RIICS: Risk Based IICS Segmentation Method

Abstract

Nowadays, one of the major challenges in industrial business world is integrating industrial control systems (ICS) with corporate systems (IT) and keeping the integrated system secured. Connecting this two totally different networks has numerous benefits and advantages, but introduces several security problems. Defense-in-depth is one of the most important security measures that should be applied to integrated ICS systems. This security technique consists essentially of “Segmentation” and “Segregation”. Segmentation of an integrated ICS may be based on various types of characteristics such as technical characteristics, business impact, risk levels or other requirements defined by the organization. This paper presents RIICS (Risk based IICS Segmentation) a new segmentation method that aims to simplify security zones identification by focusing on systems characteristics that are really relevant for segmentation especially technical industrial specificities and risk.