Chemical Engineering May 2016 - 22

Newsfront
Protecting Your Industrial
Control System
A holistic and proactive approach to cybersecurity can help protect your
industrial control system from hackers
In BrIef
HOw HACKErS GAIN
ACCESS
IS THE CPI AT HIGHEr
rISK?
HOw TO PrOTECT YOUr
fACIlITY
CYBErSECUrITY
SOlUTIONS
AN ONGOING PrOCESS
Honeywell
I
n December 2015, 80,000 homes in the
Ukraine were left without power when a
cyber attack took down the electrical infrastructure.
Investigations suggest that
hackers used malware in conjunction with
remote access to industrial control systems
to directly interact with control systems, infect
workstations and servers with malware,
damage control-system hosts on workstations
and servers, and block calls to customer
call centers that would have alerted
power companies to the outages.
A year prior, a German steel mill was the
victim of a cyber attack. Investigations revealed
that attackers used a spear phishing
campaign - an email that appears to be
from an individual or business known to the
recipient, but isn't. Instead, it's from hackers
who want financial, personal or login information
found on that user's PC. The attack
was aimed at particular individuals in the
company to trick them into opening malicious
links. The opening of the links provided
hackers with login information that granted
them access to the plant's network and control
systems, resulting in failure of parts of the
plant and the inability to properly shut down
a blast furnace, causing " massive damage "
to the equipment.
Clearly, as more industrial control systems
connect to the Internet, they are
becoming accessible to skilled hackers,
resulting in an industrial landscape that is
open to attack, an especially scary prospect
for chemical processors.
How hackers gain access
" As we integrate more digitalization into our
lives, we are increasing the attack surface
available to hackers, " says Andy Kling, director
of cybersecurity and software practices
with Schneider Electric (Andover, Mass.; www.
schneider-electric.com). " The use of tablets,
smart phones and cloud storage is expanding
at an exponential rate and, as a result, cyber
22
Figure 1. The Honeywell Industrial Cyber Security Risk
Manager specifically proactively monitors, measures and
manages cybersecurity risk for industrial plants and systems
attacks are more likely to avoid traditional security
tools and infiltrate the workplace. Industrial
targets aren't necessarily secure on this
fuzzy perimeter of our digital lives. "
As processors get smarter regarding cybersecurity,
so too do hackers, who realize
that the weakest link in the defense of industrial
control systems is the humans who
interact with them. " By tricking an employee
into clicking on a link via a spear-phishing
campaign, attackers can melt away defensive
barriers, gain access to control systems
and immediately take over the digital world
of the plant, " warns Kling. " Once they do
that, all bets are off. "
In addition, attackers can also enter a network
via malicious links embedded in advertisements
on websites where employees
may browse, says Neil Peterson, director
of DeltaV product marketing with Emerson
Process Management (Austin, Tex.; www.
emersonprocess.com). " Hackers can buy ad
space on a reputable website and, embedded
in that advertisement, can be malware.
If an employee clicks the ad and your system
is unpatched, hackers just injected malware
onto your system and, from there, can begin
to take control, " he says.
Another common point of entry is universal
serial bus (USB) sticks. " People use them
and aren't aware that they contain malware.
They plug [a USB stick] into their computer
with the intention of moving data and acciChemiCal
engineering www.Chemengonline.Com may 2016
http://www.emersonprocess.com http://www.schneider-electric.com http://www.Chemengonline.Com
Chemical Engineering May 2016

Table of Contents for the Digital Edition of Chemical Engineering May 2016
