Method, device and computer program for monitoring an industrial control system

An apparatus for monitoring an industrial control system, the apparatus comprising:

• an internal sources module executable to collect data from one or more internal sources on the industrial control system;
• an external sources module executable to collect data from one or more external sources that are external to the industrial control system, wherein the data from the one or more internal sources and the one or more external sources are collectively referred to as collected data;
• an aggregation, correlation and interpretation module executable for aggregating, correlating and interpreting the data from the one or more internal and the one or more external sources so as to monitor the security of the industrial control system, the aggregating, correlating and interpretation module generating aggregation data and correlation data;
• wherein the one or more internal sources comprise one or more of:
• a sensor, an agent implemented as a computer program for recording and assessing parameters and events, and a recording means adapted to record data from, instructions, operations, procedures or security events locally on the industrial control system;
• wherein the one or more external sources comprise one or more of:
• security blogs, security discussion source, databases for providing information on threats and security attacks, security evaluation and severity information comprising at least one of Common Vulnerability Scoring System (CVSS), standards, standardization bodies, security best practices, security agencies, security statistics, and information from security software solution providers;
• and
• a computer database configured to store the aggregation data and the correlation data;
• wherein the aggregation, correlation and interpretation module is adapted to generate, for at least two parameters of the collected data, a first graph of one of the at least two parameters during a period and a second graph of data from a critical process during the period, to correlate the first graph and the second graph so as to generate a correlation graph, and to correlate the correlation graph corresponding to each of the at least two parameters so as to generate an interval graph for forecasting security events within the industrial control system based on correlations between data from the one or more internal sources and the one or more external sources over time.

A non-transient computer readable medium comprising a computer program for monitoring an industrial control system, wherein the computer program when executed by a processor is configured to:

• collect within an external sources module data from one or more external sources that are external to the industrial control system;
• collect within an internal sources module data from one or more internal sources on the industrial control system, the data collected from the one or more internal sources and the one or more external sources being collectively referred to as collected data;
• aggregate the collected data within an aggregation correlation and interpretation module to generate aggregated data;
• correlate the aggregated data within the aggregation, correlation and interpretation module by analyzing and interpreting the aggregated data in view of historical aggregated data that was previously collected and aggregated from a computer database so as to monitor the security of the industrial control system;
• store the aggregated data and the correlated data generated by the aggregation, correlation and interpretation module in the computer database;
• wherein collecting the data from the one or more internal sources on the industrial control system comprises collecting data from one or more of:
• a sensor, an agent configured to record and assess parameters and events, and a recording means adapted to record data from instructions, operations, procedures or security events locally on the industrial control system;
• wherein the step of collecting the data from the one or more sources external to the industrial control system comprises collecting data from one or more of:
• security blogs, security discussion sources, databases for providing information on threats and security attacks, security evaluation and severity information comprising at least one of Common Vulnerability Scoring System (CVSS), standards, standardization bodies, security best practices, security agencies, and information from security software solution providers;
• and
• wherein the computer program correlates the aggregated data by, for at least two parameters of the collected data, generating a first graph of one of the at least two parameters during a period and a second graph of data from a critical process during the period, correlating the first graph and the second graph so as to generate a correlation graph, and correlating the correlation graph corresponding to each of the at least two parameters so as to generate an interval graph for forecasting security events within the industrial control system based on correlations between data from the one or more internal sources and the one or more external sources over time.