Protect sensitive systems by taking them offline

Manufacturers need to understand their process and disconnect the “crown jewels" to protect their systems from serious damage.

04/01/2017“Today, digital means connected,” said Marty Edwards, director of the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the Department of Homeland Security (DHS) during his keynote address last week at the ARC Advisory Group’s Industry Forum in Orlando, FL. “Everything is connected to everything. If it isn’t connected, it will be.”

So, what Edwards, a longtime security expert with DHS and before, said next seems a bit surprising, but also realistic. No, it is not about throwing as much technology as possible at the issue, it is the exact opposite to a degree. “Now that we are connected, we have to think of security. The two don’t really work together,” he said.

In this day and age of connected everything, manufacturers need to understand their process and disconnect the “crown jewels.” Courtesy: Luca Bravo, UnsplashThat is where what Edwards calls cyber informed engineering comes into play. “Find the most critical functions; find that basic function and take it off line,” he said. Think about safety systems. With some safety systems becoming more digitalized there are shut down functions that once you push it, it stays shut down. That could be good or bad, depending on the process and the situation. Because once the process shuts down, a reboot is in order.

That is why, he said, the user needs to “look at functions and find the one or two areas that could be a problem. We do need to take care of those life safety functions.”

By taking those vital “crown jewel” functions off line, that does not absolve anyone of also have a security program. “You still need to do basic cyber security functions,” he said. Find out the vital parts of the process and protect it. While he is advocating taking certain systems offline, he is not pushing for an air gapped environment.

“Air gap does not necessarily work,” he said. “Air gapped often means neglected.” Edwards is also not giving up on today’s technology. “Ten years ago you could not use IT technology (in an OT environment) because it would break,” he said. “I think there is quite a bit of IT or IIoT (Industrial Internet of Things) security products right now. I think that is a good thing for industrial security. Overall this is a good message.”

But vulnerabilities exist and there is a danger point for some areas. He listed the medical device sector as a hot button. There are devices implanted in patients and then connect to a device sitting on a bedside table that also sends information back to a doctor’s office. What is the potential for something happening if the device is not secure?

That means users need to understand security and have a basic plan of attack. “At least do some separation, segment, do due diligence, patching, perimeter control, train your people, do logging,” he said. When it comes to security, the reality of it all is if a bad guy wants to get in, it doesn’t really matter what you have done; if you face a nation state, they will figure out how to get in.

That means in the end, security is all about understanding risk management and getting a firm grip on what you have and what you need to protect, while also understanding the massive amount of surface area a manufacturer needs to protect. On top of that, no one can afford to protect everything, plus not everything needs heavy duty protection.

“You can’t protect everything,” Edwards said, “it won’t work."

Gregory Hale is the editor and founder of Industrial Safety and Security Source (, a news and information Website covering safety and security issues in the manufacturing automation sector. This content originally appeared on ISSSource is a CFE Media content partner. Edited by Joy Chang, CFE Media,

ONLINE extra

See related stories from ISSSourced linked below

The Top Plant program honors outstanding manufacturing facilities in North America. View the 2015 Top Plant.
The Product of the Year program recognizes products newly released in the manufacturing industries.
Each year, a panel of Control Engineering and Plant Engineering editors and industry expert judges select the System Integrator of the Year Award winners in three categories.
Pipe fabrication and IIoT; 2017 Product of the Year finalists
The future of electrical safety; Four keys to RPM success; Picking the right weld fume option
A new approach to the Skills Gap; Community colleges may hold the key for manufacturing; 2017 Engineering Leaders Under 40
Control room technology innovation; Practical approaches to corrosion protection; Pipeline regulator revises quality programs
The cloud, mobility, and remote operations; SCADA and contextual mobility; Custom UPS empowering a secure pipeline
Infrastructure for natural gas expansion; Artificial lift methods; Disruptive technology and fugitive gas emissions
Power system design for high-performance buildings; mitigating arc flash hazards
VFDs improving motion control applications; Powering automation and IIoT wirelessly; Connecting the dots
Natural gas engines; New applications for fuel cells; Large engines become more efficient; Extending boiler life

Annual Salary Survey

Before the calendar turned, 2016 already had the makings of a pivotal year for manufacturing, and for the world.

There were the big events for the year, including the United States as Partner Country at Hannover Messe in April and the 2016 International Manufacturing Technology Show in Chicago in September. There's also the matter of the U.S. presidential elections in November, which promise to shape policy in manufacturing for years to come.

But the year started with global economic turmoil, as a slowdown in Chinese manufacturing triggered a worldwide stock hiccup that sent values plummeting. The continued plunge in world oil prices has resulted in a slowdown in exploration and, by extension, the manufacture of exploration equipment.

Read more: 2015 Salary Survey

Maintenance and reliability tips and best practices from the maintenance and reliability coaches at Allied Reliability Group.
The One Voice for Manufacturing blog reports on federal public policy issues impacting the manufacturing sector. One Voice is a joint effort by the National Tooling and Machining...
The Society for Maintenance and Reliability Professionals an organization devoted...
Join this ongoing discussion of machine guarding topics, including solutions assessments, regulatory compliance, gap analysis...
IMS Research, recently acquired by IHS Inc., is a leading independent supplier of market research and consultancy to the global electronics industry.
Maintenance is not optional in manufacturing. It’s a profit center, driving productivity and uptime while reducing overall repair costs.
The Lachance on CMMS blog is about current maintenance topics. Blogger Paul Lachance is president and chief technology officer for Smartware Group.
The maintenance journey has been a long, slow trek for most manufacturers and has gone from preventive maintenance to predictive maintenance.
This digital report explains how plant engineers and subject matter experts (SME) need support for time series data and its many challenges.
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.
Maintenance Manager; California Oils Corp.
Associate, Electrical Engineering; Wood Harbinger
Control Systems Engineer; Robert Bosch Corp.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me