Security and Audit Considerations for Industrial Control Systems (ICS)

Security and Audit Considerations for Industrial Control Systems (ICS)

This course is designed to assist auditors, examiners, operational technology and information technology professionals with understanding the essential elements of security for Industrial Control Systems (ICS) including Supervisory Control and Data Acquisition (SCADA). Through improving knowledge in this area, attendees will be better able to understand the risks facing this technology and provide assurances that organizational risks are appropriately mitigated.

ICS represent a growing concern as a cyber threat target. ICS technology often has a long lifespan and the older systems in use today were not designed with cyber threats in mind. As more of these systems become network and internet connected to improve supportability and response, the potential to compromise these systems increases. Typically managed by operational technology staff, the security focus of these systems is availability first, followed by integrity then confidentiality; the reverse order from what information technology security focuses on (confidentiality, integrity then availability.) Furthermore, since availability is the primary concern for these systems, artifacts and evidence of cyberattacks is often erased during the course of restoring system availability leading to a lack of visibility and reporting on this global threat.

Attendees will learn about the similarities and differences between information technology security and operational technology security, best practices for operational technology security and how to develop ICS technology audit programs.