Users in the process industry have not prioritised cybersecurity. This might be because they assume it’s the IT department’s responsibility, or they don’t feel directly threatened. However, both attitudes are neglectful, and here’s why: IT security should always be a joint task between IT and OT. Digital networking is rapidly advancing in the process industry, and concepts such as NAMUR Open Architecture (NOA), Modular Type Package (MTP), and Ethernet-Advanced Physical Layer (Ethernet-APL) are increasingly being used.
All of this creates new pathways into the previously isolated automation environment, which provides a convenient entry point for cyberattacks.
The dangers of digital networking
The use of modern, integrated automation solutions is simplifying processes and making them more flexible and efficient, but due to this flexibility, process automation engineers are increasingly placing more emphasis on security. For example, according to the industry association Bitkom, the German economy experiences an annual loss of approximately €203 billion due to the theft of IT equipment and proprietary data, and also from espionage and sabotage. What makes this particularly problematic is that cyber adversaries can come from various backgrounds, ranging from individual ‘script kiddies’ to criminals, and even nation states. Although such attacks are still infrequent in the process industry, operators of power plants, fuel tanks, or equipment in the water industry have recently become more vigilant. It is crucial not to underestimate the fact that any IT attacks can rapidly impact OT areas.
The development of wireless communication has brought about many benefits for users. Level sensors play a crucial role in providing essential data across various industrial sectors. This allows process data to be accessible globally, enabling vendor-managed inventory. For many years, VEGA sensors have been supplying critical data such as level data from reservoir water levels through to coal power station inventory stockpiles.
The emergence of Bluetooth technology has further expanded the use of these applications. Bluetooth simplifies the adjustment and commissioning of sensors and controllers, often helping to prevent accidents. Regardless of the source of the level data, whether from large silos, remote measuring points, potentially hazardous environments, or intricate processing plants, VEGA sensors make the data available where it’s needed. Wireless data transmission is also used to retrieve status information from the sensors, such as reporting maintenance needs or requesting updates, effectively reducing downtime.
From a cybersecurity standpoint, challenges arise. Data is increasingly integrated into production and maintenance systems for further processing in offices or control rooms, creating a gap between operational and security functions.
Holistic security concept
VEGA has invested significantly in obtaining the certification following IEC 62443-4-2 while developing the VEGAPULS 6X. This international set of standards defines security requirements for both hardware and software, and the entire development process of the VEGAPULS 6X was aligned with it. TÜV Nord oversaw this work and rigorously tested every measure.
The VEGAPULS 6X prioritises safety by safeguarding its internal electronics against tampering. It employs a layered security approach called defence-in-depth, comprising various IT security layers such as production equipment security, network security, and security measures for different system components. This strategy protects against threats like data manipulation, denial of service (DoS) attacks, and espionage.
The VEGAPULS 6X incorporates extra security features that include user authentication. Each device is assigned a unique device code and a Bluetooth access code. The Bluetooth connections are encrypted using standardised cryptographic methods, and can be disabled after configuration. The instrument logs all locking and unlocking actions in its event memory, capturing all successful and unsuccessful attempts. Firmware integrity checks ensure the software update package is encrypted and signed, preventing unauthorised software from being loaded into the VEGAPULS 6X. Lastly, the instrument allows data backup for recovery through the DTM, with the option to save parameters using HART-enabled control systems.
What happens in a worst-case scenario?
When defending against a cyberattack, time is of the essence. Companies should make appropriate preparations, which include developing a clearly defined emergency plan to ensure that valuable time is not wasted in case of an attack. It is also essential to plan how to rebuild a secure system in case significant damage is done. The product security incident response team (PSIRT) at VEGA is always ready to help. These experts continuously search for vulnerabilities, assist with updates and patches, address customer enquiries, and take immediate action in critical situations, such as when a user discovers a vulnerability. VEGA also collaborates closely with CERT@VDE, an IT security platform for industrial companies, to report and investigate vulnerabilities.
VEGA level sensors have been used for monitoring industrial processes for many years. The VEGAPULS 6X sensor is designed to be easy to set up, regardless of the application area, technology, or sensor version. VEGA also focuses on simplifying aspects related to cybersecurity, acknowledging that cybersecurity is an ongoing, dynamic process that requires continuous attention. Although VEGA cannot absolve the plant operator of all responsibility, it does provide support by encouraging operators to implement security measures outlined in the guidelines. These guidelines also offer additional suggestions for enhancing the security of production systems.
| Tel: | +27 11 795 3249 |
| Email: | info.za@vega.com |
| www: | www.vega.com/en/home_za |
| Articles: | More information and articles about VEGA Controls SA |
© Technews Publishing (Pty) Ltd | All Rights Reserved
printer friendly version