SIEM: policy-based monitoring of SCADA systems

Security Information and Event Management (SIEM) systems work on SCADA systems by observing and reacting to the dynamic security-related events of the target automation system. These events are created by collecting/filtering raw logs maintained by its subcomponents. Preferably, logging items are attached with synchronized timestamps. Specific data of security-related event can be correlated and analyzed as security measures of the SCADA system. Possible correlation rules represent the power of SIEM system for handling security dynamics. A SIEM system can help to recognize security breach in a short time and optionally can react to the breach automatically. SIEM systems are able to monitor the system’s residual risks, while continuously track the deployed security controls and measure their effectiveness. In this paper, we proposed the common requirements of a SIEM system and discussed its important enhancements within the context of SCADA systems. The SIEM system can be supported by the overall security model and designed in a model-driven manner. At last, this paper proposes a preliminary model of correlation rules.