Security: To defend your control system perimeter, find it first

-- Control Engineering, 7/2/2008

One common security technique is putting firewalls at the perimeter of a control system. This is fine if you can figure out where the perimeter is. As one poor IT technician at a nuclear power plant discovered, the fence may not be where you think it is.

The fact that this incident occurred at the Hatch nuclear power plant probably makes it more interesting, but maybe the same thing could happen at your company. Here’s the story: Last March, a technician was installing a software update on a computer that was considered part of the plant’s business network. Finishing the installation involved a reboot, as is typical. The technician knew that the updated computer was connected to the primary control system, but he didn’t realize how fully integrated the two networks were. When the business computer rebooted, alarms sounded and the reactor went into emergency shutdown. Oops.

What no one seemed to realize was that the control system and this business system computer were configured to synchronize data. The control system saw the interruption of data as a sudden loss of water in the cooling system. Automated safety systems did what they were supposed to do and triggered an emergency shutdown. (Read a more detailed account of the incident.) The control software could have been written to avoid that problem (and probably has been rewritten by now), but that’s not really the issue. The lesson is that systems like this in a plant may be more integrated than you realize, and the line between control system and business system can be blurry.

If you are basing your security architecture on trying to protect the perimeter of your control system, this situation should remind you that drawing the boundary line precisely can be tricky. The frontier is anywhere somebody can get in. That can include points where the business system interconnects, assuming you can find them all. Hopefully you won’t do it the hard way like the poor guy at Hatch. You might also find something like a dial-up modem that was added a few years ago to provide access for a contractor. You might have forgotten that it’s even there, but a hacker scanning all the phone numbers at your company might just find it. Keep an eye on your fences, and watch those reboots.

—Peter Welander, process industries editor, peter.welander@reedbusiness.com,
Process & Advanced Control Monthly
Register here and scroll down to select your choice of free eNewsletters.