Zebras and Lions: Better Incident Handling Through Improved Cooperation

Abstract

Abstract. The ability to appropriately prepare for, and respond to, information security incidents, is of paramount importance, as it is impossible to prevent all possible incidents from occurring. Current trends show that the power and automation industry is an attractive target for hackers. A main challenge for this industry to overcome is the differences regarding culture and traditions, knowledge and communication, between Information and Communication Technology (ICT) staff and industrial control system staff. Communication is necessary for knowledge transfer, which in turn is necessary to learn from previous incidents in order to improve the incident handling process. This article reports on interviews with representatives from large electricity distribution service operators, and highlights challenges and opportunities for computer security incident handling in the industrial control system space.

A Survey on Cybersecurity Barrier Management in Process Control Environments

“…Although there are many similarities between safety and security [36], there are important differences as well. One challenge is that the two disciplines are practised by distinct professions, who do not always communicate well [37]. Zhou et al propose investigating this from three approaches: 1) improved understanding of the interdependencies between safety and security; 2) modelling safety and security in a unified framework; and 3) integrating safety and security into the system life cycle [35].…”

An Empirical Study of CERT Capacity in the North Sea

“…3) Communication between IT and OT environment: Communication between IT and OT environment is perceived as difficult due to different cultures [16]. Vocabulary used in IT is different than that used in OT, which can lead to misunderstanding and frustration.…”

Cyber Security Considerations for Self-healing Smart Grid Networks

“…One problem that has been observed by many [7], [8], [2] is that there seems to be a cultural divide between people working in the traditional safety domain and their counterparts in IT security. SCADA security straddles these two domains, and successful solutions cannot ignore one or the other.…”

“…In general, it is not possible to achieve 100% security from a technical perspective, and it is therefore necessary to ensure that the DSO is capable of handling cyber security incidents when (not if) they occur [2]. It is important that different categories of employees receive appropriate training through exercises, and that organizational silos are avoided -cyber security should be everyone's concern!…”

“…2. Smart Grid networks are facing many cyber security challenges [1], [2], and increased interconnection will inevitably add to these challenges. SCADA systems with remote connectivity can be compromised and infected with malware, as demonstrated in the Ukraine power grid cyber-attacks [3].…”