By JHJ Pool, industrial security engineer, Proconics.
Traditionally, control system networks were based on proprietary protocols and infrastructure. While cost and complexity were detrimental factors, the advantage of these systems was an inherent level of security not provided by contemporary control communication architectures.
Interoperability and information exchange between business and control systems has become increasingly important as ERP and MES systems marry the business and control environments. Unfortunately the easiest way to facilitate this information exchange is to ensure that there are no intervening devices that can derail communication. The result: a convenient, but high risk sharing of infrastructure. Control systems are now unintentionally exposed to the Internet, and a greater amount of unauthorised access, simply because the sharing of infrastructure makes physical access control much more difficult.
The question may be asked, “But what makes control networks different?” The answer to this can be surprisingly complex, but in essence the requirements or ‘objectives’ are very different. Figure 1 shows that while there is a certain amount of convergence, priorities are fundamentally different.
Figure 1.
What must be done to separate and secure your control networks?
Have a limited number of access points between the business and control networks: preferably there should only be one connection in a physically secured area. This is not always possible, but the number must be as small as possible.
Implement firewalled DMZs or unidirectional data gateways as part of the access point(s): losing the connection or protecting firewalls to an attack should allow one to physically disconnect and isolate the control network to allow continued integrity and operation of the control system.
Unplug the Internet: the biggest threat faced by owners of control systems is direct access to equipment from the Internet. This is ably illustrated by Shodan (www.shodanhq.com). The most frequent objection to this is that remote access is required. Probably the safest solution, although it is not perfect, is to make use of VPN access with the VPN forming part of the firewall.
Check for intrusion: very few control networks are equipped with intrusion detection systems. The fact is control systems will experience unexplained problems and outages and in some (hopefully relatively few) cases it will be due to system intrusion. The problem is however, if you do not monitor for it, you will most likely never know your systems have been penetrated.
Get rid of dual zoned equipment: people using one machine for business and process will almost never consider the impact of having one machine with direct access to both networks. Even if only one machine like this exists on the network, it invalidates all firewall separation because it provides a direct alternative route to the control network. Many of the inadvertent Internet exposures take place in this manner.
In conclusion, it is critical to separate control and business networks as the security problems can have dire consequences. The one aspect that is frequently ignored is that it must be a managed, controlled and monitored process, just like quality or safety management.
Transforming pulp and paper with automation and digitalisation ABB South Africa
IT in Manufacturing
The pulp and paper industry in South Africa is undergoing a significant transformation from traditional manual processes to embracing automation technologies. Automation in pulp and paper mills aims to improve various production stages, from raw material preparation to final product creation.
Read more...Protecting industrial networks with resilient defence RJ Connect
IT in Manufacturing
Network security is no longer just about preventing hacking or data breaches. For operational technology networks, resilient defence and consistent uptime are crucial. They are the core tenets that underpin Moxa’s guarded uptime and resilient defence (GUARD).
Read more...The metaverse is now: are you ready to reimagine your business?
IT in Manufacturing
The convergence of the digital and physical worlds, driven by spatial computing and the metaverse, is rapidly reshaping business landscapes. This transformation extends beyond the mere novelty of virtual reality headsets and augmented reality filters, signalling a fundamental shift in how organisations operate, collaborate and innovate.
Read more...AI and cyber security: South Africa’s next battleground
IT in Manufacturing
Artificial intelligence is rapidly becoming a double-edged sword in the world of cybersecurity. In South Africa, where cybercrime is on the rise, AI presents both an opportunity and a threat.Artificial intelligence is rapidly becoming a double-edged sword in the world of cybersecurity. In South Africa, where cybercrime is on the rise, AI presents both an opportunity and a threat.
Read more...Addressing the cooling needs of the modern data centre Schneider Electric South Africa
IT in Manufacturing
The rise in hardware density in data centres is gaining speed and is largely driven by the demands of artificial intelligence and machine learning, requiring more powerful servers and specialised hardware.
Read more...South Africa’s next cyber security frontier
IT in Manufacturing
AI-powered agents are rapidly transforming how South African businesses operate, from chatbots managing customer inquiries to automated systems processing financial transactions. While these AI-driven assistants increase efficiency and reduce operational costs, they also present a new, and often underestimated, cybersecurity challenge: identity management.
Read more...The DeepSeek effect: navigating AI’s new frontier
IT in Manufacturing
DeepSeek has emerged as a game-changer in artificial intelligence, offering a robust platform redefining how businesses approach AI integration. This change is especially important since it opens up AI to a wider range of organisations, including small and medium-sized enterprises that could have previously been priced out of the market.
printer friendly version