Securing your industrial control network

Cyber security for industrial networks is rapidly becoming necessary. In recent years, there have been numerous attacks where critical infrastructure, private industry and public sector control networks have been compromised or taken down. Protecting a control network is often more challenging than protecting a traditional office network.


Cyber security for industrial networks is rapidly becoming necessary. In recent years, there have been numerous attacks where critical infrastructure, private industry and public sector control networks have been compromised or taken down.

Protecting a control network is often more challenging than protecting a traditional office network. There is generally much less IT support on the plant floor than in an office. Plant networks also have older equipment running without support and non-patched operating systems. They need to avoid downtime that can occur when installing or updating firewall software or anti-virus programs.

Steps you can take to protect your control networks include setting up a firewall, segmenting the control network from the office network and taking some common-sense security steps.

Firewall protection

Implementing firewall protection secures your control network from unwanted and unnecessary traffic. A network firewall is hardware and/or software designed to protect network devices by inspecting each packet trying to pass through it. It denies or permits passage based on a set of rules.

Firewalls are grouped into categories based on rule complexity and traffic inspection level. These categories include access control lists, stateful inspection and application layer.

Access control list %%MDASSML%% Access control lists (ACLs) are the simplest firewalls. They inspect IP addresses bidirectionally. ACLs may also allow filtering on basic protocol choices such as TCP or UDP. You should be very explicit in setting up your rules. For example, to allow a PLC and an HMI to communicate, you must provide a rule that covers PLC-to-HMI and a rule that covers HMI back to PLC. ACL-based firewalls generally have the least latency because they evaluate only basic IP header information. They are still vulnerable to certain types of attacks such as spoofing.

Stateful firewalls %%MDASSML%% Stateful firewalls add a level of protection beyond ACLs without a significant increase to latency or cost. They still allow bidirectional IP header filtering. They also allow filtering on specific application layer protocols such as http, ftp, Modbus/TCP and EtherNet/IP.

Stateful firewalls also keep track of the connection state of the traffic flowing through them. Unlike ACLs, you don’t need to configure separate rules for your PLC and HMI to talk to each other. Create a rule allowing the PLC to talk to the HMI, and the firewall notes that you established a connection to the HMI’s IP address. The stateful firewall can also protect against spoofing and other attacks where invalid IP addressing is used.

Application layer firewalls %%MDASSML%% An application layer allows deep packet inspection; you also see what the packet contains, allowing you to filter out certain types of content within otherwise valid packets. However, the inherent latency is not compatible with typical industrial applications, where tens of milliseconds can make a difference.

Control network segmentation

Segmenting your control network from the office network provides further protection. This is done by using a router. Available for less than $1,000, a router keeps broadcast traffic such as ARPs off the control network. Of course, the router still allows communication between the control and office networks, but it will allow you to manage it better.

Common sense

Finally, don’t forget to take simple security precautions such as:

  • Using strong passwords (6+ character, mix of letters and numbers)

  • Auditing who has access and to what on the network

  • Logging any configuration changes to verify who is doing what.

    • Treat access to your control network the same way you treat access to your credit card information; your network will be much more secure.

      Securing your network is not a one-time task; it is an on-going process that you should revisit frequently to keep up with emerging threats. Take the steps needed to protect your network to ensure that your data, processes and business are safe.


      <table ID = 'id1120875-0-table' CELLSPACING = '0' CELLPADDING = '2' WIDTH = '100%' BORDER = '0'><tbody ID = 'id1120886-0-tbody'><tr ID = 'id1120888-0-tr'><td ID = 'id1120890-0-td' CLASS = 'table' STYLE = 'background-color: #EEEEEE'> Author Information </td></tr><tr ID = 'id1121353-3-tr'><td ID = 'id1121355-3-td' CLASS = 'table'> Dan Schaffer is a product marketing lead specialist for Phoenix Contact. He has more than 10 years experience as a network engineer, specializing in troubleshooting and design. </td></tr></tbody></table>

No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2015 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
Safer human-robot collaboration; 2017 Maintenance Survey; Digital Training; Converting your lighting system
IIoT grows up; Six ways to lower IIoT costs; Six mobile safety strategies; 2017 Salary Survey
2016 Top Plant; 2016 Best Practices on manufacturing progress, efficiency, safety
Mobility as the means to offshore innovation; Preventing another Deepwater Horizon; ROVs as subsea robots; SCADA and the radio spectrum
Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Big Data and bigger solutions; Tablet technologies; SCADA developments
Automation modernization; Predictive analytics enable open connectivity; System integration success; Automation turns home brewer into brew house
Commissioning electrical systems; Designing emergency and standby generator systems; Paralleling switchgear generator systems
Natural gas for tomorrow's fleets; Colleges and universities moving to CHP; Power and steam and frozen foods

Annual Salary Survey

Before the calendar turned, 2016 already had the makings of a pivotal year for manufacturing, and for the world.

There were the big events for the year, including the United States as Partner Country at Hannover Messe in April and the 2016 International Manufacturing Technology Show in Chicago in September. There's also the matter of the U.S. presidential elections in November, which promise to shape policy in manufacturing for years to come.

But the year started with global economic turmoil, as a slowdown in Chinese manufacturing triggered a worldwide stock hiccup that sent values plummeting. The continued plunge in world oil prices has resulted in a slowdown in exploration and, by extension, the manufacture of exploration equipment.

Read more: 2015 Salary Survey

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.
Motion control advances and solutions can help with machine control, automated control on assembly lines, integration of robotics and automation, and machine safety.
Compressed air plays a vital role in most manufacturing plants, and availability of compressed air is crucial to a wide variety of operations.
Maintenance Manager; California Oils Corp.
Associate, Electrical Engineering; Wood Harbinger
Control Systems Engineer; Robert Bosch Corp.
click me