equency than in the past, and this approach is gaining in popularity, partially due to its ease of administration. Utilizing the RBAC approach, the role remains constant, despite employee turnover.
However, there are issues and weaknesses to consider. For example, a single sign-on can be difficult with multiple control systems, and because RBAC requires central servers and digital certificates it may not be supported by legacy systems.
When designing a security program, it is important to keep a number of trade-offs in mind. These include security versus ease of use; security versus the time needed to authenticate; and security versus the ability to operate in an emergency. The key is to put in place a customized solution that meets the security requirements without negatively impacting the ability for employees to efficiently do their jobs.
Of course, technology is just part of the security equation. Cyber security measures are most effective when they also identify and address the human factors that can lead to security breaches.
The first reaction may be to view cyber security from a perspective of protecting operations and processes from intentional, malicious intrusion.
In fact, it is more likely that there is no malicious intent—rather, an employee has let down his guard.
For example, an employee may open non-work-related e-mail messages or give out his password to an unauthorized user.
The best way to address the human side of the equation is training and education. The focus here is to not only ensure employees know the policies and procedures, but that they also think about their actions and understand the ramifications.
Change is constant?
When it comes to cyber security, the adage that “the only constant is change” certainly applies. New viruses and other cyber threats require constant vigilance. It is therefore advantageous to factor in security requirements when selecting a distributed control system vendor for water and wastewater facilities.
The control system supplier should continuously and proactively offer product and service enhancements that address different types of cyber security concerns.
To help ensure security offerings meet the real-world security needs of municipalities, look in particular for suppliers that work with existing customers to test and validate new features.
Last but certainly not least, the control system supplier should understand that security is just one of many demands faced by the industry.
With that in mind, the supplier should offer solutions that make complex security issues easy to manage as part of an overall monitoring and control system strategy that ensures the secure and reliable operation of facilities both today and well into the future.