Protect sensitive systems by taking them offline

Manufacturers need to understand their process and disconnect the “crown jewels" to protect their systems from serious damage.

04/01/2017


www.isssource.com“Today, digital means connected,” said Marty Edwards, director of the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the Department of Homeland Security (DHS) during his keynote address last week at the ARC Advisory Group’s Industry Forum in Orlando, FL. “Everything is connected to everything. If it isn’t connected, it will be.”

So, what Edwards, a longtime security expert with DHS and before, said next seems a bit surprising, but also realistic. No, it is not about throwing as much technology as possible at the issue, it is the exact opposite to a degree. “Now that we are connected, we have to think of security. The two don’t really work together,” he said.

In this day and age of connected everything, manufacturers need to understand their process and disconnect the “crown jewels.” Courtesy: Luca Bravo, UnsplashThat is where what Edwards calls cyber informed engineering comes into play. “Find the most critical functions; find that basic function and take it off line,” he said. Think about safety systems. With some safety systems becoming more digitalized there are shut down functions that once you push it, it stays shut down. That could be good or bad, depending on the process and the situation. Because once the process shuts down, a reboot is in order.

That is why, he said, the user needs to “look at functions and find the one or two areas that could be a problem. We do need to take care of those life safety functions.”

By taking those vital “crown jewel” functions off line, that does not absolve anyone of also have a security program. “You still need to do basic cyber security functions,” he said. Find out the vital parts of the process and protect it. While he is advocating taking certain systems offline, he is not pushing for an air gapped environment.

“Air gap does not necessarily work,” he said. “Air gapped often means neglected.” Edwards is also not giving up on today’s technology. “Ten years ago you could not use IT technology (in an OT environment) because it would break,” he said. “I think there is quite a bit of IT or IIoT (Industrial Internet of Things) security products right now. I think that is a good thing for industrial security. Overall this is a good message.”

But vulnerabilities exist and there is a danger point for some areas. He listed the medical device sector as a hot button. There are devices implanted in patients and then connect to a device sitting on a bedside table that also sends information back to a doctor’s office. What is the potential for something happening if the device is not secure?

That means users need to understand security and have a basic plan of attack. “At least do some separation, segment, do due diligence, patching, perimeter control, train your people, do logging,” he said. When it comes to security, the reality of it all is if a bad guy wants to get in, it doesn’t really matter what you have done; if you face a nation state, they will figure out how to get in.

That means in the end, security is all about understanding risk management and getting a firm grip on what you have and what you need to protect, while also understanding the massive amount of surface area a manufacturer needs to protect. On top of that, no one can afford to protect everything, plus not everything needs heavy duty protection.

“You can’t protect everything,” Edwards said, “it won’t work."

Gregory Hale is the editor and founder of Industrial Safety and Security Source (ISSSource.com), a news and information Website covering safety and security issues in the manufacturing automation sector. This content originally appeared on ISSSource.com. ISSSource is a CFE Media content partner. Edited by Joy Chang, CFE Media, jchang@cfemedia.com.

ONLINE extra

See related stories from ISSSourced linked below



No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2015 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
Prescriptive maintenance; Hannover Messe 2017 recap; Reduce welding errors
Safety standards and electrical test instruments; Product of the Year winners; Easy and safe electrical design
Safer human-robot collaboration; 2017 Maintenance Survey; Digital Training; Converting your lighting system
Mobility as the means to offshore innovation; Preventing another Deepwater Horizon; ROVs as subsea robots; SCADA and the radio spectrum
Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Big Data and bigger solutions; Tablet technologies; SCADA developments
Automation modernization; Predictive analytics enable open connectivity; System integration success; Automation turns home brewer into brew house
Commissioning electrical systems; Designing emergency and standby generator systems; Paralleling switchgear generator systems
Natural gas for tomorrow's fleets; Colleges and universities moving to CHP; Power and steam and frozen foods

Annual Salary Survey

Before the calendar turned, 2016 already had the makings of a pivotal year for manufacturing, and for the world.

There were the big events for the year, including the United States as Partner Country at Hannover Messe in April and the 2016 International Manufacturing Technology Show in Chicago in September. There's also the matter of the U.S. presidential elections in November, which promise to shape policy in manufacturing for years to come.

But the year started with global economic turmoil, as a slowdown in Chinese manufacturing triggered a worldwide stock hiccup that sent values plummeting. The continued plunge in world oil prices has resulted in a slowdown in exploration and, by extension, the manufacture of exploration equipment.

Read more: 2015 Salary Survey

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.
Featured articles highlight technologies that enable the Industrial Internet of Things, IIoT-related products and strategies to get data more easily to the user.
Compressed air plays a vital role in most manufacturing plants, and availability of compressed air is crucial to a wide variety of operations.
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.
Maintenance Manager; California Oils Corp.
Associate, Electrical Engineering; Wood Harbinger
Control Systems Engineer; Robert Bosch Corp.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me