ISA Interchange

Welcome to the official blog of the International Society of Automation (ISA).

This blog covers numerous topics on industrial automation such as operations & management, continuous & batch processing, connectivity, manufacturing & machine control, and Industry 4.0.

The material and information contained on this website is for general information purposes only. ISA blog posts may be authored by ISA staff and guest authors from the automation community. Views and opinions expressed by a guest author are solely their own, and do not necessarily represent those of ISA. Posts made by guest authors have been subject to peer review.

All Posts

How Much Is Enough Cybersecurity Protection for an Industrial Network?


This post was authored by Paul J. Galeski, CEO and founder of MAVERICK Technologies, a Rockwell Automation company.


Today’s cyber threat landscape is constantly changing with a growing list of highly publicized attacks against the government, retail stores, and business information networks. The number of incidents against industrial networks is also growing—and they often go unreported.

Most of today’s industrial networks are not isolated from corporate business networks or the Internet. In fact, many of the recent gains in productivity are a result of integration between business and industrial control networks. Productivity techniques that have become commonplace, such as just-in-time manufacturing and lean inventories, are only made possible through the use of a highly integrated network.

The conduits that permit data exchange between these networks make the industrial control network as vulnerable to attack as the business network. In addition to this obvious path, employees using universal-serial-bus drives or contractor laptops are potential points of infection by computer viruses. Remember cybersecurity is not only protection from unauthorized access, but also from inadvertent damage.


Most companies know they must address cybersecurity, but there is little understanding of the risks, problems, and answers. Here is a frank assessment of the issues, along with suggestions for action.

There have been countless articles, webcasts, conferences, videos, and other discussions of cybersecurity defensive strategies, but few provide sufficient detail to help structure an effective program. I recommend using the ISA/IEC 62443, Industrial Automation and Control Systems Security standard, or if applicable, the API 1164 Pipeline SCADA Security standard, as starting points. Most standards call for a complete inventory of all industrial network cyber assets, network layouts, communication paths, and identifiable vulnerabilities. Performing inventory to the level of detail required is very time consuming, which is why most plants have not completed this first crucial step. However, without this step, other attempts at formulating a defensive strategy can fall flat.

How much is enough? It depends on what is at stake. If a business has not quantified the risk, it might be all but impossible to get funding to implement mitigation policies and equipment. Would an extended disruption of your process effect profitability, or even worse, safety or the environment? How much is this worth to you and the shareholders? Knowing this number will help overcome the largest challenges to cybersecurity: funding and implementation.

You can view cybersecurity in a similar light as a process safety system. A well-designed safety system balances the potential of loss to the business with the cost to implement appropriate safety measures. This is no different for a cybersecurity program. In a simple sense, if you determine a likely cybersecurity incident may cost the company millions of dollars or lost production, spending a fraction of this potential loss on mitigation is just good business.

Given the age of many of the components in most industrial environments, most assets on industrial networks have no provision for their own security. They have no capability to encrypt communication between devices, and they use unsecured communication protocols. Many new devices are no better. This is changing, but not fast enough.

Implementing a comprehensive cybersecurity program, users often find they do not have enough qualified people with the skills to understand and implement defensive strategies for industrial networks. Companies should expect to contract with knowledgeable firms, while at the same time committing to formal employee training. Cybersecurity threats are constantly changing, requiring an effective cybersecurity program to be evergreen.

So now what? There are many items we could add to the list, but these are actions you can take now:

  1. Know your industrial network. It seems obvious, but it is the most overlooked item.
  2. Perform a vulnerability assessment to define, identify, and classify the security vulnerabilities in your industrial control system.
  3. Follow up your vulnerability assessment with a security risk assessment to determine the likelihood and consequences of a successful cyberexploit.
  4. Define and implement cybersecurity policies and procedures and add tools and technologies as needed.
  5. Educate your employees about cybersecurity and prevention.
  6. Leverage your employees with knowledgeable outside resources.
  7. Actively participate in the development of industry-based cybersecurity standards and working groups.

No system will ever be 100 percent secure. Business analysis should balance quantifiable business risk with prudent investments to achieve results “good enough” relative to the consequences and downside risk of a cyberattack.


Paul J. Galeski, the chief executive officer and founder of MAVERICK Technologies, specializes in high-level operational consulting, as well as the development of automation strategy and implementation for automation technology. He is also involved in expert witness testimony, and is a contributing author to Aspatore Books’ Inside the Minds, a series of publications that examine C-level business intelligence.


Connect with Paul


A version of this article also was published at InTech magazine


Related Posts

IoT Solutions World Congress: Why Barcelona is the Place to Be in May

A century ago, automation solutions arrived to transform manual industrial tasks. This century, the digit...
Renee Bassett Apr 2, 2024 7:00:00 AM

3 Ways Industry 4.0 Can Upgrade Industrial Water Treatment Methods

Industrial water treatment methods must evolve to remain relevant and efficient. Many decision-makers hav...
Emily Newton Mar 12, 2024 7:38:26 PM

ISA Business Academy: A Mini-MBA For Automation Industry Leaders

The ISA Business Academy is a 10-week fully digital program beginning 28 March for both current and aspir...
Ashley Ragan Mar 11, 2024 10:08:24 AM