Abstract: A method includes establishing, using a connection policy at a first device, a security association with a second device of an industrial process control and automation system. The method also includes, once the security association is established, activating a process data policy at the first device. The security association is established during first and second types of negotiations. The process data policy is activated during the second type of negotiation without the first type of negotiation. The second type of negotiation is faster than the first type of negotiation. The connection policy defines a communication channel between the devices using a non-process communication port of the first device. The process data policy defines a communication channel between the devices for real-time industrial process data. The first type of negotiation could include an IKE main mode negotiation, and the second type of negotiation could include an IKE quick mode negotiation.

Abstract: This disclosure provides systems and methods for prediction of potential cyber security threats and risks in an industrial control system using predictive cyber analytics. A method includes receiving, by a risk manager system, real-time data from a plurality of connected devices. The method includes creating, by the risk manager system, a data model based on the real-time data. The method includes analyzing, by the risk manager system, the data model to identify potential current threats. The method includes predicting, by the risk manager system, potential threats. The method includes notifying a user, by the risk manager system, of the potential threats.

Abstract: A method includes identifying a plurality of elements in a process control system that uses a process value from a field device. The method also includes identifying an aggregate control connection status of the field device by (i) determining whether one or more of the elements can use a manual value in place of the process value, (ii) determining whether one or more other elements in the plurality can use a user configured value, and (iii) evaluating a logic expression based on results of the determining in (i) and (ii). The method further includes determining whether the field device is available to be taken offline based on the aggregate control connection status. In addition, the method includes generating a notification based on the determination of whether the field device is available to be taken offline.

Abstract: A method includes establishing, using a connection policy at a first device, a security association with a second device of an industrial process control and automation system. The method also includes, once the security association is established, activating a process data policy at the first device. The security association is established during first and second types of negotiations. The process data policy is activated during the second type of negotiation without the first type of negotiation. The second type of negotiation is faster than the first type of negotiation. The connection policy defines a communication channel between the devices using a non-process communication port of the first device. The process data policy defines a communication channel between the devices for real-time industrial process data. The first type of negotiation could include an IKE main mode negotiation, and the second type of negotiation could include an IKE quick mode negotiation.

Abstract: A method includes identifying a plurality of elements in a process control system that uses a process value from a field device. The method also includes identifying an aggregate control connection status of the field device by (i) determining whether one or more of the elements can use a manual value in place of the process value, (ii) determining whether one or more other elements in the plurality can use a user configured value, and (iii) evaluating a logic expression based on results of the determining in (i) and (ii). The method further includes determining whether the field device is available to be taken offline based on the aggregate control connection status. In addition, the method includes generating a notification based on the determination of whether the field device is available to be taken offline.