Recognizing that the biggest security risk to your control system assets are the operators who interface with the system on a daily basis is the most important step to successfully securing your systems. For a thorough analysis of your risks and setup of reliable control system security technologies and processes, consult an industrial control system security expert such as scadahacker.com, tofinosecurity.com, or industrialdefender.com. Following are the groundlevel security steps that a batch process facility should implement at a bare minimum:
1. Assess your systems.Compile an accurate list of all the assets in your plant: make, model and serial number. Where are your computers? Where are your PLCs? It’s difficult to secure something when you don’t know it exists. This should be a high-level assessment in which you go through your plant and figure out what is high risk and what is low risk, which is determined by two key factors: How likely is a problem to occur? How serious is the problem? For example, if something happened to your chlorine tank, it would be really ugly. That chip pile, not so ugly. Get a feel for the significant risks. Where do you have to focus your effort? The answer is going to drive your decisions and your capital allocation.
2. Document your policies and procedures.No company operates in a vacuum. Each company will have a series of policies and procedures for things like safety and performance, reliability, and change management. Lay those out and understand how they impact control systems and security, and then build on that to create a set of additional security requirements.
3. Start training.No one is going to follow policies unless they know about them and understand why they are necessary. All levels of employees that interact with the control system need to understand what an attack looks like and how to respond to one. You should end up with a matrix of training for the various levels of users; it doesn't have to be onerous, but it has to be done.
4. Understand your traffic flows.You need a diagram that shows all the things that require intercommunication. Smart companies will have a comprehensive diagram showing that the accounting department needs data out of this area, and maintenance needs data out of this area, and so on.
5. Remember that SCADA security is used to control access.Access should be segmented to specific network resources, hardware resources, and HMI. Effective security practices should prevent access to all layers by unwanted external connections.
6. Leverage safety reports.Those responsible for safety, when they do reports and analyses, have done a good deal of the work needed to understand the security risks.
7. Use separate networks.Though this step is becoming less and less practical, some still advocate that the process control network be kept separate from business networks, and also isolated from the Internet. For this approach, which may not be viable in the longer term, utilize operating system (OS) implemented security, with active directory “domain group security” as the preferred approach.
8. Security in the operator interface should be considered broadly.With advanced human-machine interface technologies, security can be implemented for individual attributes. HMI should be the only accessible program, with user-specific exceptions, connected to the control operating system at a dedicated user station. All other resources for that particular terminal should be restricted.
9. Use unique user accounts and passwords.All users should have unique user accounts and passwords to minimize the risk of unauthorized access.
10. Provide port security.使用这种方法,以太网MAC地址connected to the switch port allows only that MAC address to communicate on that port. If any other MAC address tries to communicate through the port, port security will disable it. Most of the time, network administrators configure the switch to send an SNMP trap to their network monitoring solution that the port’s disabled for security reasons. When using port security, you can prevent unwanted devices from accessing the network.
11. Administer antivirus protection.Use an antivirus solution that is compatible with the installed SCADA software.
12.开放和促进之间的通信and process control groups.Roles need to be defined and an understanding of what each group needs must be accomplished so true collaboration can take place to begin and continue the process of enabling a fully functional control system with adequate security protection.
Liked this article?Download the Batch Process playbook here.Or,Download the Continuous Process playbook here.
