exida explains Blog

The exposure of industrial facilities to cybersecurity threats has never been higher. An analysis performed by IBM security found that the number of attacks on SCADA systems increased 636% from 2012 to 2014, with 675,816 cybersecurity incidents in January 2014 [1]. Finding an effective method for evaluating the current…

Read More...

The world of automation has changed significantly over the past 30 years.  I have fond memories of starting my career by calibrating, adjusting, and tuning pneumatic control loops while working my way through the electronic age right up to the present digital and cyber generation of automation.  If you…

Read More...

Have you noticed that over the last several years, cybersecurity seems to be “trending?” 

Companies of all sizes are starting to learn how to prevent, or at least minimize, these attacks. They hire third-party experts and attend trainings to learn more about the human and system weaknesses that are…

Read More...

The thought of tackling a threat model (TM) might not be the most appetizing to some people.   Doing a quick Internet search, someone could get stuck under a mountain of acronyms and terms.  I mean, what is a CVSS anyway?  And then there are the diagrams, attack trees and feedback loops that…

Read More...

Today’s owner operators and lease operators of industrial production facilities frequently employ service providers for projects and upgrades, as well as operations and maintenance. These contractors often travel to many sites, carry their own copies of source code and files, and use multiple PCs with multiple engineering tools for…

Read More...

To be clear, the above title is meant to capture your attention. We all understand and know that it is unusual for a Process Safety engineer and the IT architect to possess detailed knowledge of both safety and security. In today’s world, the operators, engineers, design and support personnel of…

Read More...

Co-written by Todd Stauffer, Director of Alarm Management Services at exida

A wise man once said, “You can’t manage what you don’t measure.” Let's apply this to the world of cybersecurity to discuss the importance of cybersecurity metrics and how they are different from a cyber diagnostic and a…

Read More...

exida would like to welcome our new director of cybersecurity services Dave Gunter.  Dave will be taking us through a multi part blog series based on general cybersecurity evolving into how it pertains to your industrial work environment and what you should do to protect your company…

Read More...

That’s a great question.

What is a Cyber sensitive position?

A cyber sensitive position is a subset of a job position description that can be graded as Ultra, High, Medium or Low sensitivity with respect to cybersecurity assets and associated potential consequences that may impact an operating company.

What…

Read More...

2013 was a good year for functional safety progress.  exida Certification issued a record number of new product functional safety certifications in mostly every product category - valves, actuators, solenoid valves, PLCs, fire and gas sensors, process sensors, and components.  The component category is one of the most…

Read More...

After careful planning and development of your system, the last thing you want to worry about is the credibility of your certification. Although it may seem like a given for your certification to be well accepted by your customers, it is never a bad idea to dig a little…

Read More...

The travel and group meeting restrictions from COVID-19 have allowed me to catch up on some reading about viruses; not the type that get transmitted to humans. This article is about the Stuxnet virus and what I learned from the book “Countdown to Zero Day: Stuxnet and the Launch of…

Read More...

Oh look! Squirrel!

I am not much of a blogger. I should be but I’m not. This is strange, because I always have plenty to say.

This subject just gets me going so I am writing about it. I welcome feedback and opinions.

I have been in cybersecurity in…

Read More...

The IEC 62443 series of cybersecurity standards include over ten documents covering various subjects. Buying a full set is a bit expensive, but for me the real cost is the time needed to read and understand them. So I often ask one of the experts at exida…

Read More...

During an IACS cybersecurity risk analysis, each zone of a network is given a target security level. The levels are one to four, with one being the least amount of protection and four giving the most protection. For each zone we ask, “How much cybersecurity protection do we…

Read More...

Industrial Automation Control Systems (IACS) Cybersecurity based on IEC 62443 was created to be compatible with agile development methodology. The standard deliberately talks about processes and not phases, such as those in the waterfall model. The processes defined can be met simultaneously and are, most likely, already being followed…

Read More...

When we were doing safety system designs in the 1980s, there was no Windows, there was no TCP/IP, there was no in Ethernet. We had to write our own protocols to transmit data to our I/O and our controllers.

Fault-finding was always a challenge . What we ended up…

Read More...

As the incidence of cybersecurity threats in automation systems continue to rise, the automation world continues to grapple with how to address these issues.  There are many good practices published in the IEC 62443 series of standards available to end users such as creating demilitarized zones between the business…

Read More...

By now we’ve all become familiar with safety integrity levels (SIL), as they have become part of our everyday lives. However, with the recent release of several cybersecurity standards in the IEC 62443 series, things are getting more complicated. This series of standards introduces two more levels…

Read More...

Last Saturday, I read an article about hackers who were behind at least two potentially fatal intrusions on oil and gas industrial facilities (Yes I read cyber articles on the weekend 😉). Besides the fact that I enjoy learning about cybersecurity on my days off, what I noticed is…

Read More...