Certified Information Security Manager (CISM)Information Security Risk ManagementHard
A manufacturing company is deploying a new Industrial Control System (ICS) that will manage critical production lines. The information security manager is concerned about the potential for cyber-physical attacks. Which of the following is the MOST important consideration when implementing security controls for this ICS environment?
- AImplementing traditional IT security controls without modification.
- BAllowing direct internet access for remote maintenance to reduce costs.
- CPrioritizing confidentiality of production data over system availability.
- DEnsuring the integrity and availability of operational processes.
Show answer & explanationAnswer & explanation
Correct answer: D. Ensuring the integrity and availability of operational processes.
In ICS environments, the primary concern is the continuous and correct operation of physical processes. Therefore, ensuring the integrity (preventing unauthorized modification) and availability (ensuring continuous operation) of these operational processes is paramount, often taking precedence over confidentiality, which is typically prioritized in traditional IT.
Why the other options are wrong
- A. Traditional IT security controls often need significant modification or different application in ICS due to unique protocols, hardware, and operational priorities.
- B. Direct internet access for ICS components significantly increases the attack surface and is a high-risk practice, generally avoided without stringent compensating controls.
- C. In ICS, availability and integrity often take precedence over confidentiality, due to the direct impact on physical processes and safety.
ICS Security Priorities
The distinct security objectives and control priorities for Industrial Control Systems (ICS) compared to traditional IT systems.
- Availability and integrity are often paramount.
- Safety is a critical consideration.
- Utilizes specialized protocols and hardware.
Memory trick: ICS: Availability & Integrity are the keys to keeping the factory running safely.