Automation & IT systems are different

With automation systems there are definite differences of goals, objectives and assumptions of what needs to be protected. It’s important to understand what “real time performance” and “continuous operation” really mean and recognize how well-intentioned software-based security solutions can interfere with automatic control systems.

Beyond the common architectures, many business networks are now connected with process networks. This has opened the door for hackers and viruses to enter the production and process environments. If ignored, or under-managed, this can lead to serious problems.

Many legacy process automation systems were designed for functionality and performance not security. They were largely proprietary and specialized knowledge was needed to work with them. System components were purchased as black boxes considering only their end-to-end function and there was little or no concern with interconnectivity with other systems. Control systems operated in isolation from the rest of the company, both technically and physically, assuming an environment of implicit trust. And so, when included in common networks, they are often the weak point in total network security.

It is important to have separate networks where access to automation and control systems is strictly limited by routers and firewalls. Users and applications on control networks should be limited to those specifically required for the processing of email, no games, no Internet browsing. Control rooms may also need a business network for email and business applications, and budget-conscious administrators may suggest network commonality. But that ’s short-sighted, and simply exposes the automation systems network to a plethora of problems. Parallel installation of different networks is not a luxury – it should be mandated.

Accidental or Deliberate

Deliberate problems are caused by individuals with malicious intent, such as disgruntled employees or ex-employees who may be involved in theft and retaliation. And there are “hackers” who may do it just for the thrill, plus vandals and opportunistic criminals (including terrorists). Passwords usually provide only limited protection against hacking because most production and process control groups use easy-to-remember (and easy-to-guess) passwords on their systems and typically don’t change them regularly. Accidental errors typically outnumber deliberate attacks in industrial environments. But the proliferation of viruses and the increase in PC-based control systems is causing a significant increase in deliberate system intrusions.

Deliberate attacks on automation control networks fall into one of these two categories:

• Viral Infection. Worms and trojans usually enter through mainstream software – Microsoft Windows, Internet Explorer and Outlook email on Intel-based computers. The chances of infection have increased in the automation environment because these technologies are being used more and more in control systems due to low cost and interoperability. A not uncommon problem is vulnerability to what is called “sneaker net” – the use of portable memory like floppy-disks, CDROMs or USB memory sticks to transfer data or programs. These could insert a virus or worm intentionally or unintentionally. Security policies must include both network protection (firewalls) and physical protection (making the server inaccessible).
• External Intrusion. Hacking of automation and control networks is increasing rapidly during recent years, as more plants and factories are connected to the Internet, or to corporate Intranets. Typically a hacker will get access to the business network, and then attempt to invade other computers or networked servers. Intranet web servers are a weak point in many industrial installations. They are used commonly as an effective data distribution tool; because they may not be directly exposed to the Internet, they are not usually maintained with the latest updates and security patches.

• Network Spoofing and Denial of Service attacks: Process alarms are lost because the network is clogged with spurious requests. Beyond just performance degradation, these are serious safety issues.
• Eavesdropping and password cracking: confidentiality and safety issues.
• Tampering, impersonation, system modification: The system is open to malicious intent.

Secure architecture & location

Well thought out network security architectures provide the mechanisms necessary to prioritize and manage traffic, restrict outside traffic, and give preferential treatment to control traffic. The system must have the ability to recognize broadcast attacks that can create denial of service conditions, to prevent problem situations before they occur. When anything happens outside the bounds established for the control network, it must be captured as an auditable event. The event logs must be reviewed regularly to determine if unauthorized changes are made.

Anti Virus software from companies like McAfee or Symantec could be part of a good security strategy, but this is not sufficient. Standard anti-virus and anti-spam packages were developed for typical PC users, not for sophisticated, real-time control systems. They need to be adapted specifically for use with automation control systems.

A good cyber-security system should provide preconfigured security settings for files, directories, and registry keys to protect against viruses, malicious users, and inadvertent actions. There should be preconfigured groups and group policies that defined desktop and console behavior: Operators should be limited to say just auto start applications, supervisors could be very secure, engineers could be restricted to relevant engineering functions, and administrators could have unlimited access with secure settings. Clearly the administrative procedures (password protection, etc.) should be subject to maximum security procedures.

Management of the network is the key to security protection. As they say about Quality, business performance, and even about Life – Network Security is a journey, not a destination!

Related links:

Cyber Security Risks for Industrial Control Systems

Study reveals more attacks on control and SCADA systems

Cyber security guidance

Who’s Trying to Hack into Your Automation System?