Cyber-Informed Engineering Principles

CIE Principle 2: Engineered controls

What are engineered controls?

All CIE Principles

How do I select and implement controls to reduce avenues for attack or the damage that could result?

The engineered controls principle embeds protective constraints into the physical process and system architecture to prevent cyber compromise from causing unacceptable outcomes. Rather than relying solely on perimeter defenses or software protections, this principle directs engineers to shape what the system is physically and logically capable of doing, even under adversarial control of its digital technology. This principle emphasizes selecting and implementing controls that block unsafe actions or limit their impact. These controls operate at the process level and remain effective even if digital systems are manipulated. The goal is to ensure that safety, reliability and mission performance do not depend on the integrity of programmable, digital or networked components. For a detailed taxonomy and examples of engineered controls, see the CIE Engineering Controls Database.1

Learn About Engineered Controls

How can I apply this principle?

To apply consequence-focused design, engineering teams should consider the following questions:

1

Given the critical functions and identified high-consequence events for this system, how many are controlled by digital technologies to prevent unacceptable impacts?

2

Where can additional controls be introduced to: (1) eliminate digital risks leading to unacceptable impacts; (2) reduce impact severity; (3) constrain the effects of undesired digital signals; (4) enhance early warning and preparedness; or (5) ensure organizational resilience if impacts occur?

3

How is the effectiveness of engineered controls monitored and maintained across system changes and operational conditions, including scenarios that may degrade control performance (e.g. through undue stress)?

4

How do we validate the effectiveness of engineered controls, especially those that may be affected or circumvented by administrative workarounds?

CIE Principle in Action

Municipal Water Booster Pump Station

A municipal water booster pump station implements cloud-based monitoring and remote start/stop capability to improve operational efficiency.8 Engineers recognize that remote commands introduced by the cloud-based solution could rapidly cycle pumps or force operation outside safe pressure limits. Applying the engineered controls principle, they install a mechanical time-delay relay in the pump control actuation circuit to enforce a minimum off-time between starts, independent of any validation checks in the cloud system or pump controller. Even if an adversary issues rapid start/stop commands through the trusted cloud interface or bypasses controller checks, the relay physically prevents damaging cycling and limits stress on pumps and piping. This nondigital control cannot be subverted through digital manipulation. By embedding this constraint at the process level, the station ensures safe operation does not depend on the integrity of the cloud-based system or controller configuration.

[1] CIE Engineering Controls Database https://github.com/idaholab/CIE_EC_Database
Previous
All principles
Next