Plant-floor security, by the numbers
Count the ways to secure your plant-floor data, networks, and operations
By Nancy Bartels, senior editor -- Manufacturing Business Technology, 3/1/2005 7:00:00 AM
Now that connectivity has come to the plant floor and the old black boxes that powered controllers are giving way to commercial off-the-shelf software, questions about securing data on the plant floor are more pressing than ever. Plant-floor security involves IT and the still-critical business of keeping products and employees safe and secure. To do the job right, you need people with expertise in both IT and operations. Getting your arms around security issues is a big job. There are no quick fixes or simple solutions, but there are some basic parameters that can define the territory.
2 separate but equal challenges
-
Security
-
Safety
Security and safety are interrelated issues. In general, you want to keep your people and environment safe and your physical and intellectual property secure. Sometimes the same procedures will do both. Remember that focusing on one of these and not the other leaves you vulnerable.
One truism: Security is about managing risk. You can never make your plant 100-percent secure. The question is, what is the level of risk your company is prepared to accept?
7 false assumptions
-
Security issues on the plant floor are the same as in corporate IT and the front office.
-
Current corporate security policies are all that are needed for the plant.
-
As long as the firewall is okay, we're okay on the plant floor.
-
IT has this all figured out and will take care of it.
-
There are no new issues at the plant level.
-
If there are, I'm in trouble until the new standards and technologies rescue me.
-
Because no one knows about my plant-floor network, I have "security by obscurity."
Source: Rockwell Automation
2 rules of thumb for security strategy
-
You only need to protect things that have value to your business, and you should only apply protection in proportion to the value of the items.
-
Plant-floor security is not a destination, but a continuous process.
5 pillars of a sound security plan
-
People trained in the correct policies and procedures
-
Policies that clearly define what compliance means and how it is to be carried out
-
Processes that define the activities outlined in the policies, including products, tools, and methodologies
-
Procedures that clearly define the steps involved in applying the processes and technologies
-
Products that address your particular security needs
Source: Rockwell Automation
4 top threats and their causes
-
System breakdown that can halt operations—e.g., viruses, worms
-
Data loss due to insufficient or nonexistent backup
-
Information theft due to lack of access control
-
Manipulation of records due to lack of access control and ID procedures
Source: SFW LLC
Eighty-one percent of the respondents to a recent survey by the FBI and the Computer Security Institute said the most likely source of a security breach was inside the company.
3 reasons to be concerned about plant-floor IT security
-
Successful cyber attacks on process and SCADA systems have increased tenfold since 2000.
-
There are between 100 and 500 unreported attacks every year.
-
Half of those attacked experienced losses of more that $1 million.
Source: Cisco Systems
7 reasons why attacks have increased
-
There is more alignment of process control and corporate IT systems.
-
There are more powerful and malicious cyber threats—e.g., worms, viruses, and hackers.
-
Corporate IT security measures often are not applied to process control systems.
-
Demands for access to information continue to increase, so that companies need to be connected to the Internet, supply chain partners, wireless applications, and their own extended enterprises.
-
Intellectual property is becoming more of a competitive advantage.
-
Web services increase application exposure.
-
Lost business opportunity results from disruption, and nonperformance is increasing.
Source: Cisco Systems & Rockwell Automation
The first 5 steps to securing your plant floor (and the rest of your operation)
1. Build awareness. Be the bearer of bad tidings if you must. Let senior management know that security is about more than protecting e-mail from viruses. Start getting your plans and policies in place today.
2. Conduct a risk analysis:
a. What assets are you trying to protect?
b. What is their value?
c. What are the potential threats to these assets?
d. What is the impact of a security breach on these assets?
3. Do a detailed audit:
a. Review present policy documents and reports.
b. Gather "people" information. Who knows what about your security?
c. Test your policies and procedures.
d. Evaluate the results.
e. Prioritize the necessary fixes.
Did your security audit tell you that your plant is an accident waiting to happen? What do you do next?
4. Start building rings of defense around your most critical systems.
5. Implement a business continuity and recovery plan.
Source: Info-Tech Research Group
1 rule of security diplomacy
You and your corporate IT staff will have to work together to ensure plant-floor security. You will have to learn to speak one another's language and recognize one another's concerns and constraints. Plant-floor security is a job you will have to handle together.
7 questions to ask about your facility's security
-
Have I identified the potential threats?
-
Have I conducted background checks on employees, vendors, and other parties?
-
Do I have a system for controlling login names and passwords?
-
Have I implemented policies regarding computer usage and ensured they are followed?
-
Have I considered enterprisewide information encryption?
-
Do I control who has physical access to my servers and computers?
-
Have I trained my employees on security policies and procedures?
Source: SFW LLC
7 more steps to securing plant-floor data
-
Physically mark computer stations as "classified" so it is easy to see if an unauthorized person is trying to access it.
-
Add a security layer, such as keycards, to classified workstations.
-
Physically secure rooms that are hosting classified servers with their own access control systems.
-
Add network security measures, such as firewalls, to classified servers.
-
Ensure passwords and roles are being used appropriately and that passwords are changed on a regular basis.
-
Make sure you back up data regularly. Keep copies off-site. Make sure they are as secure as on-site copies.
-
Keep up with security and patch updates.
Source: SSW LLC
5 steps to sound patch management
-
Future-proof your firewall and virus protection systems. Make sure they are adaptable and capable of meeting the challenge of the next virus out there.
-
Test your patches. Make sure they won't disrupt your processes when installed.
-
Prioritize your patches. Talk to your system vendor. How critical is the patch? Does it have to be installed right now?
-
Adhere to open standards. Don't tweak your system and inadvertently create more security holes.
-
Have a designated patch manager who "owns" the system. Ideally this manager understands both the control and IT environments.
Source: Cisco Systems
2 questions your system should ask potential users
-
Who are you and are you allowed access? (Authorization)
-
Are you allowed to do this procedure from this machine? (Authentication)
3 questions you should ask your system
-
Are you available? Can I do what I need to do when I want to do it?
-
Can you prove I did it? For regulated industries, this documentation is critical for tracking changes.
-
Can you protect my data and my privacy?
Source: Rockwell Automation
