Network security in plants is beginning to mature. For years, the goal was to build an impenetrable perimeter. Control engineers and IT departments fought it out to do that work. The perimeter is still critical, but new concerns and new strategies are showing up as plant managers begin to realize there are dangers inside the perimeter.
One of the emerging security strategies is to look at the plant as assets that need protecting rather than seeing a building that needs security. “We’re seeing customers shift to detecting assets. Rule one is to understand what you’re protecting, identifying those assets,” Roger Hill, head of technology management at Siemens Industry, told Design News. “The control and process engineers are working with the IT department to address security organizationally. Plants are identifying their vulnerabilities, and that includes their assets.”
The shift in perspective on security is recent. As well as looking at perimeter protection, plants are looking at policies. “We’ve seen a change of focus in the last 16 months. Our customers are now focused on how to protect their plant,” Galina Antova, global head of industrial security services at Siemens Industry, told us. “They realize the threats are always changing, and they want to reduce the risk whether through security measures or policies and procedures.”
Bringing IT and the shop floor together
For many years, plant engineers and IT were in conflict over network security. But if you bump the problem to a level above control and IT, the battle ends. “C-level management now holds the responsibility for security across the enterprise. The product folks have a good understanding of how the plant works, and the IT folks are trying to streamline and enforce cyber security across the shop floor,” says Antova. “Together they’re putting together task forces to address cyber security to identify solutions. Some go straight into increasing perimeter protection. Others look at the assets and identify the risks. They realize it’s not just a shop-floor problem, and not just an IT problem.”
Response and recovery
Hill argues that plants need to approach network security the same way they approach threats from tornados or other physical dangers. Network security has to become a disaster strategy with policies and procedures rather than just a network functionality issue.
“The classic approach to protecting a plant is to identify, protect, detect, respond, and recover. There are gaps on the response and recovery side. Disaster and recovery have always been part of business continuity. Now they need to be part of security policy,” he told us. “Response and recovery are not being addressed as much as they should be. In the virtual teams, plants have been focused on the first three areas: identify, protect, and detect. Yet they need to be able to recover when and if something happens.”
The unintentional attacker
The other sleeping danger Hill and Antova point to is the innocent threat -- the naïf who does something perfectly reasonable that ends up endangering plant security.
“The non-malicious threat is a big concern. Someone walks into the plant and says, ‘Oh, my iPhone is just about out of power. Here’s a USB I can use.’ That’s in-house breach,” says Hill. “Unintentional breaches do not get the attention they deserve. You don’t see unintentional threats discussed in the media. We just hear about the big breach. But if you look at the numbers, the insider threat is probably the biggest threat. From our perspective, this is the really big one.”