What are the best practices for DCS security and backup in water treatment?

Backups should be performed using the “backup-in-depth” approach, with layers of backups (e.g., local, facility, disaster, etc.) that are time-sequenced such that rapid recent local backups are available for immediate use and secure backups are available to recover from a massive security incident. A mixture of backup/restore approaches and storage methods should be used to ensure that backups are rigorously produced, securely stored, and appropriately accessible for restoration.

Prepare a backup archival and restoration procedure for all OT Assets. The philosophy shall remain the same across the organization however steps or methodology may differ for each manufacturer. Consider redundancy while taking system backups. Backup should be stored at multiple secured locations to ensure max availability. Taking Backup shall be defined as a plan in SAP with automatic notification to the maintenance agency as per defined archival frequency. Use only dedicated stations with de-contamination/sanitation protocol applied while taking a backup to ensure remains protected.

By identifying potential threats like; cyberattacks or equipment failures, you can prioritize critical DCS functions and implement targeted security measures. Regularly backing up the system ensures a quick recovery in case of any disruptions.

The backups available are to follow the CIA model (Confidentiality, Integrity and Availability). Implement strong authentication mechanisms with MFA. Install DMZs wherever IT/OT convergence is foreseen. Implement Endpoint security and use latest signatures. Protecting DCS from external and internal threats also involves installing firewalls, intrusion detection systems and patch management systems. Prepare an Incident response plan, Develop procedures and policies and ensure compliance to relevant standards like ISA 62443. Conduct regular indecent response drills and conduct mock system restoration activities to ensure that all team members are familiar with their roles and can effectively restore DCS in case Of requirement.

Try Implementing defense-in-depth, antivirus, and firewalls is a great start. Have you considered implementing a vulnerability scanning program to proactively identify weaknesses in the DCS system?

Use network monitoring tools that are specifically designed for industrial control systems. These tools help ensure visibility and analysis of the OT environment. Some of the network monitoring tools have the feature of automatic asset discovery and inventory, this helps provides a real time inventory of assets. It analyzes the performance of major industrial communication platforms. Nowadays, these tools are using machine learning to benchmark normal network traffic and detect any deviations from it that could indicate a potential cyber threat. It also alerts the user in case of any suspicious activity. Continual monitoring is vial to ensure the integrity and reliability of control system network performance.

Well, Monitoring performance is crucial to maintaining a healthy DCS including: 1- This includes tracking sensor data, network activity, and security tools to identify any issues. 2- Regular audits and tests ensure implemented controls are effective. 3- So, how often do you recommend conducting these performance checks and audits?

Testing of the back up and recovery procedure of the OT system (ICS/ICSS) is really challenging since in order for it to be 100% completed it should be tested on the live network, as a suggestion it can be included on planned maintenance shutdown sonce the risks are much controlled during this times (with respect to the effect on the actual process) Keeping a separate back ups (at least 3) on separate locations is the way to go and make sure to also have an offsite back up incase the back up on the ot network is suspected to have been also infected by a malware

(1) Keeping the DCS software updated can help to prevent security vulnerabilities, improve performance and add new features. (2) Maintained a robust backup and recovery plan in place can help to minimize downtime and data loss in case of system failure. This includes regularly backing up the system configuration and process data and testing the recovery process. (3) It is essential to have a cybersecurity plan in place to protect the system from cyber-attacks. This includes regular security audits, implementing firewalls, intrusion detection and prevention systems, and ensuring that software and firmware are updated with the latest security patches.

I used to say: Have a backup of the backup! This is the most important and first step after an incident for DCS restoration. - Maintain up-to-date backups of DCS configuration, data, software, recovery, and restoration procedures. - This includes storing backups securely, testing them regularly, and keeping your backup plan current. I have two questions, waiting for DCS experts response: 1) How often do you recommend testing the backups and recovery procedures? 2) Where would you recommend storing the backups for optimal security and accessibility?

Validating DCS backups prepare you for emergency situations. Consider the following: -Conduct Mock system restoration activities or drills on DCS trainer. Make this a compulsory part of the engineer training program. -Validate the backup by testing them on Trainer and least critical operstor workstation. Can be frequency based. -In the event of Planned outage/TA do integrity check of the backups especially for workstations. -Store backups at more than 1 location for ensuring max availability. Alternate site may also be considered for backup in case the main site is compromised.

Training can be: 1- Classroom based to understand theoractical concepts 2- On-site training: by physically visiting DCS assets and explaining training/handouts Don't forget, training is ongoing thing. So need to refresh staff knowledge and assess them periodically is very important. And above all, prepare different type of trainings for different department (Operations, Maintenance, Engineers).

Staff training with DCS backup in mind: -Prepare and develop training videos for System archival and restoration. Share them with concerned. -Prepare operations & maintenance manual. -Develop comprehensive Work Instructions. -Conduct class room sessions for DCS team. Carry out handy on training on DCS trainer for collecting backup and system restoration. -Conduct regular Mock system restoration activities and time it. -Incorporate System Backup&Restoration in training plans of new inductees. -Arrange refresher courses for the operations and maintenance team.

I am presently involved in Scada implementation and integration in one of the biggest water treatment facilities in Philippines supplying half of Metro Manila. The facility has its own IT team that handles the cyber security and other related matters. 1st rule I observed, you cannot install, download or copy anything in all workstations. They will be the one installing our Scada software, in coordination with my team. Anti-virus or malware system are handled by them including firewall. In conclusion, IT has evolved from commercial into industrial applications. Well, as long as my Scada system works, they can manage whatever they want. Less work and less headache for us. If everythings fails, they'll pay us to rebuild everything.

Reviewing procedures should be part of annual or at least once in 3 years auditing or part of major planned maintenance activity. It is needed because of: - Updates introduced by OEM - New potential cyber Threats - Change of crew - Training of existing crew etc.

Identify your assets and its criticality (know your crown jewel) Conduct an assessment of the identified assets to know risks and vulnerabilities Implement solutions or mitigations (FW for network segmentation, patch management, SIEM, CTD, secure remote access if needed) to address the discovered risk and vulnerabilities (will incure cost) Do table top exercises and security awareness, develope incident response playbook and create a team that will handle incidents related to cybersecurity (ideally from O&M, OT engr, IT pips and management) Invest on back up and recovery solutions (atleast have a 3 copy of the last good working backup on separate locations) Review and improved the above Separate your IT network from your OT network