Chemical Processing-August 2008

local security appliance technology. First, policy sets out what truly belongs on the control system network and what’s outside. Next, a primary control-system firewall acts as the choke point for all traffic between the outside world and the control system devices. Once the electronic perimeter of the control system is secured, it’s necessary to build the secondary layers of defense on the control system itself. Control components like HMIs and data historians that are based on traditional IT operating systems such as Windows and Linux should take advantage of the proven IT strategies of patch and anti-virus management. However, this requires prior testing and care. For devices like PLCs and DCS controllers where patching or anti-virus solutions aren’t readily available, I suggest an industrial security appliance. This rapidly evolving security solution deploys low-cost security modules directly in front of each control device(s) needing protection (Figure 3). PeoPle first, not technology Figure 3. Low-cost modules are designed to protect individual control devices. Source: MTL Instruments. Address the threAts Despite the razzle-dazzle of these technological solutions, it’s important to consider the human aspects of security such as developing policy, assigning responsibility and training staff. It’s this human part of the equation — not the technology — that’s most critical to the success of any security program. Three factors are critical for the successful implementation of a security program within a chemical facility: 1. security policy, objectives and activities that reflect business goals; 2. an approach and framework for implementing, maintaining, monitoring and improving information security that’s consistent with the organizational culture; and 3. management’s visible support and commitment. If any of these are missing, then the security program will likely fail. Finally, IT managers and plant managers face a common enemy attacking related technologies in what has become a highly interconnected environment. This demands developing a coordinated defense. It can be valuable to: • establish cross-department training programs that focus on values and behaviors expected, to foster a culture of co-operation and communication; • create cross-functional teams to develop policies, standards and projects for process security; and • encourage informal networks. These are important. When a real problem arises, provide opportunities for people from both the process and IT departments to liaise and work together. These are just a few of the most important steps that the chemical industry needs to take to effectively protect itself from cyber attack. Failure to adapt to changing threats and vulnerabilities will leave companies exposed to increasing numbers of cyber incidents. The consequences unfortunately could include a marred reputation, environmental releases, production and financial loss, and even human injury or death. eric Byres, P.E., is chief technical officer of Byres Security Inc., Lantzville, B.C. E-mail him at eric@byressecurity.com. relAted security resources on chemicAlProcessing.com • Feel Secure about Vulnerability Assessments, www.ChemicalProcessing.com/articles/2008/042.html • Become a Cyber Security Pacesetter, www.ChemicalProcessing.com/articles/2007/186.html • Plug Cyber Security Gaps, www.ChemicalProcessing.com/articles/2007/152.html • Properly Protect Control Systems, www.ChemicalProcessing.com/articles/2007/104.html • Get Ready to Comply with New Security Mandates, www.ChemicalProcessing.com/articles/2007/095.html other Articles By eric Byres: • Wolves at the Door(s) of the House of Straw, www.ControlGlobal.com/articles/2007/449.html • Wolves at the Security House Door(s), Part 2, www.ControlGlobal.com/articles/2008/017.html • Making Cyber Security Work in the Refinery, www.isa.org/Template. cfm?Section=Technical_Information_and_Communities&template=/ ContentManagement/ContentDisplay.cfm&ContentID=64756 25 chemicalprocessing.com august 2008 http://ChemicalProcessing.com http://www.ChemicalProcessing.com/articles/2008/042.html http://www.ChemicalProcessing.com/articles/2007/186.html http://www.ChemicalProcessing.com/articles/2007/152.html http://www.ChemicalProcessing.com/articles/2007/104.html http://www.ChemicalProcessing.com/articles/2007/095.html http://www.ControlGlobal.com/articles/2007/449.html http://www.ControlGlobal.com/articles/2008/017.html http://www.isa.org/Template.cfm?Section=Technical_Information_and_Communities&template=/ContentManagement/ContentDisplay.cfm&ContentID=64756 http://www.isa.org/Template.cfm?Section=Technical_Information_and_Communities&template=/ContentManagement/ContentDisplay.cfm&ContentID=64756 http://chemicalprocessing.com

Table of Contents Feed for the Digital Edition of Chemical Processing-August 2008

Chemical Processing- August 2008 Contents From the Editor ChemicalProcessing.com Field Notes In Process Energy Saver Compliance Advisor Protect your Plant What’s on Tap for Water? Keep Operations Safe Polystyrene Plant Gains Extra Output and More Process Puzzler Plant InSites Equipment & Services Adlits Product Spotlight/Classifieds Ad Index End Point

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.