A system and a method for securing control systems for critical infrastructure, complex networks and/or industrial processing facilities. Aspects of the invention can include a proximity-based user identification device that generates a computer-readable identification of operators who are in proximity to a control device in the control system and an imaging device that captures a visual likeness of operators in proximity to the control device. A network sensor can read operation data from the control system. An overlay network can interconnect the proximity-based identification device, the imaging device, and the network sensor, and can interface to the control system without modifying the control system. Processing hardware can execute processor-implemented instructions to generate a correlation between at least a portion of the operation data and the control system, the computer-readable identification, and the visual likeness. The processor can then associate the correlation with the portion of the operation data.
STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT
 This invention was made with Government support under Contract DE-AC0576RL01830 awarded by the U.S. Department of Energy. The Government has certain rights in the invention.