Improvements in SCADA and DCS systems security

Supervisory control and data acquisition (SCADA) systems monitor, regulate, gather information from, and control the computer field units that control much of our industrial and utility infrastructure. Distributed Control Systems (DCS) is a broader term used in the chemical and process industries, and includes systems implemented with SCADA networks as their backbone. Security was not a high priority in the design of much of this equipment because it used obscure protocols and relatively secure, dedicated, communications links. This has all changed in recent years as many SCADA and DCS systems are now accessible, either deliberately or through system design flaws, through the public Internet. In this paper a new approach to the issue of intrusion detection and prevention in DCS and SCADA has been developed. Here, the cyber vulnerabilities specifically applicable to the control of chemical plants are directly addressed, rather than adopting in this environment generic solutions. Abnormal behavior signatures are directly associated with adaptive traffic matrix deviations. Spatial and temporal correlation techniques are then applied to enhance intrusion detection. This paper also discusses an experimental test-bed for generating attack data for a wide variety of SCADA and DCS configurations.