Security Monitoring and Network Management for the Power Control Network

Abstract

Security monitoring is a viable solution to enhance the security capability in the current power control Supervisory Control and Data Acquisition (SCADA) system, more broadly Industrial Control System (ICS), since the intrusion detection system as a main tool for monitoring can be easily deployed without any change of SCADA configuration. We explain how to design the SCADA domain-specific network security monitoring system, reflecting semantics of the target SCADA network. However, the attack vectors of the recent attacks to the SCADA/ICS systems are the vulnerabilities of the software underlying the host systems. In this respect, we need security monitoring running on host systems which can provide process and memory protection. Furthermore, network and system management (NMS), which incorporates the traditional network management into the power control system, can not only help to manage and maintain the IT/OT (information technology and operational technology) systems in a unified way, but also enhance the security capability of the SCADA system with collaboration with network and host security monitoring.