Three Foundational Pillars have long been referred to as the Cybersecurity TRIAD or more commonly, CIA (Confidentiality, Integrity, and Availability). In Information Technology, which focuses on business applications like email, payroll, and others for which “Confidentiality” is always of utmost importance.

But in ICS/OT environments, the critical piece is likely to be Availability. If industrial systems become unavailable or misbehave, critical operations may cease or cause unintended damage, including some that have life/safety impacts.

Designing for ICS Cybersecurity must still follow Security-by-Design, and Defense-in-Depth. But the approach to defining these must be informed by an understanding of both the control system architecture and the cybersecurity controls required to safeguard ICS from the adjusted CIA viewpoint.

This session will examine this critical shift in the approach to fulfilling the CIA Triad in implementing cybersecurity for ICS / OT.
• Which is more important in the OT environment, confidentiality, availability, or integrity?
• Why is this re-emphasis so critical during the design phase? (Life-safety)
• Examples of real-world impacts from breaches to OT systems
• How does this affect best practices for ICS / OT design?
• What published standards and best practices guide these designs?

Upon completion of this presentation, attendees will:
• Have increased understanding of how the Upside-Down view of the CIA Triad should be considered during design of ICS/OT networks
• Be able to quickly access standards, regulations, and other resources for effective and compliant ICS design
• Have a plan for the integration and coordination of multiple disciplines (HVAC, Electrical, Building Management Automation, Maunfacturing Automation, etc., to facilitate more efficient and robust industrial control systems design.