Security: To defend your control system perimeter, find it first
Is your control system integrated with IT networks more than you realize? Don't find out the hard way.
One common security technique is putting firewalls at the perimeter of a control system. This is fine if you can figure out where the perimeter is. As one poor IT technician at a nuclear power plant discovered, the fence may not be where you think it is.
The fact that this incident occurred at the Hatch nuclear power plant probably makes it more interesting, but maybe the same thing could happen at your company. Here’s the story: Last March, a technician was installing a software update on a computer that was considered part of the plant’s business network. Finishing the installation involved a reboot, as is typical. The technician knew that the updated computer was connected to the primary control system, but he didn’t realize how fully integrated the two networks were. When the business computer rebooted, alarms sounded and the reactor went into emergency shutdown. Oops.
What no one seemed to realize was that the control system and this business system computer were configured to synchronize data. The control system saw the interruption of data as a sudden loss of water in the cooling system. Automated safety systems did what they were supposed to do and triggered an emergency shutdown. ( Read a more detailed account of the incident .) The control software could have been written to avoid that problem (and probably has been rewritten by now), but that’s not really the issue. The lesson is that systems like this in a plant may be more integrated than you realize, and the line between control system and business system can be blurry.
If you are basing your security architecture on trying to protect the perimeter of your control system, this situation should remind you that drawing the boundary line precisely can be tricky. The frontier is anywhere somebody can get in. That can include points where the business system interconnects, assuming you can find them all. Hopefully you won’t do it the hard way like the poor guy at Hatch. You might also find something like a dial-up modem that was added a few years ago to provide access for a contractor. You might have forgotten that it’s even there, but a hacker scanning all the phone numbers at your company might just find it. Keep an eye on your fences, and watch those reboots.
—Peter Welander, process industries editor, PWelander@cfemedia.com ,
Process & Advanced Control Monthly
Register here and scroll down to select your choice of free eNewsletters .
Case Study Database
Get more exposure for your case study by uploading it to the Plant Engineering case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.
These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.
Click here to visit the Case Study Database and upload your case study.
2012 Salary Survey
In a year when manufacturing continued to lead the economic rebound, it makes sense that plant manager bonuses rebounded. Plant Engineering’s annual Salary Survey shows both wages and bonuses rose in 2012 after a retreat the year before.
Average salary across all job titles for plant floor management rose 3.5% to $95,446, and bonus compensation jumped to $15,162, a 4.2% increase from the 2010 level and double the 2011 total, which showed a sharp drop in bonus.