually a short delay.
In a plant, the same tool quarantining a file that the control system needs can stop production.
This happens more often than many people expect. Standard office antivirus installed on an HMI is one of the more common ways a plant loses production because of a security measure, and it is usually installed by a competent person trying to help.
The principle is that availability must be considered from the start of the design, not added at the end. If a control could stop the process, it needs to be redesigned.
Vendor support must be protected
Your control system is covered by a support agreement, which usually specifies what can be installed on those computers.
Installing software outside that agreement may improve your security on paper, but it can also leave you without vendor support when you need it most.
For this reason, the question of whether the vendor will continue to support the system is answered before anything is recommended, not after installation.
Work is planned around your maintenance schedule
Any work that affects the process is planned around your existing maintenance windows.
A security programme that requires an extra shutdown is unlikely to go ahead. It tends to be approved, scheduled, postponed and eventually dropped. Planning the work within existing windows is the approach that gets completed.
Where confidentiality still matters
Confidentiality is still important in a plant, particularly in two areas.
Process data is commercially sensitive. Yields, recipes, production rates and efficiency figures would be valuable to a competitor, and in some sectors they are also of interest to regulators.
Network architecture is also sensitive. A detailed diagram of what is connected to what could help an attacker plan an attack.
When availability and confidentiality conflict, which happens occasionally, the plant chooses to keep running.
A design that serves both priorities
One design meets both priorities, and it is one of the most useful in OT security.
Data needs to leave the plant. Production figures go to the business, the maintenance system needs equipment data, and managers want dashboards. Each of these is a legitimate need, and each creates a possible route into the plant.
The solution is a data diode: a device that allows data to leave the plant but has no physical return path.
Availability is maintained because data still flows. Confidentiality is maintained because the data reaches only its intended destination. The route into the plant is closed by the hardware itself, so it cannot be opened later by a configuration change.
Three questions to ask about any security measure
If you manage a plant and someone proposes a security measure, these three questions will settle most issues:
- What happens to the process if this fails? If the plant could stop, the design needs more work.
- Will our control system vendor still support us with this installed? If no one has checked, the proposal is not ready.
- When will this be installed? If it needs a shutdown that is not already planned, it is unlikely to happen.
None of these questions is about security technology. They are about keeping the plant running, which is the basis for all other security work.