Cybersecurity in SCADA Engineering

Abstract

Kyberturvallisuus on kasvava huolenaihe valvontaohjelmistoalalla. Monilla yrityksillä tietoturvan tuominen osaksi järjestelmän kehitystyötä on ongelmallista. Opinnäytetyön tarkoitus oli määrittää, dokumentoida ja tuoda kyberturvallisuuteen liittyvät ABB:n minimivaatimukset osaksi projektin kehitysprosessia. Opinnäytetyön aikana luotiin kyberturvallisuusohje, jossa tarvittavat toimenpiteet olivat yksityiskohtaisesti listattu, jotta saataisiin aina standardisoitu lopputulos. Kyberturvallisuusohjeen lisäksi luotiin mallipohjat projektin kyberturvallisuuden seurannalle sekä esimerkki proseduureja tehdas- ja hyväksymistestaukselle.|en=Cybersecurity is a growing concern in the SCADA market and many companies have difficulties adapting the security into the engineering process. The focus of this thesis was to determine, implement and document the needed actions what needs to be taken to fulfil the minimum cybersecurity requirements of a system during project deployment. Minimum cybersecurity requirements were defined by ABB at the business level. As a result, multiple documents were created to standardize the cybersecurity practices during the project. The documentation included a practical guide, a project tracking document and cybersecurity procedures to be included in the factory as well as site acceptance testing.|

Cybersecurity is a growing concern in the SCADA market and many companies have difficulties adapting the security into the engineering process. The focus of this thesis was to determine, implement and document the needed actions what needs to be taken to fulfil the minimum cybersecurity requirements of a system during project deployment. Minimum cybersecurity requirements were defined by ABB at the business level. As a result, multiple documents were created to standardize the cybersecurity practices during the project. The documentation included a practical guide, a project tracking document and cybersecurity procedures to be included in the factory as well as site acceptance testing.