1 Sustainable Security for Infrastructure SCADA

Abstract — Modern SCADA systems used in infrastructure are threatened by cyber attack, as a result of their higher visibility in recent years and the conversion of legacy stovepipe implementations to modern information technology (IT) systems. Many contemporary efforts statically address obvious errors in the implementation of these systems, but this approach does not foster effective security because of the fluid IT environment. The problem must be addressed such that SCADA security becomes effective and sustainable for the entire system lifecycle, including design, installation, operation, maintenance, and retirement. Only the implementation of effective security governance for SCADA will meet this requirement. Some approaches for security perform well at linking security investment for information assurance to the business goals of the larger corporation but are not readily translatable into actionable practice. Others excel at defining and enforcing security for implementations and procedures but are weak from the perspective of the larger picture. The strengths of the two groups can be leveraged to create effective security governance for SCADA, reaching across the organizational structure of the company and creating the foundation for sustainable security