A security primer: 8 steps to building a security infrastructure

Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

11/01/2007


Regardless of the age of process equipment, it is very likely connected to the enterprise and in turn to the Internet. Protecting it means establishing and applying security infrastructure throughout, including hardware and software as well as policies and procedures. Controlling physical access to the control system goes hand-in-hand with creating a secure infrastructure.

 

Any system that secures plant assets should follow a “defense in depth” strategy that takes a multilayer approach including the creation of security zones. Here are eight key actions we believe every security effort should apply:

 

  • Create secure architectures. Plan and define zones to divide the facility into secure cells with monitored access points. Communication and data exchange between zones should be strictly monitored and controlled. No direct access to the control system network should be allowed from the outside. Each cell should be capable of operating autonomously. Cell access should be monitored and logged.

  • Establish “demilitarized zones” (DMZs). Experts are using the term DMZ to describe a perimeter network of PCs that support data exchange between the outside and control system. A DMZ quarantines critical operations from contamination, allowing connectivity to PCs for data exchange, but containing all communication inside the DMZ. There are no direct connections to or from any DCS to the outside.

  • Use firewalls. The best known security devices, firewalls typically separate security zones from each other, managing external access to networks inside the zones. Firewalls examine and filter data traffic by certain rules and must be configured carefully to accomplish the intended purpose. They come in a variety of configurations, including dedicated hardware appliances, in routers, or on PCs.

  • Manage security patches carefully. Managing Microsoft security patches for Windows, MSSQL, and the like is necessary in a process automation environment, but also carries special concerns. Risks and consequences of failure are greater in automation areas, so take more care in rolling out patches. Automation and control processes typically must run 24/7. Downtime costs can be high and data loss unrecoverable. Security patches should be tested thoroughly by the supplier or end user before rollout. Consider deployment in redundant architectures to minimize impact on operations by pushing out patch updates without taking a system offline. Use of Microsoft Windows Server Update Services is strongly recommended.

  • Block viruses. Virus scanners are another popular security measure. They are typically placed at access points to filter incoming and outgoing traffic to help secure systems from viruses and other malware. Take care so virus scanners do not impact system performance and that alert messages are directed to appropriate personnel and don’t distract operators.

  • Manage system access appropriately. Adopt a strict philosophy for access management. A roles-based approach grants users and computers the minimum set of access rights required to perform their functions. Manage passwords and permissions centrally. Diplomacy helps in coordinating and establishing appropriate access rights.

  • Apply VPN and encryption methodology. Virtual private network (VPN) technology helps provide secure connections between locations. VPNs assume both ends of the communication are trustworthy sources. The outside support computer has network permissions and cannot access anything inside the plant. Also consider data encryption and server authentication (such as secure socket layers with HTTPS or IPsec).

  • Train employees; provide guidelines. Do not overlook the human element. Develop clear, written security policies. A plant security policy should bring together all disparate facets of an operation, striking a balance between meeting security needs and achieving business goals. Make sure everyone understands the security vision. Be sure that all employees are properly trained, and document that training. Circumstances within an operation are constantly changing. Security policies must be dynamic as well, undergoing review and modification regularly.





No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2015 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
Your leaks start here: Take a disciplined approach with your hydraulic system; U.S. presence at Hannover Messe a rousing success
Hannover Messe 2016: Taking hold of the future - Partner Country status spotlights U.S. manufacturing; Honoring manufacturing excellence: The 2015 Product of the Year Winners
Inside IIoT: How technology, strategy can improve your operation; Dry media or web scrubber?; Six steps to design a PM program
Getting to the bottom of subsea repairs: Older pipelines need more attention, and operators need a repair strategy; OTC preview; Offshore production difficult - and crucial
Digital oilfields: Integrated HMI/SCADA systems enable smarter data acquisition; Real-world impact of simulation; Electric actuator technology prospers in production fields
Special report: U.S. natural gas; LNG transport technologies evolve to meet market demand; Understanding new methane regulations; Predictive maintenance for gas pipeline compressors
Warehouse winter comfort: The HTHV solution; Cooling with natural gas; Plastics industry booming
Managing automation upgrades, retrofits; Making technical, business sense; Ensuring network cyber security
Designing generator systems; Using online commissioning tools; Selective coordination best practices

Annual Salary Survey

Before the calendar turned, 2016 already had the makings of a pivotal year for manufacturing, and for the world.

There were the big events for the year, including the United States as Partner Country at Hannover Messe in April and the 2016 International Manufacturing Technology Show in Chicago in September. There's also the matter of the U.S. presidential elections in November, which promise to shape policy in manufacturing for years to come.

But the year started with global economic turmoil, as a slowdown in Chinese manufacturing triggered a worldwide stock hiccup that sent values plummeting. The continued plunge in world oil prices has resulted in a slowdown in exploration and, by extension, the manufacture of exploration equipment.

Read more: 2015 Salary Survey

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.
This article collection contains several articles on the vital role that compressed air plays in manufacturing plants.
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.
This article collection contains several articles on strategic maintenance and understanding all the parts of your plant.
click me