www.isa.org/ISAGCA
Threats are increasing
38,500
malware modifications were
detected on industrial automation systems
of industrial control systems computers were attacked
in 2018
Vulnerabilities are Expanding
415
342
of these vulnerabilities could be accessed remotely
without any expertise
68%
carried
critical or
high risk implications
known vulnerabilities
were found in
ICS computers in 2018
Industry's Response: A False Sense of Security?
58% say hiring skilled employees is a critical challenge
30%
...but only
only 23% of companies follow minimum industry guidance
58% of companies say that finding skilled employees is a
critical challenge
plan to invest in cyber training
DANGER TO COMMUNITY
AND EMPLOYEES
Injury, death, facilitates acts of terrorism
PRODUCTION LOSS
Reduction or loss of productivity at one or multiple sites simultaneously
DAMAGE TO EQUIPMENT, FACILITIES, and ENVIRONMENTS
Empty text
IMPACTS OF CYBERSECURITY INCIDENTS
HAZARDOUS MATERIALS RISKS
Release, loss, or theft of hazardous materials
REGULATORY, LEGAL, AND CIVIL LIABILITIES
PRODUCT CONTAMINATION
Source: NIST 800-82r2
COST OF CYBERSECURITY INCIDENTS
$10 million
$70 million
$300 million
2016 - Duke Energy - Cybersecurity Compliance Violations
2017 - A.P. Moller Maersk - Shipping and Logistics - Ransomware Incident
2019 - Norsk Hydro - Mining and Metals - Ransomware Incident
$150 million
$670 million
$117 million
Mondelez - Food & Beverage - Equipment and Software Damage; Lost Sales; Compromised Data
Reckitt Benckiser - Manufacturing - Lost Sales; Disruptions to Manufacturing & Ordering Systems, Shipping Terminals, IT Networks and other Vital Infrastructure
Merck - Pharmaceutical - Production Shutdown; Inability to Fulfill Vaccine Orders, Lost Sales; Technology Remediation
Source: www.nozominetworks.com
Apply and maintain documented procedures for all systems, solutions, and software. Strengthen and enhance employee training, recognizing people as your first line of defense.
Create and deploy a strategy leveraging multiple technologies to safeguard critical systems and applications.
A comprehensive approach requires evaluation. In the face of dangerous threats and internal mistakes, your business needs to understand risks to assets, systems, and people.
Demand cybersecurity awareness and industry standards compliance from all vendors and contractors across your supply chain.
Poorly Managed Cybersecurity is a Major Business Risk
It's Time to Integrate a Comprehensive Security Strategy
Service 2Empty text
01
Empty text
02
INCLUDE CYBERSECURITY IN OPERATIONAL RISK MANAGEMENT PROFILES
04
03
DOCUMENT AND FOLLOW STANDARDS-BASED BEST PRACTICES
ENSURE
COMPLIANCE
ACROSS YOUR
SUPPLY CHAIN
ADOPT SECURITY AS PART OF THE OPERATIONS LIFECYCLE
Safety and Cybersecurity: Related Priorities
Companies need to develop a cybersecurity culture for the same reasons they've developed a safety culture
DIGITAL TRANSFORMATION adds COMPLEXITY
Our industries are safer, more efficient, and more reliable --
but these technologies bring more security risks to your facilities and operations
Accelerated connectivity, cloud resources, remote access
Industrial Internet of Things
Servers, cloud computing drives productivity and vulnerabilities
OT/IT
Convergence
Prioritize availability and integrity over security
Legacy Systems
Integration introduces risks and many products are not inherently secure
Multi-Vendor Environments
Increased reliance on contract workforces and challenges in finding and retaining talent
Skill Gaps
LOADING AWESOME
The ISA Global Cybersecurity Alliance
will work together to develop solutions that
address our biggest challenges
When end-users, asset owners, vendor companies, government agencies, and other stakeholders join together in an open and transparent way, we can move industry forward faster and more effectively
COLLABORATION
Standards exist, but aren't well understood. Our companies need easy-to-follow guides for implementing best practices, and industry needs to increase the adoption of standards globally
STANDARDIZATION
Human error is the biggest factor in safety and security incidents around the world. Providing accessible, consistent training and education for professionals at all levels gives our companies a first line of defense
EDUCATION
Ensuring the inherent security of vendor devices and systems, and exploring ways to increase compliance with best practices, offers real risk reduction in your operations
PROTECTION
MEMBERS
38,500
SECTIONS
135
COUNTRIES
44
LOADING AWESOME
CUSTOMERS
350,000
STANDARDS
EDUCATION
CERTIFICATION
CONFERENCES
PUBLICATIONS
COMPLIANCE
ISA is uniquely qualified to lead this effort
Independent, tax-exempt, global professional organization
Unbiased 501c3
ISA has extensive experience sharing knowledge across industries and stakeholder groups
Advocacy and Outreach Capabilities
Developers of the world's only consensus automation cybersecurity standards
Home of the ISA/IEC 62443 Standards
ISA has managed several consortia and industry groups, including LOGIIC, the ISA Secure® Program, and the ISA100 Wireless™ Program
Experience Managing Consortia
Trusted industry resource for hands-on, vendor-neutral training and certification
Established Training and Certification Programs
Defines requirements and procedures for implementing electronically secure systems
Leverages a holistic approach, bridging the gap between operations and information technology; and between safety and cybersecurity
World’s only consensus-based standard for automation and control system applications
Flexible framework to address and mitigate current and future security vulnerabilities
Importance of the ISA/IEC 62443 Standards
Leveraging industry standards
increases productivity, lowers costs, and keeps facilities safe
ISA Global Cybersecurity Alliance Differentiation, Structure, and Objectives
ISA Global Cybersecurity Alliance is Different
Open, standards-based, and practical
A broad network of end users, vendors, government agencies, and other stakeholders will leverage the UN-endorsed, consensus-developed series of standards as a foundation.
The challenge is so much bigger than any one organization - no matter how big or capable - can tackle alone. We see a need for an open, transparent body to bring all kinds of groups together.
All-Inclusive, Industry Wide
GCA will develop the training, tools and know-how to bridge the gap between the standards and implementation, making standards more approachable and user-friendly.
Built Around
Global Standards
Practical and
Tactical
Alliance Composition
LOADING AWESOME
LOADING AWESOME
LOADING AWESOME
LOADING AWESOME
LOADING AWESOME
End Users
Automation Providers
Cybersecurity Providers
IT Infrastructure Providers
Insurance Providers
Objectives of the Alliance
Share threat intelligence & experience
Develop a skilled,
cyber-aware
workforce
Increase awareness
and engagement
Accelerate expansion & adoption of ISA/IEC 62443
Optimize compliance and prevention
PROPOSED OBJECTIVES
- We’ll create high-quality, standards-based procedural security guidelines for industry segments & stakeholder groups
- We’ll work closely with global standards organizations to facilitate the use of ISA/IEC 62443 as a reference standard
Workforce training
and development
Expansion and adoption
of ISA/IEC 62443
Optimized compliance and prevention
Industry reach and awareness
Shared threat intelligence and experience
- We’ll facilitate and encourage initiatives that bridge the gap between information technology and operations technology
- We’ll develop and maintain training modules and certification options with user-friendly, accessible tools to help companies and facilities consistently navigate the entire lifecycle of cybersecurity protection
- We’ll facilitate open dialogue and engagement to drive consistency and prioritization across all industry segments and types of facilities
- We’ll educate and inform global governments, agencies, and stakeholders, ensuring they understand industry’s challenges and the benefits of standardization
- We’ll share knowledge, information, and threat intelligence in an open environment
- We’ll develop safe, secure, and customized ways to identify best practices and vulnerability remediation guidance across industry segments
- We’ll expand compliance programs globally, ensuring all vendors develop inherently secure products
- We’ll develop and publish a baseline of common cybersecurity requirements for suppliers within the supply chain to follow
User-friendly, consistent standards implementation
Reliable, secure,
and interoperable
devices and systems
Stay ahead of
increasing threats
and vulnerabilities
Expansion
and adoption of
ISA/IEC 62443
Optimized compliance and prevention
Shared threat intelligence and experience
Alliance Objectives
End User Benefits
A vigilant, proactive cybersecurity culture in every facility
Industry reach and awareness
A skilled, experienced workforce that
drives results
Workforce training
and development
Top Reasons for End Users to Join the ISAGCA
Top
Leverage the power of a unified group of experts and thought leaders
EXPONENTIAL KNOWLEDGE
Leverage the collective knowledge, experience, and best practices across industries, facilities, and geographies
01
AMPLIFIED VOICE
Explore and define challenges with people who can take down barriers and solve problems
02
UNPARALLELED ACCESS
Access the experts and thought leaders that are shaping the future of cybersecurity in multiple industries
03
INFLUENCE SOLUTIONS
Influence the creation of the latest tools, guides, and best practices to help your company address cybersecurity challenges
04
CONSISTENCY
Develop a consistent approach to cybersecurity using the lens of people, processes, and technology
05
EMPOWERMENT
Empower your company to create and sustain a positive cyber-aware culture at every level of the organization
06
MEMBERSHIP OPTIONS
Founding Member
ree-year financial commitment based on annual revenues — eligible to be selected by ISA to serve on the advisory board for the first year of the Alliance (after the first year, the general membership votes to select advisory board members) — if selected to advisory board, vote to prioritize activities and allocate resources (each advisory board member company will have one vote)
- three-year financial commitment based on annual revenues
- eligible to be selected by ISA to serve on the advisory board for the first year of the Alliance
- if selected to advisory board, vote to prioritize activities and allocate resources
ree-year financial commitment based on annual revenues — eligible to be selected by ISA to serve on the advisory board for the first year of the Alliance (after the first year, the general membership votes to select advisory board members) — if selected to advisory board, vote to prioritize activities and allocate resources (each advisory board member company will have one vote)
- yearly financial commitment
- propose initiatives and vote on committee and workgroup decisions
- opportunity to be elected to the advisory board after the first year of the Alliance
ree-year financial commitment based on annual revenues — eligible to be selected by ISA to serve on the advisory board for the first year of the Alliance (after the first year, the general membership votes to select advisory board members) — if selected to advisory board, vote to prioritize activities and allocate resources (each advisory board member company will have one vote)
Supporting Member
Awareness and Outreach
- Cultivates awareness and engagement around important cybersecurity issues with industry and stakeholders across all relevant sectors
- Serves as primary marketing arm for the ISAGCA’s objectives and accomplishments
- Expands and extends the adoption and use of cybersecurity standards worldwide
- Cultivates relationships with key global stakeholder groups and agencies
- Develops materials that help all sectors utilize standards and technical guidance
- Delivers specific workforce development initiatives with consideration to all relevant job functions and industry sectors
- Develops and promotes training courses, web seminars, educational events, certificates or certification programs, etc.
- Expands and develops compliance, prevention, and harmonization initiatives
- leverages collective expertise and intelligence of member companies for the good of industry
Initial Workgroups of the ISA Global Cybersecurity Alliance
Advocacy and Adoption
Training and Education
Compliance and Prevention
ISA Global Cybersecurity Alliance
Founding Members
Slide not found
The ISA Global Cybersecurity Alliance relies on expertise and financial commitments from a diverse membership. The Alliance welcomes:
end-user companies
asset owners
automation and control systems vendors
cybersecurity vendors
IT infrastructure vendors
system integrators
industry organizations
government agencies
insurance companies
other stakeholders
Questions and Answers
Note: Citations for the facts presented during this presentation are attributed to
Kaspersky Labs' The State of Industrial Cybersecurity 2018,
and SANS' 2019 State of OT/ICS Cybersecurity Report
Key Contacts
Andre Ristaino
ISA Global Cybersecurity Alliance Director
Rick Zabel
ISA Sponsorship Director
+1 919–990–9233
Elena Pitt
Strategic Business Development
+1-919-323-4023
Media and analysts should contact:
Jennifer Halsey
ISA Marketing and Communications Director [email protected]
+1 919–990–9287
www.isa.org/ISAGCA
