A security primer: 8 steps to building a security infrastructure

Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

11/01/2007


Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

 

Any system that secures plant assets should follow a “defense in depth” strategy that takes a multilayer approach including the creation of security zones. Here are eight key actions we believe every security effort should apply:

 

  • Create secure architectures. Plan and define zones to divide the facility into secure cells with monitored access points. Communication and data exchange between zones should be strictly monitored and controlled. No direct access to the control system network should be allowed from the outside. Each cell should be capable of operating autonomously. Cell access should be monitored and logged.

  • Establish “demilitarized zones” (DMZs). Experts are using the term DMZ to describe a perimeter network of PCs that support data exchange between the outside and control system. A DMZ quarantines critical operations from contamination, allowing connectivity to PCs for data exchange, but containing all communication inside the DMZ. There are no direct connections to or from any DCS to the outside.

  • Use firewalls. The best known security devices, firewalls typically separate security zones from each other, managing external access to networks inside the zones. Firewalls examine and filter data traffic by certain rules and must be configured carefully to accomplish the intended purpose. They come in a variety of configurations, including dedicated hardware appliances, in routers, or on PCs.

  • Manage security patches carefully. Managing Microsoft security patches for Windows, MSSQL, and the like is necessary in a process automation environment, but also carries special concerns. Risks and consequences of failure are greater in automation areas, so take more care in rolling out patches. Automation and control processes typically must run 24/7. Downtime costs can be high and data loss unrecoverable. Security patches should be tested thoroughly by the supplier or end user before rollout. Consider deployment in redundant architectures to minimize impact on operations by pushing out patch updates without taking a system offline. Use of Microsoft Windows Server Update Services is strongly recommended.

  • Block viruses. Virus scanners are another popular security measure. They are typically placed at access points to filter incoming and outgoing traffic to help secure systems from viruses and other malware. Take care so virus scanners do not impact system performance and that alert messages are directed to appropriate personnel and don’t distract operators.

  • Manage system access appropriately. Adopt a strict philosophy for access management. A roles-based approach grants users and computers the minimum set of access rights required to perform their functions. Manage passwords and permissions centrally. Diplomacy helps in coordinating and establishing appropriate access rights.

  • Apply VPN and encryption methodology. Virtual private network (VPN) technology helps provide secure connections between locations. VPNs assume both ends of the communication are trustworthy sources. The outside support computer has network permissions and cannot access anything inside the plant. Also consider data encryption and server authentication (such as secure socket layers with HTTPS or IPsec).

  • Train employees; provide guidelines. Do not overlook the human element. Develop clear, written security policies. A plant security policy should bring together all disparate facets of an operation, striking a balance between meeting security needs and achieving business goals. Make sure everyone understands the security vision. Be sure that all employees are properly trained, and document that training. Circumstances within an operation are constantly changing. Security policies must be dynamic as well, undergoing review and modification regularly.





No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Intelligent, efficient PLC programming: Cost-saving programming languages are available now; Automation system upgrades; Help from the cloud; Improving flow control; System integration tips
Smarter machines require smarter systems; Fixing PID, part 3; Process safety; Hardware and software integration; Legalities: Integrated lean project delivery
Choosing controllers: PLCs, PACs, IPCs, DCS? What's best for your application?; Wireless trends; Design, integration; Manufacturing Day; Product Exclusive
PLCs, robots, and the quest for a single controller; how OEE is key to automation solutions.
This article collection contains several articles on improving the use of PID.
Learn how Industry 4.0 adds supply chain efficiency, optimizes pricing, improves quality, and more.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Special report: U.S. natural gas; LNG transport technologies evolve to meet market demand; Understanding new methane regulations; Predictive maintenance for gas pipeline compressors
Cyber security cost-efficient for industrial control systems; Extracting full value from operational data; Managing cyber security risks
Drilling for Big Data: Managing the flow of information; Big data drilldown series: Challenge and opportunity; OT to IT: Creating a circle of improvement; Industry loses best workers, again

(copy 5)