Byres Research has been at the forefront of control system security since its emergence as a critical issue nearly a decade ago. Members of the Byres team have been responsible for numerous standards, best practices and innovations for control system security in industrial environments. They have provided security guidance to government security agencies and to major energy companies on cyber protection for critical infrastructures.

exida adds to this rich expertise a global service delivery capability and its own deep experience in control system availability and safety. Recognizing that weaknesses in control system safety and security expose similar consequences, the blending of these capabilities under exida gives plant operators a more efficient, more thorough option for proactively avoiding unplanned incidents.

The security life cycle, which in many ways resembles the safety life cycle, includes three main phases:

• The Assess phase involves analyzing a new or existing design to determine the inherent risk in the system, to establish a Zone & Conduit (Z&C) model, and to establish security level targets for each Zone/Conduit.

• The Implement phase involves designing and implementing the system architecture design as well as testing and validating that the design meets the security level targets established in the ASSESS phase.

• The Maintain phase is focused on maintaining the security level targets through periodic vulnerability assessments and an effective patch management process.