| Physical, network, internal, and cyber security for Industrial Control Systems is extremely low, leaving these critical systems vulnerable to attack by sophisticated cyber-threats. Outdated control systems have been in place for upwards of thirty years and are riddled with significant vulnerabilities, with no clear solutions to be found. The purpose of this research was to examine the current state of security for Industrial Control Systems and to provide clear and applicable solutions to any issues that may be discovered. This research also analyzed the threats that are enabled through the current state of ICS security. Central focal points of this research include discovering the age and state of current running control systems, uncovering the vulnerabilities and threats against them, and locating applicable security solutions to and problems observed. Key findings of this research show that many Industrial Control Systems have been in place for upwards of thirty years and run outdated hardware and software. ICS were designed with a focus on functionality and not internal security. Vulnerabilities include weak access control, weak user authentication, unauthenticated protocols, remote access, poor network security and visibility, increased IT/OT convergence, and a lack of involvement by senior level management. Threats toward Industrial Control Systems are on the rise and consist of enemy nation-states and politically motivated attacks, internal threats such as human error or sabotage, terrorist organizations, and hacktivists. Industrial Control Systems can be made more secure through the use of defense-in-depth strategies, detailed procedures, timely application of system patches, network segmentation, multi-layered access mechanisms, and an increased understanding of what systems are most at risk. ICS need to be secured one step at a time to avoid disruption and physical damage from an attack. |
