ct the system from cyber attacks from hackers and worms, which are viruses that reside in the active memory of a computer and duplicate themselves, potentially wreaking havoc.
Two important security concepts are: authentication, which identifies the user or host; and/or authorization, which dictates the actions a user and/or host can take. There are a number of approaches where these concepts can be used alone or, more effectively, in combination to discourage cyber attacks.
One security tactic is password management. The strength of passwords/PINS is based on their length and randomness. Unfortunately, the very thing that makes a password difficult to crack also makes it difficult for the user to remember.
This can be compounded by the need for different passwords to perform various activities or gain access to different programs, not to mention the necessity to periodically change passwords. A variation of password management is known as the challenge/response, in which computers must correctly respond to a question (similar to people using questions like “what was the name of your grade school?” or “who won the 2003 World Series?” to confirm someone’s identity) to gain access to the system.
Another related technique, so-called “smart cards,” which must be used to gain access to the system, also is gaining in popularity.
However, lost or misplaced cards not only limit the ability for personnel to do their job, but also pose a security concern themselves.
While it may sound like something out of a James Bond movie, biometrics, which read a user’s physical attributes, such as fingerprints, facial geometry or retinal signatures, will likely gain ground as the technology continues to improve and the social acceptability of these techniques become more accepted.
Another approach for authorizing users is known as Role Based Access Control (RBAC). In this approach, people are assigned to roles, and their authorization is based on the role.
In today’s work environment, people change positions and companies with more frequency than in the past, and this approach is gaining in popularity, partially due to its ease of administration. Utilizing the RBAC approach, the role remains constant, despite employee turnover.
However, there are issues and weaknesses to consider. For example, a single sign-on can be difficult with multiple control systems, and because RBAC requires central servers and digital certificates it may not be supported by legacy systems.
When designing a security program, it is important to keep a number of trade-offs in mind. These include security versus ease of use; security versus the time needed to authenticate; and security versus the ability to operate in an emergency. The key is to put in place a customized solution that meets the security requirements without negatively impacting the ability for employees to efficiently do their jobs.
Of course, technology is just part of the security equation. Cyber security measures are most effective when they also identify and address the human factors that can lead to security breaches.
The first reaction may be to view cyber security from a perspective of protecting operations and processes from intentional, malicious intrusion.
In fact, it is more likely that there is no malicious intent—rather, an employee has let down his guard.
For example, an employee may open non-work-related e-mail messages or give out his password to an unauthorized user.
The best way to address the human side of the equation is training and education. The focus here is to not only ensure employees know the policies and procedures, but that they also think about their actions and understand the ramifications.
Change is constant?
When it comes to cyber security, the adage that “the only constant is change” certainly applies. New viruses and other cyber threats require constant vigilance. It is therefore advantageous to factor in security requirements when selecting a distributed control system vendor for water and wastewater facilities.
The control system supplier should continuously and proac