Talk to me: Security in action, or inaction

When it comes time to talk about security plans, it becomes so easy to cry the proverbial “Wolf!” “Everyone will be hit. You are playing with fire. Disaster is just around the corner.” The cries are tedious and you can do it so many times that after awhile it just becomes background noise.

04/25/2011


When it comes time to talk about security plans, it becomes so easy to cry the proverbial “Wolf!.”

“Everyone will be hit. You are playing with fire. Disaster is just around the corner.” The cries are tedious and you can do it so many times that after awhile it just becomes background noise.

But the question needs asking: Are manufacturers fully engaged in the pursuit of securing their systems – and plants – to help increase uptime, or have they let yesterday’s news just fade away?

It is easy to understand. Users could feel, “Yes, Stuxnet was interesting, but that was a focused shot from the good guys firing against the bad guys. Iran’s nuclear system was a threat and someone did something about it,” a manufacturer could think.

OK, that line of thinking is fine and some will follow it. But it really doesn’t wash. What really showed in this very focused assault was the plain and simple fact industrial control systems are open to attack. Remember, when you are thinking about your risk assessment, this is all about keeping plants up and running so the company can produce product and make money.

“(Users) will have to see the shotgun approach compared to the sniper shot that happened with Stuxnet,” said Rick Kaun, director of network security solutions for Matrikon.

Now it is time for the industry to stare down both barrels of the shotgun. Just take a look at the reports of the SCADA system vulnerabilities out there.

Italian security specialist Luigi Auriemma, who mainly focuses on detecting holes in games and media players, released a list of 34 vulnerabilities in SCADA products by some major players: Siemens Tecnomatix (FactoryLink), ICONICS (Genesis 32 and 64), 7-Technologies (IGSS) and DATAC (RealWin).

Then another list of vulnerabilities came out. Name players: Atvise SCADA; Control Microsystems ClearScada; DataRate SCADA WebControl and RuntimeHost; Indusoft SCADA Webstudio; ITS scada; Automated Solutions Modbus/TCP OPC Server; BACnet OPC client Advantech Studio Web server; BroadWin WebAccess (also sold as Advantech); Ecava IntegraXor.

Yes, most of the companies are patching the vulnerabilities, but how quickly will that happen at the plant level and what other holes are out there from other companies that no one has even tried to crack yet?

These vulnerabilities could affect anyone at any plant. Maybe that is crying “Wolf!” once again, but it is true. Just what will it take for companies to focus on generating a thorough security plan that everyone in the organization is aware of?

That answer is difficult to answer as the mindset right now when it comes to security is very reactive and not proactive. It is kind of like the days of reacting to an incident before predictive maintenance became a force. See something happening and quickly react. That compares to seeing a trend occurring and knowing you will need to fix something in a couple of weeks. While security doesn’t really work that way, the point is the mindset has to change.

That change has to start from the top. In a study sponsored by sponsored by Q1 Labs and conducted by the Ponemon Institute entitled “State of IT Security: Study of Utilities & Energy Companies” of the 291 security practitioners who responded, 71 percent said their companies’ top executives do not understand or appreciate the value of information-technology security.

That seems like it may be an uphill fight, but in the wake of the Stuxnet attack and the recent SCADA vulnerabilities alerts, there are some companies that just seem to get it. They are now taking part in creating a full blown security solution knowing they will be ready for the next attack.

Others are just continuing along their way, not fully understanding what lies around the next corner. What else will it take to get manufacturers fully engaged?

Eric Byres, chief technology officer at Byres Security feels one approach is through the standards process like ISA99’s security standard.

“The ISA99 Gap Analysis task group is making progress in determining how the ISA and IEC (the International Electrotechnical Commission) standards will have to change to address something like Stuxnet. Better standards will probably make more of a difference than anything else over the long run.”

Standards work in one approach, but education over time also helps.

“At the end of the day, there needs to be a culture change, but it takes time,” Kaun said. “Just look at the emergence of safety cultures. It takes time to get everybody to accept changes. Look at safety belts and smoking. Until security becomes a part of the culture on a day to day basis, it will be a daily battle. Eventually over time it should become a part of the culture.”

Yes, a culture change does take time, but in the meantime let’s get to work creating a plan of attack to keep systems up and running. That will keep the wolves at bay.



No comments
The Top Plant program honors outstanding manufacturing facilities in North America. View the 2013 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
The Leaders Under 40 program features outstanding young people who are making a difference in manufacturing. View the 2013 Leaders here.
The new control room: It's got all the bells and whistles - and alarms, too; Remote maintenance; Specifying VFDs
2014 forecast issue: To serve and to manufacture - Veterans will bring skill and discipline to the plant floor if we can find a way to get them there.
2013 Top Plant: Lincoln Electric Company, Cleveland, Ohio
Case Study Database

Case Study Database

Get more exposure for your case study by uploading it to the Plant Engineering case study database, where end-users can identify relevant solutions and explore what the experts are doing to effectively implement a variety of technology and productivity related projects.

These case studies provide examples of how knowledgeable solution providers have used technology, processes and people to create effective and successful implementations in real-world situations. Case studies can be completed by filling out a simple online form where you can outline the project title, abstract, and full story in 1500 words or less; upload photos, videos and a logo.

Click here to visit the Case Study Database and upload your case study.

Bring focus to PLC programming: 5 things to avoid in putting your system together; Managing the DCS upgrade; PLM upgrade: a step-by-step approach
Balancing the bagging triangle; PID tuning improves process efficiency; Standardizing control room HMIs
Commissioning electrical systems in mission critical facilities; Anticipating the Smart Grid; Mitigating arc flash hazards in medium-voltage switchgear; Comparing generator sizing software

Annual Salary Survey

Participate in the 2013 Salary Survey

In a year when manufacturing continued to lead the economic rebound, it makes sense that plant manager bonuses rebounded. Plant Engineering’s annual Salary Survey shows both wages and bonuses rose in 2012 after a retreat the year before.

Average salary across all job titles for plant floor management rose 3.5% to $95,446, and bonus compensation jumped to $15,162, a 4.2% increase from the 2010 level and double the 2011 total, which showed a sharp drop in bonus.

2012 Salary Survey Analysis

2012 Salary Survey Results

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.