November, 2011
The contrast between these two articles beautifully captures an issue the automation industry must resolve in the next few years. On one hand, industry is becoming increasingly concerned about just how vulnerable control systems have become to outside attacks. At the same time, new tools and applications that improve efficiency, but increase that exposure, are appearing daily.
So must we sacrifice these gains in efficiency that modern technologies offer if we want our utilities and factories to be secure?
For many security commentators, the answer is:
Now industry and government can try to battle this trend by banning technologies and mandating complex and onerous procedures. We see this sort of strategy every time we try to board a plane and wait in long lines to take our shoes off and get our hair shampoo confiscated. Frankly, I don’t think it is effective or efficient security for air travel. It is even worse for companies that ultimately need to be profitable if they are going to stay in business.
Simply put, expecting companies (and the people running them) to pick security over efficiency is not a realistic strategy because it goes against human nature. People are terrible at making good judgements about risk. We badly underestimate the risks of very infrequent, but serious events. We lean toward decisions that are beneficial or efficient in the short term, as long as the consequences are sufficiently long term. We underestimate the risks for things we can control (like driving a car), but overestimate the risks for things we can’t control (like being in a plane crash).
This is not just a fact for security related decisions. We are bad at any risk-related decision – health, personal safety, financial planning and so on. Consider the poor smoker – neither gruesome images of cancer victims nor graphic warning labels prevent them from opening those packs and enjoying their next smoke. Only when a health crisis is upon us, do most of us modify our behaviours.
Now interestingly, in the safety arena many things have improved over the past few decades. Smoking rates are falling (at least in the developed world), workers in factories are more safety-aware, and driving deaths are declining.
Progress comes from a combination of three solutions:
- Sustained educational programs.
- Enforced management of behaviours.
- Simplified risk reduction technologies.
Consider driving deaths due to car accidents. The combination of massive educational programs on the risks of driving without a seatbelt, laws requiring the wearing of seatbelts, and the introduction of improved safety technology (such as antilock brakes and air bags) in automobiles have all helped to drive these deaths downward. All three have been critical legs of the solution. All have been expensive and slow to see significant results. But they do get results.
- Years of regularly repeated safety education programs have made safety top of mind for anyone entering an industrial site.
- Well-designed standards like IEC-61508 (Functional safety of electrical/electronic/programmable electronic safety-related systems) and IEC-61511 (Functional safety - Safety instrumented systems for the process industry sector) have led to well-designed safety strategies.
- Significant improvement in the technologies and ease of use for safety integrated systems (SIS) has made deploying a safe process an economically viable reality.
All three have been critical to achieving safer plants and factories.
We are not going to be successful at making our factories and infrastructure more secure unless we embrace education, standards and technology as the three legs of the solution. Furthermore, each leg needs to be well-designed and implemented. Education that is sporadic, poor regulations that reward compliance rather than results, or technology that is complex and cumbersome will doom the quest for better security.
Take industrial wireless as an example. Companies can ban wireless outright, but a better solution is to use its adoption as a way to drive better plant floor security. Boeing, the aircraft manufacturer, makes extensive use of wireless technologies in its 777 and 787 manufacturing operations. At the same time, it is using the migration to wireless as the impetus to manage and encrypt all in-plant manufacturing communications whether wired or wireless. As a result, the flawed “crunchy on the outside, chewy on the inside” mentality is disappearing and a truly robust plant floor is emerging.
- Why the Human Brain Is a Poor Judge of Risk Wired News,
- Cognitive biases potentially affecting judgment of global risks Singularity Institute,
March 22, 2007 Bruce Schneier
August 2006 Eliezer Yudkowsky
- IEC-61511 (Functional safety - Safety instrumented systems for the process industry sector)
- IEC-61850 (Functional safety - Electrical/electronic/programmable electronic safety-related systems)
- exida - Control System Security blogs
