Security and solutionproposals for TCP/IP based distributed industrial control systems

Water, electricity, natural gas and oil production, transmission and distribution systems which are important in terms of social welfare, security and economy are defined as critical infrastructure in literature. One of the common features of these infrastructures is to use Distributed Control Systems (DCS) or Supervisory Control and Data Acquisition (SCADA) systems to automate physical processes in industrial plants. Unlike the past, most of the critical infrastructures based on information technology and control system technology could not be defended by solely physical protection. Recently, standard and general purpose hardware and software are frequently used in SCADA/DCS products instead of custom designed and proprietarycomponents. In addition, most of these systems could be connected to internet or other external networks in some ways and allow remote access and operations. In the last years, increases in cyber attacks to SCADA/DCS have more attentions because of its critical functionalities. That is why academics and government sponsored studies have been started in some countries.In this study, it is aimed to contribute and propose solutions to security of critical infrastructures that are used for production, transmission and distribution based on control systems. Two case studies have been conducted to determine security requirements, observe institutional practices in Turkey, and propose realistic and applicable security solutions. Literature survey and data obtained from two case studies were used to determine threats and vulnerabilities of critical infrastructures in Turkey. With the help of these, an approach illustrating the criticality level of security vulnerabilities based on unwanted incidents for different operators is proposed.As a result, we have aimed to develop an integrated security aspect which gives importance to management, operation and technical dimensions related to SCADA/DCS systems. In addition, several security documents have been created in terms of improvement of security risks and to supply the needs of decision makers, researchers and operators. These strategy and action plan documents can be used in national or organizational platforms.It is evaluated that the present study, which is first on this field in Turkey, will make contributions to security of critical infrastructures based on control systems.