PKI Deployment Challenges and Recommendations for ICS Networks

Different types of Control Systems used for Industrial production are broadly called Industrial Control Systems (ICS) (n.d.). These include Supervisory Control and Data Acquisition (SCADA) Systems and Distributed Control Systems (DCS). ICS typically perform the “Command and Control” operations required for smooth functioning of machines in industrial production. They are widely used in Critical infrastructures such as power generation and distribution systems, Oil and Gas plants, Chemical factories and various other manufacturing facilities. Traditionally, ICS used proprietary protocols and operated in isolation. Perimeter security was considered enough as the only means to compromise these systems was via physical access to the systems. However, increased standardization, open architecture adoption and connectivity to enterprise networks as well as internet opened up these systems for a wide range of audience and enabled remote attacks. In this new operation landscape, it is imperative that newer means of securing the networks are adopted continuously. One of the security considerations for the ICS networks is the communication paths used by these networks. Public Key Infrastructure (PKI) (n.d.) plays a key role in securing the communication of ICS networks. Using Digital Certificates, PKI provides a mechanism to verify the identity of all the entities on a network and also ensures that the information is shared securely between communicating entities. PKI is a proven mechanism for secure communication and is widely used in many organizations. However, PKI as a solution to ICS security is challenging due to factors such as resource constrained environments, bandwidth considerations and hard real-time communication requirements. This paper intends to focus on key challenges in Digital Certificate management and correct deployment of PKI in ICS networks and will also present recommendations to overcome these challenges without compromising the basic functionalities of ICS.