A security primer: 8 steps to building a security infrastructure

Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

11/01/2007


Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

 

Any system that secures plant assets should follow a “defense in depth” strategy that takes a multilayer approach including the creation of security zones. Here are eight key actions we believe every security effort should apply:

 

  • Create secure architectures. Plan and define zones to divide the facility into secure cells with monitored access points. Communication and data exchange between zones should be strictly monitored and controlled. No direct access to the control system network should be allowed from the outside. Each cell should be capable of operating autonomously. Cell access should be monitored and logged.

  • Establish “demilitarized zones” (DMZs). Experts are using the term DMZ to describe a perimeter network of PCs that support data exchange between the outside and control system. A DMZ quarantines critical operations from contamination, allowing connectivity to PCs for data exchange, but containing all communication inside the DMZ. There are no direct connections to or from any DCS to the outside.

  • Use firewalls. The best known security devices, firewalls typically separate security zones from each other, managing external access to networks inside the zones. Firewalls examine and filter data traffic by certain rules and must be configured carefully to accomplish the intended purpose. They come in a variety of configurations, including dedicated hardware appliances, in routers, or on PCs.

  • Manage security patches carefully. Managing Microsoft security patches for Windows, MSSQL, and the like is necessary in a process automation environment, but also carries special concerns. Risks and consequences of failure are greater in automation areas, so take more care in rolling out patches. Automation and control processes typically must run 24/7. Downtime costs can be high and data loss unrecoverable. Security patches should be tested thoroughly by the supplier or end user before rollout. Consider deployment in redundant architectures to minimize impact on operations by pushing out patch updates without taking a system offline. Use of Microsoft Windows Server Update Services is strongly recommended.

  • Block viruses. Virus scanners are another popular security measure. They are typically placed at access points to filter incoming and outgoing traffic to help secure systems from viruses and other malware. Take care so virus scanners do not impact system performance and that alert messages are directed to appropriate personnel and don’t distract operators.

  • Manage system access appropriately. Adopt a strict philosophy for access management. A roles-based approach grants users and computers the minimum set of access rights required to perform their functions. Manage passwords and permissions centrally. Diplomacy helps in coordinating and establishing appropriate access rights.

  • Apply VPN and encryption methodology. Virtual private network (VPN) technology helps provide secure connections between locations. VPNs assume both ends of the communication are trustworthy sources. The outside support computer has network permissions and cannot access anything inside the plant. Also consider data encryption and server authentication (such as secure socket layers with HTTPS or IPsec).

  • Train employees; provide guidelines. Do not overlook the human element. Develop clear, written security policies. A plant security policy should bring together all disparate facets of an operation, striking a balance between meeting security needs and achieving business goals. Make sure everyone understands the security vision. Be sure that all employees are properly trained, and document that training. Circumstances within an operation are constantly changing. Security policies must be dynamic as well, undergoing review and modification regularly.





No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2013 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
The true cost of lubrication: Three keys to consider when evaluating oils; Plant Engineering Lubrication Guide; 11 ways to protect bearing assets; Is lubrication part of your KPIs?
Contract maintenance: 5 ways to keep things humming while keeping an eye on costs; Pneumatic systems; Energy monitoring; The sixth 'S' is safety
Transport your data: Supply chain information critical to operational excellence; High-voltage faults; Portable cooling; Safety automation isn't automatic
Case Study Database

Case Study Database

Get more exposure for your case study by uploading it to the Plant Engineering case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.

These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.

Click here to visit the Case Study Database and upload your case study.

Maintaining low data center PUE; Using eco mode in UPS systems; Commissioning electrical and power systems; Exploring dc power distribution alternatives
Synchronizing industrial Ethernet networks; Selecting protocol conversion gateways; Integrating HMIs with PLCs and PACs
Why manufacturers need to see energy in a different light: Current approaches to energy management yield quick savings, but leave plant managers searching for ways of improving on those early gains.

Annual Salary Survey

Participate in the 2013 Salary Survey

In a year when manufacturing continued to lead the economic rebound, it makes sense that plant manager bonuses rebounded. Plant Engineering’s annual Salary Survey shows both wages and bonuses rose in 2012 after a retreat the year before.

Average salary across all job titles for plant floor management rose 3.5% to $95,446, and bonus compensation jumped to $15,162, a 4.2% increase from the 2010 level and double the 2011 total, which showed a sharp drop in bonus.

2012 Salary Survey Analysis

2012 Salary Survey Results

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.