By JHJ Pool, industrial security engineer, Proconics.
Traditionally, control system networks were based on proprietary protocols and infrastructure. While cost and complexity were detrimental factors, the advantage of these systems was an inherent level of security not provided by contemporary control communication architectures.
Interoperability and information exchange between business and control systems has become increasingly important as ERP and MES systems marry the business and control environments. Unfortunately the easiest way to facilitate this information exchange is to ensure that there are no intervening devices that can derail communication. The result: a convenient, but high risk sharing of infrastructure. Control systems are now unintentionally exposed to the Internet, and a greater amount of unauthorised access, simply because the sharing of infrastructure makes physical access control much more difficult.
The question may be asked, “But what makes control networks different?” The answer to this can be surprisingly complex, but in essence the requirements or ‘objectives’ are very different. Figure 1 shows that while there is a certain amount of convergence, priorities are fundamentally different.
Figure 1.
What must be done to separate and secure your control networks?
Have a limited number of access points between the business and control networks: preferably there should only be one connection in a physically secured area. This is not always possible, but the number must be as small as possible.
Implement firewalled DMZs or unidirectional data gateways as part of the access point(s): losing the connection or protecting firewalls to an attack should allow one to physically disconnect and isolate the control network to allow continued integrity and operation of the control system.
Unplug the Internet: the biggest threat faced by owners of control systems is direct access to equipment from the Internet. This is ably illustrated by Shodan (www.shodanhq.com). The most frequent objection to this is that remote access is required. Probably the safest solution, although it is not perfect, is to make use of VPN access with the VPN forming part of the firewall.
Check for intrusion: very few control networks are equipped with intrusion detection systems. The fact is control systems will experience unexplained problems and outages and in some (hopefully relatively few) cases it will be due to system intrusion. The problem is however, if you do not monitor for it, you will most likely never know your systems have been penetrated.
Get rid of dual zoned equipment: people using one machine for business and process will almost never consider the impact of having one machine with direct access to both networks. Even if only one machine like this exists on the network, it invalidates all firewall separation because it provides a direct alternative route to the control network. Many of the inadvertent Internet exposures take place in this manner.
In conclusion, it is critical to separate control and business networks as the security problems can have dire consequences. The one aspect that is frequently ignored is that it must be a managed, controlled and monitored process, just like quality or safety management.
Overcoming the bottling industry’s fragmented visibility Schneider Electric South Africa
IT in Manufacturing Electrical Power & Protection
Beverage bottling facilities are among manufacturing’s most energy-intensive environments, yet many still operate without granular insight into where that energy goes. Rezolia Muller-Potluri of Schneider Electric explains how tiered metering architecture and advanced
Read more...New chiller line for high-density AI data centres Schneider Electric South Africa
IT in Manufacturing
Schneider Electric has launched the Uniflair XCA, a new series of air-cooled and free-cooling chillers designed for artificial intelligence-driven, high-density liquid-cooled data centres.
Read more...Turning system integrators into trusted technology partners Schneider Electric South Africa
IT in Manufacturing System Integration & Control Systems Design
Schneider Electric’s Alliance Partner Programme is repositioning system integrators from hardware suppliers into lifecycle-value partners. Oriel Soupen explains the competency framework, certification model and real-world results that are already helping African system integrators win higher-value, longer-term engagements.
Read more...Why renewable projects need integrated protection and control
IT in Manufacturing
Fragmented secondary plant integration in renewable energy projects causes costly delays during commissioning. ACTOM Protection and Control’s Secondary Plant Integration solution consolidates all secondary systems under a single engineering framework, reducing risk and accelerating grid
Read more...When digital twins move from concept to critical tool
IT in Manufacturing System Integration & Control Systems Design Maintenance, Test & Measurement, Calibration
Digital twins are moving out of the lab and onto the mine, the factory floor and the transport network where they predict failures before they happen. Amritesh Anand looks at where they earn their keep, the data and integration work behind them, and the security questions every organisation should ask before switching one on.
Read more...How a digital foundation can overcome the LNG trilemma Schneider Electric South Africa
IT in Manufacturing SCADA/HMI
The LNG sector is racing to add capacity, but without a digital backbone, growth creates complexity rather than capability. Christophe Begat of Schneider Electric explains how connecting data, systems and analytics across the LNG value chain can resolve the trilemma of secure supply, lower emissions and tighter costs.
Read more...Decarbonisation is reshaping mining strategy in Africa Schneider Electric South Africa
IT in Manufacturing Electrical Power & Protection
Mining companies across Africa are embedding decarbonisation into operational strategy, driven by investor, regulatory and customer pressure to reduce emissions while improving resilience.
Read more...Siemens and HighByte partner to scale industrial AI Siemens South Africa
IT in Manufacturing Fieldbus & Industrial Networking
Siemens is expanding its Industrial Edge ecosystem through a partnership with HighByte, enabling customers to connect, contextualise and transform data from operational technology and information technology sources to build AI models and applications at scale.
Read more...Africa on the edge of a digital future Schneider Electric South Africa
IT in Manufacturing
Edge computing promises lower latency, stronger reliability and real-time responsiveness across Africa, yet its rollout keeps colliding with one stubborn obstacle, power. Steven Santini explores how renewable microgrids, smart energy management and the right partnerships could turn the continent’s energy gap into its biggest edge opportunity.
While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.
printer friendly version