A security primer: 8 steps to building a security infrastructure

Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

11/01/2007


Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

 

Any system that secures plant assets should follow a “defense in depth” strategy that takes a multilayer approach including the creation of security zones. Here are eight key actions we believe every security effort should apply:

 

  • Create secure architectures. Plan and define zones to divide the facility into secure cells with monitored access points. Communication and data exchange between zones should be strictly monitored and controlled. No direct access to the control system network should be allowed from the outside. Each cell should be capable of operating autonomously. Cell access should be monitored and logged.

  • Establish “demilitarized zones” (DMZs). Experts are using the term DMZ to describe a perimeter network of PCs that support data exchange between the outside and control system. A DMZ quarantines critical operations from contamination, allowing connectivity to PCs for data exchange, but containing all communication inside the DMZ. There are no direct connections to or from any DCS to the outside.

  • Use firewalls. The best known security devices, firewalls typically separate security zones from each other, managing external access to networks inside the zones. Firewalls examine and filter data traffic by certain rules and must be configured carefully to accomplish the intended purpose. They come in a variety of configurations, including dedicated hardware appliances, in routers, or on PCs.

  • Manage security patches carefully. Managing Microsoft security patches for Windows, MSSQL, and the like is necessary in a process automation environment, but also carries special concerns. Risks and consequences of failure are greater in automation areas, so take more care in rolling out patches. Automation and control processes typically must run 24/7. Downtime costs can be high and data loss unrecoverable. Security patches should be tested thoroughly by the supplier or end user before rollout. Consider deployment in redundant architectures to minimize impact on operations by pushing out patch updates without taking a system offline. Use of Microsoft Windows Server Update Services is strongly recommended.

  • Block viruses. Virus scanners are another popular security measure. They are typically placed at access points to filter incoming and outgoing traffic to help secure systems from viruses and other malware. Take care so virus scanners do not impact system performance and that alert messages are directed to appropriate personnel and don’t distract operators.

  • Manage system access appropriately. Adopt a strict philosophy for access management. A roles-based approach grants users and computers the minimum set of access rights required to perform their functions. Manage passwords and permissions centrally. Diplomacy helps in coordinating and establishing appropriate access rights.

  • Apply VPN and encryption methodology. Virtual private network (VPN) technology helps provide secure connections between locations. VPNs assume both ends of the communication are trustworthy sources. The outside support computer has network permissions and cannot access anything inside the plant. Also consider data encryption and server authentication (such as secure socket layers with HTTPS or IPsec).

  • Train employees; provide guidelines. Do not overlook the human element. Develop clear, written security policies. A plant security policy should bring together all disparate facets of an operation, striking a balance between meeting security needs and achieving business goals. Make sure everyone understands the security vision. Be sure that all employees are properly trained, and document that training. Circumstances within an operation are constantly changing. Security policies must be dynamic as well, undergoing review and modification regularly.





The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by Control Engineering subscribers. Vote now (if qualified)!
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
Each year, a panel of Control Engineering and Plant Engineering editors and industry expert judges select the System Integrator of the Year Award winners in three categories.
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Maximize ROI with integrated control system approach; Microcontrollers vs. PLCs; Power quality; Accelerate and rewire IIoT; Traits for excellent engineers
HMI effectiveness; Distributed I/O; Engineers' Choice Award finalists; System Integrator advice; Inside Machines
Women in engineering; Engineering Leaders Under 40; PID benefits and drawbacks; Ladder logic; Cloud computing
Programmable logic controllers (PLCs) represent the logic (decision) part of the control loop of sense, decide, and actuate. As we know, PLCs aren’t the only option for making decisions in a control loop, but they are likely why you’re here.
This digital report explains how plant engineers and subject matter experts (SME) need support for time series data and its many challenges.
This article collection contains several articles on how advancements in vision system designs, computing power, algorithms, optics, and communications are making machine vision more cost effective than ever before.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Control room technology innovation; Practical approaches to corrosion protection; Pipeline regulator revises quality programs
Cloud, mobility, and remote operations; SCADA and contextual mobility; Custom UPS empowering a secure pipeline
Infrastructure for natural gas expansion; Artificial lift methods; Disruptive technology and fugitive gas emissions
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me