Control systems' operational security has historically been defined by the industry, as the level of reliability of the system to operate safely and efficiently (p. 212). He noted that security problems arise because of an increasing dependency on automation, industrial control systems, insecure connectivity to external networks, as well as the usage of technologies with known vulnerabilities among a host of other issues. .
Some control system technologies have been found to have only limited security and are often only enabled if the administrator is aware of the capability, or the security does not impede the process; however many popular control system communications protocols are devoid of basic security functionality. With some more modern systems, vulnerabilities also include hostile mobile code such as malicious active content involving JavaScript, applets, VBScript, and Active-X. With a successful intrusion into industrial control system networks come new issue such as reverse engineering of control system protocols, attacks on operator consoles, and unauthorized access into trusted peer networks and remote facilities. To fully translate information security and information assurance into the control systems realm, one must understand the key differences between traditional IT architectures and industrial control systems technology.
Kundu (2009) explained that their theory prompted an increase of threats of information security breaches. The historic database security contrivances are simply not protective against the threats that occur daily. One of the components that have association with the defense in depth system is the Intrusion detection system (IDS) which can be used to detect the harmful intrusions once any information has been compromised. If an attack causes one security mechanism to fail, other mechanisms may still provide the necessary security to protect the system.
