By JHJ Pool, industrial security engineer, Proconics.
Traditionally, control system networks were based on proprietary protocols and infrastructure. While cost and complexity were detrimental factors, the advantage of these systems was an inherent level of security not provided by contemporary control communication architectures.
Interoperability and information exchange between business and control systems has become increasingly important as ERP and MES systems marry the business and control environments. Unfortunately the easiest way to facilitate this information exchange is to ensure that there are no intervening devices that can derail communication. The result: a convenient, but high risk sharing of infrastructure. Control systems are now unintentionally exposed to the Internet, and a greater amount of unauthorised access, simply because the sharing of infrastructure makes physical access control much more difficult.
The question may be asked, “But what makes control networks different?” The answer to this can be surprisingly complex, but in essence the requirements or ‘objectives’ are very different. Figure 1 shows that while there is a certain amount of convergence, priorities are fundamentally different.
Figure 1.
What must be done to separate and secure your control networks?
Have a limited number of access points between the business and control networks: preferably there should only be one connection in a physically secured area. This is not always possible, but the number must be as small as possible.
Implement firewalled DMZs or unidirectional data gateways as part of the access point(s): losing the connection or protecting firewalls to an attack should allow one to physically disconnect and isolate the control network to allow continued integrity and operation of the control system.
Unplug the Internet: the biggest threat faced by owners of control systems is direct access to equipment from the Internet. This is ably illustrated by Shodan (www.shodanhq.com). The most frequent objection to this is that remote access is required. Probably the safest solution, although it is not perfect, is to make use of VPN access with the VPN forming part of the firewall.
Check for intrusion: very few control networks are equipped with intrusion detection systems. The fact is control systems will experience unexplained problems and outages and in some (hopefully relatively few) cases it will be due to system intrusion. The problem is however, if you do not monitor for it, you will most likely never know your systems have been penetrated.
Get rid of dual zoned equipment: people using one machine for business and process will almost never consider the impact of having one machine with direct access to both networks. Even if only one machine like this exists on the network, it invalidates all firewall separation because it provides a direct alternative route to the control network. Many of the inadvertent Internet exposures take place in this manner.
In conclusion, it is critical to separate control and business networks as the security problems can have dire consequences. The one aspect that is frequently ignored is that it must be a managed, controlled and monitored process, just like quality or safety management.
Buildings in Africa’s urban evolution Schneider Electric South Africa
IT in Manufacturing
Africa is now an urban continent. How does the continent mobilise to accommodate urban dwellers and maintain and implement critical infrastructure that allows for this expansion? Building management systems provide a tangible solution to optimise resource use, lower operations costs and ultimately contribute to a growing continent that also employs green practices.
Read more...Black Rock Mining centralises mining operations with AVEVA
IT in Manufacturing
Black Rock Mine Operations replaced and upgraded its existing infrastructure, and installed additional capacity to expand production from 3 to 4,6 million tons in three years. The new system is powered by a suite of AVEVA solutions.
Read more...The strategic role of technology in today’s economy
IT in Manufacturing
In an era of economic uncertainty and persistent market volatility, businesses are under immense pressure to manage costs while maintaining operational effectiveness. The role of chief information officers and chief technology officers has never been more critical, as they are tasked with leveraging technology not just as a tool for efficiency but as a strategic asset in navigating these turbulent times.
Read more...Minutes to meltdown: surviving a cyber attack
IT in Manufacturing
Commvault recently hosted its Minutes to Meltdown event. Led by the company’s security experts, this was an interactive and detailed ransomware attack simulation designed to help companies understand how to respond in the event of a cyber attack.
Read more...Siemens elevates automotive and aerospace simulation Siemens South Africa
IT in Manufacturing
Siemens Digital Industries Software has announced the latest update to its Simcenter portfolio, delivering advancements in aerostructure analysis, electric motor design, gear optimisation and smart virtual sensing. These enhancements are designed to streamline workflows, accelerate certification and provide deeper insights into system performance.
Read more...Automation in 2025: Navigating manufacturing innovation without the risk
IT in Manufacturing
During 2025, a wave of innovative technologies is expected to disrupt and change the way IT is applied to automation systems. The challenge lies in balancing the reliability of proven techniques with the potential of new technologies, all while minimising and controlling risk. This article explores ways to approach the latest information technologies effectively in a manufacturing context.
Read more...South Africa’s AI revolution is here – but are we secure?
IT in Manufacturing
South African businesses are sprinting to embrace generative AI, lured by its potential to drive efficiency, productivity and innovation. But here’s the stark reality: without a rock-solid cybersecurity foundation, AI will become a Trojan horse, opening the floodgates to sophisticated cyber threats.
Read more...Shaping data resilience strategies with AI and hybrid cloud solutions
IT in Manufacturing
In today’s rapidly evolving digital landscape, organisations are under growing pressure to secure their operations against increasingly sophisticated cyberthreats, including those that leverage AI to enhance the success rate of attacks. In this landscape, it has become essential to ‘fight fire with fire’ – harnessing AI as a means to counter these threats.
Read more...Advancements in wire rope testing
IT in Manufacturing
Being able to get instant, real-time and portable detection of wire rope flaws can make a significant difference for operational teams. There have been a number of significant technological advancements and tools entering the market that help wire rope operators detect and resolve problems faster.
printer friendly version