Patent ID: 9298917
Filing Date: 2016-03-29
CPC Classification: G06F

Claim Text:
1. A method of operating a Supervisory Control and Data Acquisition (SCADA) element in a first security mode defined by a first security policy, the SCADA element included in a SCADA system, comprising: monitoring applications, processes, and tasks that access a processor of the SCADA element by a SCADA element security monitor that is unique to the SCADA element and is distinct from a system security monitor that is associated with a system security server of the SCADA system, wherein the SCADA element security monitor monitors the SCADA element alone in a manner unique to the SCADA element security monitor while the system security monitor monitors each SCADA element included in the SCADA system via the system security server, wherein the SCADA element security monitor is configured to detect malicious code that is uniquely tailored to attack the SCADA element, and wherein the system security monitor alone is insufficient in detecting the malicious code; determining one or more violations of the first security policy by a violating application, process, or task associated with the malicious code that accesses the processor of the SCADA element the determining being performed by the SCADA element security monitor unique to the SCADA element, wherein the first security policy is stored on the SCADA element and is unique to the SCADA element and wherein the first security policy is configured to trigger a graduated action that is customized to prevent the malicious code from tampering with the processor of the SCADA element; and taking the graduated action pursuant to the first security policy in response to the detection of one or more violations of the first security policy.