Ensuring a Safe, Secure HMI
At the HMI level, the relationship between safety and security is fundamental to optimizing system performance.
Peter Cleaveland for Control Engineering -- Control Engineering, 10/1/2006
|
When it comes to human machine interfaces (HMIs), the distinction between safety and security is often well defined. Safety refers to “the control that’s built into the PLCs and the safety interlocks,” says Steven Garbrecht, marketing program manager for Wonderware’s infrastructure and platform products. “It is designed into the control programs.”
Security, on the other hand, is concerned with people breaking into a control system to steal information or cause damage. The two areas are addressed in different ways. Yet when it comes to an HMI, safety and security overlap.
Proper safety design prevents operators from doing anything that could cause injury or damage a product or piece of equipment, and enables them to act in time to prevent such an occurrence. Consider the December 1984 disaster in which an out-of-control chemical reaction at a Union Carbide plant in Bhopal, India, caused the release of tons of methyl isocyanate, killing thousands of people and sickening many more. There is disagreement as to whether plant safety systems were working, and Union Carbide’s position is that the leak “could only have been caused by deliberate sabotage. ”Others strongly disagree.
During the March 1979 accident at the nuclear power plant at Three Mile Island, PA, plant operators did not know that a vital relief valve had remained open despite an indication that it was closed. They later received incorrect information about the level of water in the reactor. During the subsequent investigation, the question of sabotage was ruled out, and it became apparent that had the operators received correct information, they would have been able to prevent the situation from getting out of hand.
Keeping controlCertainly there is no shortage of outside agents wishing to cause harm. Rich Clark, Information Security (Infosec) Analyst at Wonderware, in a presentation entitled “Control System Security Guidance,” lists 17, ranging from disaffected staff to common criminals to organized crime to nation states and governments. There are, he says, facilities that he will not identify, “but they do have targeted attacks every single day.”
From an HMI standpoint, says Garbrecht, there are three primary scenarios: “One is somebody external to the company coming in through firewalls, coming in through the network and doing something with the HMI. The second one is somebody within the company that wants to do something malicious for whatever reason. The third would be somebody who’s not trying to be malicious, does work for the company, but is just doing something they shouldn’t be doing and is making a mistake or causing security or some kind of problem in the process.”
Companies can get into trouble, says Clark, by assigning the job of securing a control system to the IT department. IT people seek security by isolating machines from each other, he notes, to keep people who are surfing the Web and may be picking up viruses in the process from infecting other parts of the enterprise. This method works in the IT domain, but it sacrifices ease of communication between machines and it is incapable of real-time performance.
When control systems are designed, continues Clark, “the machines are designed to talk to one another unhindered. Most machines in a control system environment are both servers and clients, so the IT client server model is not accurate there," says Clark. The way to secure a control system, he points out, is to put it behind a protective wall, with close control of all traffic into and out of the protected space.
All communications between the control system and the corporate system must go through firewalls. One California-based biopharmaceutical company recently installed a new system for handling historical data in accordance with 21 CFR 11. All data related to process upsets and events are kept in servers and available to those who need it, but vital plant data and control information are carried on a series of networks completely isolated from the corporate system.
More than philosophyClark calls this philosophy “having limited threat vectors.” An ideal secure control system he says:
- is isolated from all threats, including corporate business enterprises;
- is layered with aggressive anti-penetration devices;
- has only one point of ingress/egress;
- contains all the system automation within a secure bubble; and
- allows each trusted machine within the enterprise to have unimpeded, unlimited access to any other trusted machine.
Microsoft Corp. calls this security model “domain isolation.” GE Fanuc has built such security features into version 3.5 of its iFIX software with its “Application Validator Utility.” This software tool automatically documents any changes made to system files or utilities, reducing the likelihood that installations will inadvertently or intentionally be compromised.
People with the best of intentions can create hazards, warns Joe Quigg, vice president of engineering, Systek Automated Controls (previously corporate controls engineering manager, International Automation). “A lot of the times in legacy systems people were unguarded and unsupervised when they were making changes and alterations,” he says. “There was a lack of documentation, and when people alter systems and don’t document things, there’s no accountability.” Many legacy systems, he continues, may contain hard-wired relay logic “where somebody could open up a control panel and bypass something if they wanted to on purpose.”
A properly designed modern system, he continues, is divided into two parts, “the standard, everyday control programs that will run the process are open architecture, whereas the safety portion—the section deemed to be dangerous if altered—is locked down. Only certain people, given the correct password, training, and instructions can actually alter [it].”
| For more information, visit: | ||
| www.boschrexroth.com | www.gefanuc.com | www.invensys.com |
| www.systek.com | www.wonderware.com | |
|
View All Blogs
Now Playing:
