According to a blog post by Eugene Kaspersky, the highest priority for industrial control systems (ISC) is maintaining constant operation, relegating security to second place. In such an “always on” environment, software is updated only after a thorough check for fault-tolerance to ensure that the working processes are not interrupted. And, Kaspersky said, “many companies often simply don’t bother to update ICS at all – leaving it unchanged for decades.”

“Ideally, all ICS software would need to be rewritten, incorporating all the security technologies available and taking into account the new realities of cyber-attacks. Alas, such a colossal effort coupled with the huge investments that would be required in testing and fine-tuning would still not guarantee sufficiently stable operation of systems,” Kaspersky said.

However, according to Kaspersky, a secure operating system could be built into the existing infrastructure, thereby controlling “healthy” existing systems and guaranteeing the receipt of reliable data reports on the systems’ operation.

According to Kaspersky's blog post, the operating system being developed is highly tailored and aimed at solving a specific narrow task. The developers are working on methods of writing software which by design won’t be able to carry out any behind-the-scenes, undeclared activity. Additionally, Kaspersky said, “This is the important bit: the impossibility of executing third-party code, or of breaking into the system or running unauthorized applications on our OS; and this is both provable and testable.”