Analysis of ICS-SCADA cyber security maturity levels in critical sectors

ICS (Industrial Control Systems) is a general term describing industrial automation systems responsible for data acquisition, visualization and control of industrial processes, often found in various industrial sectors and Critical Infrastructures. They play a critical role not only in maintaining the continuity of industrial processes but also to ensure functional and technical safety, preventing large industrial accidents and environmental disasters. The criticality of control systems in vital sectors, and high impact in case of disruption, makes them a major target for malicious activities. Based on the ICS-CERT Monitor (part of U.S. Department of Homeland Security)1, between 2009 and 2014 the number of reported cyber security incidents in the ICS-SCADA area increased more than 27 times. At the same time more than half of the incidents (59% in 2013) were aimed at the energy and critical manufacturing sectors and around 55% involved advanced persistent threats (APT). Still many ICS-SCADA cyber security incidents stay undetected or unreported. This study reveals the current maturity level of ICS-SCADA cyber security in Europe and identifies good practices used by European Member States to improve this area.