ISC-CERT Issues Solar Magnetic Storm Advisory

Friday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) issued an advisory on the effects that may be seen on industrial control systems when an energetic solar magnetic storm produces secondary electrical effects in Earth’s atmosphere. While not specifically addressed in this advisory, it is clear that similar effects can be expected in the electronic systems associated with many security systems employed at high risk chemical facilities.

Solar Weather

The advisory provides a brief description of the events on the Sun’s surface that provide the energy for these physical effects found in our atmosphere. The advisory describes three different types of solar events that are associated with sunspot activity:

• Powerful bursts of light-speed radiation (X-rays, UV-rays, gamma rays and radio-frequency rays) that arrive within 8 minutes of solar flare eruption.

• Solar proton events involving high-energy cosmic rays (protons and ions) that arrive about an hour after the solar flare eruption.

• Coronal Mass Ejections (CME) of large clouds of charged plasma containing embedded magnetic fields that can arrive 18 hours or more after the solar flare eruption.

The National Ocean and Atmospheric Administration’s (NOAA) Space Weather Prediction Center [Updated Link, 07-06-17 0948 EDT] is responsible for providing daily solar weather forecasts as well as alerts and advisories for solar flare and CME events that could have Earth based effects.

Control System Interference

The advisory describes three different ways that these solar disturbances can interfere with the operations of industrial control systems. Those types of interference are:

• Radio Interference
• Electrical Grid Interference
• Pipeline Interference

General mitigation measures are outlined for these different ways that solar weather can interfere with ICS operations.

Facilities need to look at their potential exposure to these types of effects on their individual control systems. This would be done as part of the general vulnerability assessment done on their control systems. Those with the highest potential exposure to the solar weather effects need to insure that they monitor the daily solar weather forecasts.