POWER February 2014 - 41

InstrumentatIon & Control
physical characteristics of the system under
control. Engineers have studied these problems
and created mechanisms that respond
before the conditions affect production. But
these problems involve physical laws and
forces that are deterministic and (to an extent)
predictable.
Cybersecurity issues are different; they
involve a human intelligence. Though the
forces of nature are impressive, they are not
clever, nor resourceful, nor cunning. Exploits
and vulnerabilities are created to defy and
change the rules of systems they target (see
sidebar " How the Rules Have Changed " ).
The Lack of Security in Control
Systems
Most commercial software now is built to enforce
good security principles. For instance,
when navigating to a banking website to
make a transaction, there are multiple layers
of security so that the bank has a reasonable
belief that a user is authorized to make
a transaction.
Industrial control systems don't possess
these mechanisms. An entity that can communicate
with a control system can make
changes that should be reserved for operators
and engineers. The only limiting factor
is how difficult the learning curve is when
learning to speak to the control system. Lack
of security was built in during original development,
and it hasn't changed for most control
products.
For example, Project Basecamp was a
Digital Bond project in 2011-2012 to evaluate
and catalog the security vulnerabilities
present in several programmable logic
control (PLC)-based controller platforms.
What was found was expected: The systems
under test had numerous issues that an attacker
with communications could exploit
to alter a process.
Digital Bond researchers found that
configurations could be changed or their
firmware altered. Many systems had undocumented
features and accounts that gave
new privileges when accessed, and several
systems could be easily crashed with a single
command.
The conclusion was clear: Control system
development has not kept pace with modern
cybersecurity issues.
Compounding the lack of security in control
systems is the tendency for those systems
to fail when exposed to network traffic
and data that is common on corporate networks
and the Internet but that exceeds the
original design.
Experience points to a single conclusion:
Malicious programs or people who can communicate
with a control system are able to make
changes, operate, or crash a system entirely.
February 2014 | POWER
1. Typical automation network setup. This diagram shows external networks and
the distributed control system (DCS) network as well as a buffer zone called a " demilitarized
zone. " This demilitarized zone is used for systems that communicate with specific systems in
the DCS network and with limited systems on external networks. Source: Michael Toecker
External networks
Including Internet
External
firewall
Demilitarized
zone
Internal
firewall
Distributed control
system network
Remote
access
host
File transfer
server
Performance
monitoring
Operator
workstation
DCS
controller
Engineer
workstation
Historian
Notes:
Tier 1 systems may communicate to external networks
Tier 2 systems may communicate with Tier 1 systems
Tier 3 systems may only communicate with Tier 2 systems
Establish a Perimeter
Because of the vulnerability of control system
software and hardware as it stands today,
a strong network perimeter is vital (Figure
1). There are three goals when establishing
a perimeter:
■ Prevent external entities from accessing
the control system networks and devices
(see sidebar " Example of Excessive Automation
Capability and Risk Reduction " ).
■ Prevent control system networks and devices
from accessing external entities.
■ Limit access, in cases where access to or
from control systems networks and devices
is required to meet a valid business
need, to the minimum capability necessary
to get the job done.
Though there is a tendency to focus on IT
connections, don't ignore automation connections.
Automation connections are often a
direct route to the internal workings of your
system, and they are often configured for a
lot more capability than is required for functionality.
External automation connections
are often done with protocols that are wellknown
to engineers and security professionals.
Additionally, the methods used for these
automation connections have changed over
Example of Excessive Automation Capability and Risk
Reduction
An engineer at a coal mine-mouth plant
has identified that her distributed control
system (DCS) has a Modbus connection
to a coal-handling facility, run by
a separate mining subsidiary. This is an
external connection, as the responsibility
and accountability for the mining
subsidiary is not directed toward the reliable
production of power. The connection
feeds necessary operational data into the
DCS regarding coal volume, and it can't
be removed.
When evaluating the Modbus connection,
the engineer discovers that while
www.powermag.com
the handling facility only uses a small
subset of points, the connection allows
access to a chunk of points the handling
facility staff have no need to access and
that could cause operational issues.
Recognizing that the mining facility
has very little responsibility and accountability
for power plant operations,
she recognizes that the extra points are
a risk to her operation. She takes steps to
limit the points available via Modbus to
only those necessary through the engineering
application, and removes control
points entirely.
41

http://www.powermag.com

POWER February 2014

Table of Contents for the Digital Edition of POWER February 2014