By JHJ Pool, industrial security engineer, Proconics.
Traditionally, control system networks were based on proprietary protocols and infrastructure. While cost and complexity were detrimental factors, the advantage of these systems was an inherent level of security not provided by contemporary control communication architectures.
Interoperability and information exchange between business and control systems has become increasingly important as ERP and MES systems marry the business and control environments. Unfortunately the easiest way to facilitate this information exchange is to ensure that there are no intervening devices that can derail communication. The result: a convenient, but high risk sharing of infrastructure. Control systems are now unintentionally exposed to the Internet, and a greater amount of unauthorised access, simply because the sharing of infrastructure makes physical access control much more difficult.
The question may be asked, “But what makes control networks different?” The answer to this can be surprisingly complex, but in essence the requirements or ‘objectives’ are very different. Figure 1 shows that while there is a certain amount of convergence, priorities are fundamentally different.
Figure 1.
What must be done to separate and secure your control networks?
Have a limited number of access points between the business and control networks: preferably there should only be one connection in a physically secured area. This is not always possible, but the number must be as small as possible.
Implement firewalled DMZs or unidirectional data gateways as part of the access point(s): losing the connection or protecting firewalls to an attack should allow one to physically disconnect and isolate the control network to allow continued integrity and operation of the control system.
Unplug the Internet: the biggest threat faced by owners of control systems is direct access to equipment from the Internet. This is ably illustrated by Shodan (www.shodanhq.com). The most frequent objection to this is that remote access is required. Probably the safest solution, although it is not perfect, is to make use of VPN access with the VPN forming part of the firewall.
Check for intrusion: very few control networks are equipped with intrusion detection systems. The fact is control systems will experience unexplained problems and outages and in some (hopefully relatively few) cases it will be due to system intrusion. The problem is however, if you do not monitor for it, you will most likely never know your systems have been penetrated.
Get rid of dual zoned equipment: people using one machine for business and process will almost never consider the impact of having one machine with direct access to both networks. Even if only one machine like this exists on the network, it invalidates all firewall separation because it provides a direct alternative route to the control network. Many of the inadvertent Internet exposures take place in this manner.
In conclusion, it is critical to separate control and business networks as the security problems can have dire consequences. The one aspect that is frequently ignored is that it must be a managed, controlled and monitored process, just like quality or safety management.
Sustainable energy management Siemens South Africa
IT in Manufacturing
Utilising its innovative ONE approach technology, Siemens provides complete transparency on resource consumption and offers data-driven optimisation recommendations for sustainable energy management.
Read more...Paving the way for a carbon-neutral future in South Africa
IT in Manufacturing
At ABB Electrification, we believe the infrastructure of the future must do more than support daily operations, it must anticipate them. We are committed to building intelligent systems that connect and optimise infrastructure across sectors.
Read more...Africa’s hidden AI advantage
IT in Manufacturing
Through my work implementing AI systems across three continents, I’ve become convinced that Africa’s unique context demands urgent AI adoption. Successful implementation requires local expertise to understand resource constraints as design parameters to create the innovations that make technology truly work under real-world conditions.
Read more...Siemens Xcelerator empowers space-tech pioneer, Skyroot Aerospace Siemens South Africa
IT in Manufacturing
Siemens Digital Industries Software has announced that Skyroot Aerospace, a leading private space launch service company in India, has adopted Polarion software from the Siemens Xcelerator portfolio to digitally transform its software development processes and enhance efficiency as it aims to accelerate access to space for its customers worldwide.
Read more...Water is running out, is your ESG strategy ready?
IT in Manufacturing
Water is one of the most critical yet undervalued resources in modern business. Water stewardship asks businesses to understand their water footprint across the entire value chain and to engage with others who share the same water resources.
Read more...Cybersecurity in 2025: Six trends to watch
IT in Manufacturing
Rockwell Automation’s?10th?State?of?Smart?Manufacturing report finds that cybersecurity risks are a major, ever-present obstacle, and are now the third-largest impediment to growth in the next 12?months.
Read more...The state of the smart buildings market in 2025
IT in Manufacturing
Smart buildings are entering a transformative phase, driven by sustainability goals, technological innovation and evolving user expectations. According to ABI Research’s latest whitepaper, the sector is undergoing a strategic overhaul across key areas like retrofitting, energy efficiency, data-driven operations and smart campus development.
Read more...Digital twin for Bavaria’s National Theatre Siemens South Africa
IT in Manufacturing
Siemens and the Bavarian State Opera are digitalising the acoustics in Bavaria’s National Theatre in Munich, Germany. The result is a digital twin that simulates sound effects, orchestral setups and venue configurations in a realistic 3D acoustic model so that musicians, the director and conductors can assess a concert hall’s acoustics even before the first rehearsal.
Read more...How AI can help solve South Africa’s water crisis
IT in Manufacturing
Climate change, ageing infrastructure, pollution and unequal access are putting intense pressure on the country’s water systems. A powerful question arises: “Can artificial intelligence help us change course?”
Read more...Backup has evolved, but has your strategy?
IT in Manufacturing
With cyber threats rising and compliance standards tightening, South African organisations are under growing pressure to revisit their data protection strategies. The era of treating backups as a box-ticking exercise is over.
While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.
printer friendly version