Chemical Engineering July 2016 - 39

Honeywell
what level of risk to mitigate, and which
risks they are willing to accept - their
risk appetite.
Since vulnerabilities and threats continually
evolve and expand (with 200,000
new variants of malware identified every
day, for example), the process must be
continuous. Automating the risk-analysis
process brings significant benefits to
the security of a plant.
Risk-analysis software does so, and
enables users to monitor networks and
system devices in realtime (Figure 4).
by consolidating complex site-wide
data, risk-analysis software significantly
improves the ability to detect threats
and identify vulnerabilities. Perhaps
more importantly, by calculating the
risk for each device in realtime, it enables
prioritization of risks by their potential
impact to the plant or business.
It also provides a realtime update when
the risks change due to new threats
or vulnerabilities to the system. Combined
with well-configured alerts, users
can assign resources more efficiently,
and respond more effectively and more
quickly to risks.
In the IT world, risk-analysis and
risk-management solutions have seen
widespread uptake, but there are difficulties
in simply transposing these to
an industrial setting. First, the requirements
and competencies of the users
- control engineers and operators,
as opposed to IT staff - are different.
An oT risk-analysis tool must present
results that are meaningful to non-security
specialists who operate the ICS
around the clock.
Second, allowance has to be made
for the oT environment. Many traditional
vulnerability assessment (VA) tools used
in enterprise systems may be unsuitable
(and possibly unsafe) when applied to
network activity in an ICS.
This is because they probe aggressively
to test for vulnerabilities, launching
a variety of network packets directed
at every possible port on an
end node. The responses are used to
determine the state of each port, and
whether the protocols are actively supported.
A database of known vulnerabilities
is then used to match the responses,
and then further scanning of
the device is attempted.
There are two key problem areas with
this technique.
* Non-standard network traffic into
poorly managed ports can cause unintended
consequences - including
locking up a communications port,
tying up resources on the end node,
or even hanging up an entire end
node. This type of probing can reveal
weaknesses in the configuration or
programming of applications that
results in unintended consequences
* Network scanning can increase the
load on an end node to an unmanageable
level, resulting in a denial
of service (with the node unable to
complete normal operation), or even
a node crash. To avoid this vulnerability,
scanners must be " throttled "
properly to protect both the end
nodes as well as the network latency
and bandwidth
An IT VA tool may therefore introduce
risks to the safe operation of an ICS, as
much as it may identify them.
essentially, realtime risk analysis in an
oT environment must be tailored to ensure
that it never interferes with normal
plant operation or control. It must also
provide realtime, actionable information
that can be used by operators, security
administrators and business leaders.
VA tools tailored to the ICS environment
are now becoming available, and
are seeing good uptake. with the scale
of the cybersecurity challenge continually
growing, they are likely to become
an increasingly important tool in helping
operators focus and tailor their cybersecurity
strategies.
Next-generation firewalls
In IT systems, firewalls are among the
most widely used cybersecurity measures.
while antivirus software protects
the end nodes, the firewall monitors and
controls network traffic based on conChemiCal
engineering www.Chemengonline.Com july 2016
39
Figure 4. By compiling complex, sitewide
data, risk-management software
can improve the ability of plants to detect
threats and identify vulnerabilties
http://www.Chemengonline.Com
Chemical Engineering July 2016

Table of Contents for the Digital Edition of Chemical Engineering July 2016
