Industrial control systems are sensitive systems that must make decisions in real time to ensure the operation of the industrial process they govern. The latency and reliability in packet transmission is fundamental, since the protocols are connection-oriented but because of the main speed goal, many of them do not have included error recovery schemes other than those included in the TCP / IP stack.

Where is it possible to use encryption without affecting the operation of the industrial control process? Here are some examples:

• Power Transmission systems: The most critical communications that electrical systems have are the protections that activate the switches that handle the events of overloads in the transmission lines. Orders that are delivered to these devices can not exceed 12 ms roundtrip. Protocols such as IEEE C37.94 unfortunately still do not support encryption functionalities by default and because latency in a communications channel can easily exceed 12 ms by numerous factors that are normally seasonal and do not involve malfunctions of the platform Of communications, the use of encryption is not recommended because of the risks involved for the operation of the system. For all other communications using protocols like IEC 60870-5-104, IEC 61850 and DNP3, the crypto extensions detailed in IEC 62351 are recommended. For all other protocols that does not include a security standard like modbus, hardware crypto boxes or VPN devices works great.
• Water and gas systems: The most critical communications for the system are in the water catchment, pipes, tanks and potabilization plants. The orders sent to the RTU are not completed immediately and might take event minutes to finalize. Protocols like DNP3, BSAP and Modbus are able to handle some milliseconds (even 50) without any impact to the industrial process. In these systems, hardware crypto or VPN devices can be used

Manuel Humberto Santander Peláez

SANS Internet Storm Center Handler