Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

Any system that secures plant assets should follow a “defense in depth” strategy that takes a multilayer approach including the creation of security zones. Here are eight key actions we believe every security effort should apply:

• Create secure architectures. Plan and define zones to divide the facility into secure cells with monitored access points. Communication and data exchange between zones should be strictly monitored and controlled. No direct access to the control system network should be allowed from the outside. Each cell should be capable of operating autonomously. Cell access should be monitored and logged.
• Establish “demilitarized zones” (DMZs). Experts are using the term DMZ to describe a perimeter network of PCs that support data exchange between the outside and control system. A DMZ quarantines critical operations from contamination, allowing connectivity to PCs for data exchange, but containing all communication inside the DMZ. There are no direct connections to or from any DCS to the outside.
• Use firewalls. The best known security devices, firewalls typically separate security zones from each other, managing external access to networks inside the zones. Firewalls examine and filter data traffic by certain rules and must be configured carefully to accomplish the intended purpose. They come in a variety of configurations, including dedicated hardware appliances, in routers, or on PCs.
• Manage security patches carefully. Managing Microsoft security patches for Windows, MSSQL, and the like is necessary in a process automation environment, but also carries special concerns. Risks and consequences of failure are greater in automation areas, so take more care in rolling out patches. Automation and control processes typically must run 24/7. Downtime costs can be high and data loss unrecoverable. Security patches should be tested thoroughly by the supplier or end user before rollout. Consider deployment in redundant architectures to minimize impact on operations by pushing out patch updates without taking a system offline. Use of Microsoft Windows Server Update Services is strongly recommended.
• Block viruses. Virus scanners are another popular security measure. They are typically placed at access points to filter incoming and outgoing traffic to help secure systems from viruses and other malware. Take care so virus scanners do not impact system performance and that alert messages are directed to appropriate personnel and don’t distract operators.
• Manage system access appropriately. Adopt a strict philosophy for access management. A roles-based approach grants users and computers the minimum set of access rights required to perform their functions. Manage passwords and permissions centrally. Diplomacy helps in coordinating and establishing appropriate access rights.
• Apply VPN and encryption methodology. Virtual private network (VPN) technology helps provide secure connections between locations. VPNs assume both ends of the communication are trustworthy sources. The outside support computer has network permissions and cannot access anything inside the plant. Also consider data encryption and server authentication (such as secure socket layers with HTTPS or IPsec).
• Train employees; provide guidelines. Do not overlook the human element. Develop clear, written security policies. A plant security policy should bring together all disparate facets of an operation, striking a balance between meeting security needs and achieving business goals. Make sure everyone understands the security vision. Be sure that all employees are properly trained, and document that training. Circumstances within an operation are constantly changing. Security policies must be dynamic as well, undergoing review and modification regularly.