Chemical Processing-August 2008

examples, ﬁrewalls were in use but the worm bypassed them or exploited a ﬂaw in the ﬁrewall’s deployment. Many chemical industry managers ﬁnd the number and variety of pathways into their control systems hard to believe. However, this information has been corroborated by the 2006 Process Control Security Forum (PCSF) keynote presentation and a 2007 ARC Advisory Group survey. e PCSF paper reported that at a large oil company 80% to 90% of all control networks were connected to the enterprise network, which, in turn, was hooked up to the Internet. ARC canvassed control engineers about the types of connections that their automation networks had to the outside world. Only 17.5% reported no connection. Indeed, ARC found an extensive number of hookups: • 47.5% to a company intranet/business network; • 42.5% directly to the Internet; • 35% to direct dial-up; • 20% to wireless modems; and • 8% with other connections. Notice the percentages add up to far more than 100%, indicating that many control-system networks had multiple connections. ese secondary pathways can have a huge impact on plant security. An analysis of 75 control-system security incidents between 2002 and 2007 showed that more than half of the attacks came through secondary pathways such as dial-up connections, wireless systems and mobile devices (Figure 1). is indicates that chemical companies are missing or at least failing to adequately secure numerous pathways into their control systems (Figure 2). Many are human pathways such as contractors’ laptops, USB drives and inappropriate employee behavior. Others are communications systems that aren’t based on the typical local area network technologies — e.g., serial and telephone connections to remote process equipment, modems and wireless systems. e only solution is to conduct a thorough analysis of all pathways into the chemical process systems. Often this can result in some big surprises. A 2005 survey of a U.S. reﬁnery that I directed uncovered 17 diﬀerent pathways — site management had believed there was only Rental Cooling. For Chemical Process Applications Rental Cooling Emergency Planned Supplemental Turnaround Pilot Plant We keep process lines running at peak capacity. Our engineers speak your technical language and can help you solve your temperature control problem. Chillers Cooling Towers Pumps Heat Exchangers Tanks Air Conditioners Air Handlers Dehumidifiers Heaters Boilers Generators 800-586-8336 We are the rental cooling, heating and dehumidiﬁcation experts. CarrierRentals.com http://CarrierRentals.com http://CarrierRentals.com

Table of Contents Feed for the Digital Edition of Chemical Processing-August 2008

Chemical Processing- August 2008 Contents From the Editor ChemicalProcessing.com Field Notes In Process Energy Saver Compliance Advisor Protect your Plant What’s on Tap for Water? Keep Operations Safe Polystyrene Plant Gains Extra Output and More Process Puzzler Plant InSites Equipment & Services Adlits Product Spotlight/Classifieds Ad Index End Point

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.