Security topic ICT (e.g. office systems) ICS (e.g. nuclear power station management) Anti-virus Very common. Easily deployed and updated. Users have control over customisation. Anti-virus protection can be asset-based or enterprisebased. Memory requirements and delays in data exchange caused by anti-virus software scans can impact negatively on an ICS system. Organisations can only protect legacy ICS elements with after-market solutions. In an ICS context, anti-virus solutions usually required ‘exclusion’ folders to avoid programs quarantining critical files. Update management Clearly defined, enterprise-wide, remote and automated. Long lead and planning time to successful patch installation; OEM-specific; may (temporarily) halt ICS functionality. The acceptable risk in this regard must be defined. Technology support life cycle 2–3 years, multiple providers, ongoing development and upgrades. 10–20 years, usually same vendor/service provider over the entire life cycle, product end-of-life creates new security threats. Testing and audit methods Use modern (poss. automated) methods. Systems are usually resilient and reliable enough to handle assessments during normal operation. Automated assessment may be unsuitable, e.g. owing to the high degree of individual development. There is a greater probability of failure during testing, so assessments during normal operation tend to be more difficult. Change management Regular and scheduled. Geared to the organisation’s requirements, to minimum/maximum period of use. A complex procedure with a potential impact on the organisation’s business activities. Strategic, individual planning required. Asset classification Common and performed annually. Results drive expenditure/investment. Performed only when necessary/mandatory. Without an inventory, countermeasures may be out of proportion to the importance of the system elements. Incident response and forensics Easily developed and deployed. May be regulatory requirements (data protection) to observe. Focused primarily on system resumption. Forensic procedures are immature. Physical security Ranges from poor (office systems) to excellent (secure data centres). Physical security is typically excellent. Secure software development An integral part of the development process. Historically, ICS have generally been designed as physically isolated systems. As a result, little thought was given to security as an integral part of system development. ICS vendors are maturing, but at a slower rate than in ICT. Core elements of ICS can be difficult to retrofit with security solutions, or none are available. Security compliance General regulatory requirements, depending on sector (and not in all sectors). Specific regulatory guidance, depending on sector (and not in all sectors) Table 1: Differences between ICT and ICS Minimum ICT standard 2018 7