The goal of this course is to familiarize the student with the elements of automated production systems from both traditional and modern (cyber-physical) perspectives, reflecting the long (20-40 year) asset lifecycles commonly seen in large manufacturing plants in both discrete and process industries.
Traditional industrial control systems (ICS) were built from mechanical and electrotechnical devices in closed (air-gapped) systems, but information technologies and communication protocols are central to modern control systems. Although this increases efficiency, and can reduce waste and costs, these changes have made the infrastructures more vulnerable to external attack. Safety and ergonomics are often drivers of automation, but in the era of wide-scale cyber-physical systems, both physical and cognitive ergonomics play a key role: even in highly automated systems, humans are still required to rapidly integrate and interpret information. Confusion (which can be brought about by both physical and cognitive impairments) can be costly, dangerous, and increase an organization’s vulnerability to attack.
As a result, this course will familiarize the student with the terms, definitions, and architecture of Industrial Control Systems (ICS) from the joint perspectives of quality management and cybersecurity. Using hazards, risks, vulnerabilities, threats, and impacts as the basis for understanding, we will explore conceptual frameworks and analytical tools for understanding and managing aspects of cyber-physical industry based on new research. This course is not a deep dive into specific tools, protocols, vulnerabilities, or exploits, but will help the student navigate the industrial environment and its expanding ecosystem of connected components.
This course is broken into four logical modules:
- Module 1: Introduction to Industrial Control Systems
- Module 2: Critical Infrastructure & Smart Cities
- Module 3: Managing Security, Safety, and Risk
- Module 4: Physical and Cognitive Ergonomic
- Explain how cybersecurity contributes to quality and innovation
- Describe the history of industrial automation from ancient times, to the first industrial revolution, through Industry 4.0 and the roles of industrial control systems (ICS) – including machine to machine communications (M2M), Cyber-Physical Systems (CPS), and Internet of Things (IoT)
- Identify the components of industrial control systems (RTU, PLC, SCADA, HMI, SIS, DCS)
- Explain the relationships between risk identification, risk management, hazard analysis, safety, and security on multiple levels (physical, hardware, software, and services)
- Describe and use management models for industrial cybersecurity, in particular, how to apply them in an industrial context: C2M2, Baldrige Cybersecurity Excellence Builder, NIST Cybersecurity Framework
- Apply common top-down (FMEA/RPN, FTA, Ishikawa) and bottom-up risk management tools (PHA, FMECA, HAZOP, HCCP) used in process industries and discrete production
- Apply quality cost models to determine whether automation process improvements are effective
- Describe how principles of physical and cognitive ergonomics influence security and performance
- Apply objective and subjective measures (e.g. time, error rates, NASA TLX) and common analysis methods (Chi-square, Mann-Whitney U, Spearman rank correlation) for empirical studies of cognitive aspects of industrial HMIs
- No previous experience with or understanding of industrial control systems is required
- A foundational understanding of statistical inference would be helpful for the ergonomics labs
Readings are selected from:
- Groover, M. P. (2016) Automation, Production Systems, & Computer-Integrated Manufacturing, 4th Ed. (http://amzn.to/2igGVKU)
- Hoeller, J. et al. From Machine-to-Machine to the Internet of Things: Introduction to a New Age of Intelligence (http://amzn.to/2igSxxd)
- Macaulay & Singer (2011) Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SIS. (http://amzn.to/2iNzU1b)
Homework Assignments and Labs
Modules 1 and 2 cover foundational information. Modules 3 and 4 address topics that are more applied in nature, and are accompanied by 8 lab exercises to help students synthesize the information into practical, actionable knowledge that will improve their performance as cybersecurity professionals. The labs correspond to, and are labeled with, the lesson IDs:
- Lab 3B: Risk Analysis and Prioritization
- Lab 3C: The NIST Cybersecurity Framework
- Lab 3D: The Baldrige Cybersecurity Excellence Builder (BCEB)
- Lab 3F: Hazard Analysis with PHA/What-if and HAZOP
- Lab 3H: Quality Costs Analysis
- Lab 4D: Hicks Law and the Nature of Choice
- Lab 4E/4F: Ergonomic HMI Design
- Lab 4D/4G: Fitts Law
There are four exams, each of which consists of 8 short-answer questions. Each exam is designed to be completed in a 90-minute session, but if less time is available, the instructor can request can the student choose 5 questions (for a 50-minute exam period) or 6 questions (for a 60-minute exam period).
The student's grade in this course is based on one exam for each module and 8 lab exercises that synthesize the concepts from all modules:
- 15% Exam 1: Introduction to Industrial Control Systems
- 15% Exam 2: Critical Infrastructure & Smart Cities
- 15% Exam 3: Managing Security, Safety, & Risk
- 15% Exam 4: Ergonomics & HMIs
- 40% 8 Labs (5% Each)
- K0002: * Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
- K0004: * Knowledge of cybersecurity principles.
- K0008: Knowledge of applicable business processes and operations of customer organizations.
- K0027: Knowledge of organization's enterprise information security architecture system.
- K0036: Knowledge of human-computer interaction principles.
- K0048: Knowledge of Risk Management Framework (RMF) requirements.
- K0053: Knowledge of measures or indicators of system performance and availability.
- K0054: Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.
- K0084: Knowledge of structured analysis principles and methods.
- K0101: Knowledge of the organization’s enterprise information technology (IT) goals and objectives.
- K0120: Knowledge of how information needs and collection requirements are translated, tracked, and prioritized across the extended enterprise
- K0146: Knowledge of the organization's core business/mission processes.
- K0149: Knowledge of organization's risk tolerance and/or risk management approach.
- K0150: Knowledge of enterprise incident response program, roles, and responsibilities.
- K0154: Knowledge of supply chain risk management standards, processes, and practices.
- K0164: Knowledge of functionality, quality, and security requirements and how these will apply to specific items of supply (i.e., elements and processes).
- K0169: Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.
- K0198: Knowledge of organizational process improvement concepts and process maturity models (e.g., Capability Maturity Model Integration (CMMI) for Development, CMMI for Services, and CMMI for Acquisitions).
- K0245: Knowledge of principles and processes for conducting training and education needs assessment.
- K0246: Knowledge of relevant concepts, procedures, software, equipment, and technology applications.
- K0252: Knowledge of training and education principles and methods for curriculum design, teaching and instruction for individuals and groups, and the measurement of training and education effects.
- K0258: Knowledge of test procedures, principles, and methodologies (e.g., Capabilities and Maturity Model Integration (CMMI)).
- K0267: Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.
- K0309: Knowledge of emerging technologies that have potential for exploitation by adversaries.
- K0329: Knowledge of statistics.
- K0335: Knowledge of current and emerging cyber technologies.
- K0436: Knowledge of fundamental cyber operations concepts, terminology/lexicon (i.e., environment preparation, cyber attack, cyber defense), principles, capabilities, limitations, and effects.
- K0437: Knowledge of general SCADA system components.
- K0511: Knowledge of organizational hierarchy and cyber decision making processes.
- K0612: Knowledge of what constitutes a “threat” to a network.
- S0001: Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
- S0010: Skill in conducting capabilities and requirements analysis.
- S0021: Skill in designing a data analysis structure (i.e., the types of data your test must generate and how to analyze those data).
- S0027: Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.
- S0030: Skill in developing operations-based testing scenarios.
- S0034: Skill in discerning the protection needs (i.e., security controls) of information systems and networks.
- S0038: Skill in identifying measures or indicators of system performance and the actions needed to improve or correct performance, relative to the goals of the system
- S0050: Skill in design modeling and building use cases (e.g., unified modeling language).
- S0060: Skill in writing code in a currently supported programming language (e.g., Java, C++).
- S0085: Skill in conducting audits or reviews of technical systems.
- S0086: Skill in evaluating the trustworthiness of the supplier and/or product.
- S0109: Skill in identifying hidden patterns or relationships.
- S0134: Skill in conducting reviews of systems.
- S0228: Skill in identifying critical target elements, to include critical target elements for the cyber domain.
- S0256: Skill in providing understanding of target or threat systems through the identification and link analysis of physical, functional, or behavioral relationships.
- S0278: Skill in tailoring analysis to the necessary levels (e.g., classification and organizational).
- S0359: Skill to use critical thinking to analyze organizational patterns and relationships.
- A0001: Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.
- A0009: Ability to apply supply chain risk management standards
- A0026: Ability to analyze test data.
- A0027: Ability to apply an organization's goals and objectives to develop and maintain architecture.
- A0030: Ability to collect, verify, and validate test data. NIST SP 800-181 (DRAFT) NICE CYBERSECURITY WORKFORCE FRAMEWORK (NCWF) 93
- A0034: Ability to develop, update, and/or maintain standard operating procedures (SOPs).
- A0035: Ability to dissect a problem and examine the interrelationships between data that may appear unrelated.
- A0040: Ability to translate data and test results into evaluative conclusions.
- A0045: Ability to evaluate/ensure the trustworthiness of the supplier and/or product.
- A0060: Ability to build architectures and frameworks.
- A0064: Ability to interpret and translate customer requirements into operational capabilities.
- A0085: Ability to exercise judgment when policies are not well-defined.
- A0101: Ability to recognize and mitigate cognitive biases which may affect analysis.
- A0106: Ability to think critically.
- A0107: Ability to think like threat actors.
- A0108: Ability to understand objectives and effects.
- A0116: Ability to prioritize and allocate cybersecurity resources correctly and efficiently.
- A0117: Ability to relate strategy, business, and technology in the context of organizational dynamics.
- A0118: Ability to understand technology, management, and leadership issues related to organization processes and problem solving.
- A0119: Ability to understand the basic concepts and issues related to cyber and its organizational impact.
- Basic Data Analysis
- Basic Scripting and Programming (BSP)
- Probability and Statistics
- Policy, Legal, Ethics, and Compliance (PLE)
- Industrial Control Systems (ICS)