Industrial Cybersecurity

Policies, procedures, and awareness

Finally, gluing all the security controls together are policies, procedures, and awareness. Policies are a high-level guideline on what the expected security stance is for ICS systems and devices, for example, we shall encrypt all our databases. Procedures are step-by-step instructions on how to accomplish policy goals, such as how to implement AES encryption on production recipe databases. Awareness (training) helps get and keep attention on security-related aspects of the ICS and its operation. Awareness training often comes in the form of an annual security training that will cover topics such as spam, insider threat, and tailgating practices (an intruder closely following a legitimate employee into ...