Chemical Processing - September 2007 - (Page 28)

can even be run as separate operations. Then you can end up with an IT versus operations/plant situation.” “Security needs to take a risk-based approach like that used in safety. So you need strategies to mitigate the risk. That requires more involved level of risk mitigation,” says Jim Cahill, marketing communications manager for Emerson’s Process Systems and Solutions business. And underpinning all this work on certification, defense-in-depth and risk-based approaches are those allimportant policies and procedures. “Policies and procedures are a quick win area. Managing something as simple as laptops or memory sticks can be crucial,” says Williams. Byres agrees. “All the technology in the world won’t help you if you don’t have the procedures in place.” Potential ISA role Vendors are not only working more closely with third parties such as Wurldtech, McAfee and Microsoft but also are working more closely with each other. “We, the suppliers, all believe cyber-security is not an area of differentiation — we need to do it,” stresses Emerson’s Cahill. “There’s been a lot of contact between users and manufacturers to see where we can work together with respect to cyber-security — we’re all very keen to do this,” agrees Invensys’s Williams. The latest initiative in this collaborative effort involves the Automation Standards Compliance Institute (ACSI), Research Triangle Park, N.C., which is sponsored by ISA. As CP was going to press ACSI was in the midst of lining up members among tier one chemical and oil companies to support establishing an ISA Security Compliance Institute (SCI). “The idea for the SCI came from a group of about 15 initial companies on a standing group,” says Andre Ristaino, ACSI managing director. “These included the larger suppliers of automation control products such as Invensys, Honeywell and Yokogawa plus the asset owners such as BP and Dupont. They put in the money to do a feasibility study.” This group has established the mission for the proposed organization. Unlike Wurldtech’s Achilles Certification mark, which is a third-party endorsement of product quality, the aim of the SCI is to decrease the time, cost and risk of developing, acquiring and deploying control systems by establishing a collaborative industry-based program among asset owners, suppliers and other stakeholders. ACSI says that a well designed and managed product-security certification process will reduce users costs and time commitment in product selection and deployment. For suppliers and integrators, the certification process provides a single conformance framework and an industry stamp of approval, resulting in faster time to market and lower development and integration 28 • September 2007 costs. ACSI adds this also will help standards bodies and government agencies developing industrial security specifications to provide better, field-tested standards that are clearly being followed by industry. An ultimate goal of the organization is to push the conformance testing into the product development life cycle, so that products are more intrinsically secure. A well-designed and managed product-security certification process will reduce user costs and time commitment. “The ISA Secure designation that is expected to arise from the effort will identify and promote security-standards-conformant products and systems,” notes Ristaino. “Certification provides the formal recognition of a product’s conformance to an industry standard security specification, creating a key differentiator for the product.” The idea is that by 2010 an ISA description on procurement documents will indicate whether a product is ISA Secure. The next stage, planned for 2012, would cover out-of-the-box secure interoperability between different vendors’ products. Procedures aren’t left out of the equation, either. “We’re starting from the point of view of what is most measurable and then moving on to what’s perceived as less urgent and harder to measure. So we start with the product, then its installation/integrity and finally the procedures,” says Ristaino. The due date for membership application returns was September 1, and Ristaino is quietly confident that the SCI will be up and running soon. “Yes, based on our feedback we are confident. We have the budget, full time staff and separate corporate identity that’s really needed to run a program like this,” he says. For his part, Eric Cosman hopes that the idea will be embraced quickly by some of the bigger vendors. “If a couple of large companies come on board, the others will go along, too. I’m very in favor of the idea of the SCI; it’s on the right track and the timing is right, too.” Cosman is involved in the ISA SP99 (Manufacturing and Control System Security) Committee, specifically as lead editor for the ISA SP99 Part 1 standard. Its publication would coincide with the SCI getting up and running, thus giving the organization a standard to measure against. Eric Byres very enthusiastically supports the proposed new standard, describing it as “absolutely necessary.” “Eventually some organization such as DHS is going to say that you have to comply with a certain standard. This would be relatively painless if that standard is already in place, but if it isn’t, it will be made up by a government official and that could be exceedingly painful.” CP www.chemicalprocessing.com 01101110110001000010011101100110011100011111001010101010011000010 http://www.chemicalprocessing.com

Table of Contents Feed for the Digital Edition of Chemical Processing - September 2007

Contents From the Editor Field Notes In Process Energy Saver Compliance Advisor Succeed at Simulation Rethink Your Approach to Process Safety Avoid Blending Blunders Get the Right Cartridge or Bag Filter Wireless Proponents Take HART Membrane Boasts Material Benefits Process Puzzler Plant InSites Chem Show Product Preview ISA Product Preview Equipment & Services Product Spotlight/Classifieds Ad Index End Point

Chemical Processing - September 2007

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.