Chemical Engineering May 2016 - 24

Indegy
that there have been recent attacks
on industrial control systems, so we
know it's possible to gain access to
an industrial facility via the control
system and cause damage, " notes
Baker. " we also know that attacks on
a chemical facility have the potential
to affect the broad population. "
for this reason, the U.S. Presidential
Policy Directive on Critical Infrastructure
Security and resilience,
which identified 16 critical infrastructure
sectors in need of strengthening
and protection, includes the chemical
industry. " The chemical processing
industry is listed as one - as a matter
of fact it's first on the list - of the
critical sectors of this country and, as
such, we have to consider that it is
likely to be part of any cyber attack
that might take place. If, how and
where such an attack would occur
would depend upon the motivation of
the attacker, but some type of attack
is obviously a real risk, " advises Schneider
Electric's Kling.
How to protect your facility
" Today's digital culture of bring your
own devices, higher connectivity between
the IT and the OT networks
and remote and cloud connections
can significantly increase the risk of a
cyber incident on an industrial control
system, " says Mike Baldi, chief cybersecurity
architect with Honeywell Process
Solutions (Houston, Tex.; www.
honeywellprocess.com). " However,
this risk can be managed by properly
implementing new technologies on
the industrial control system and integrating
appropriate security controls
with the new technologies. "
Determining the specific threats
is the first step to deciding which
of these technologies should be
implemented, according to the experts.
" Every facility - chemical
and otherwise - has its own targetrich
environment, " says Siemens'
Turmel. figuring out your facility's
threat landscape includes trying to
decipher who's likely to break in and
what their intent might be. "
Turmel calls this " threat-vectoring. "
" The first step in implementing a plan
is to work with a cybersecurity service
to determine the list of likely
adversaries, how they would gain
24
Figure 3. Indegy's cybersecurity solution comes in the form of a plug-and-play " box " that connects to a
port on the network and, from there, provides monitoring and visibility of the controls and core technologies
access and what they might be trying
to accomplish, " he says. " from
there, you conduct a vulnerability
assessment and threat modeling,
which becomes a guide to creating a
holistic plan that considers and protects
against specific threats to your
facility so you are sure you are implementing
the right tools. Then, when
you have everything in place, you do
threat-vectoring again and begin to
test your defenses. You continue to
add tools until you are as strong as
you choose to be. "
The participation of industrial control-system
suppliers, such as Siemens,
in customer control system
security continues to grow in importance.
All industrial control-system
owners should build a collaborative
relationship with their supplier, including
becoming familiar with the
supplier's cybersecurity organization.
" The key to finding a security service
provider is to find one that knows the
plant-floor space, as well as cybersecurity, "
notes Turmel. " They will coordinate
activities, from assessments to
implementation of managed services,
to monitoring or patch management,
to maintaining the infrastructure. "
" Assessments should also review
policies and practices concerning
Internet access to the control system
and the use of industrial control-system
protection for removable
media, such as USB sticks, on every
control workstation, " suggests Emerson's
Peterson.
Tools that assist with risk assessment
are also available. " we have
developed our Honeywell Industrial
Cyber Security risk Manager (figure
1) specifically to address cybersecurity
risk on industrial control
systems, " says Baldi. " The product
proactively monitors, measures and
manages cybersecurity risk for industrial
plants and systems. Through
an interface, it allows users to prioritize
and focus efforts on managing
cybersecurity risks that are most
important for reliable plant operations
to provide an ongoing situation
awareness of the cybersecurity posture
of a control system. "
Cybersecurity solutions
After the risk assessment, security
tools should be implemented, but
what types of solutions are being
offered? " There's a whole portfolio
of cybersecurity solutions and technologies
available to protect industrial
control systems, ranging from
end-point protection to network protection, "
says Baldi. " The solutions
portfolio includes both active and
passive tools, tools based on known
malware of cyber-attack signatures,
tools that restrict the allowed operations
and tools that are based upon
cyber-attack behaviors. "
Traditional tools. Traditional, signature-based
tools such as antivirus
solutions, firewalls and deep packet
inspection are still viable and advisable,
but with the shear number of
attacks and new viruses created
each year, experts suggest that
these alone are no longer enough to
protect an industrial control system.
" If all you have is a signature-based
approach, eventually the software
isn't going to recognize a malicious
signature and you'll be exposed to
a cyber attack, " says Kling. Instead,
updated versions of these tools
should be used in conjunction with
other solutions to provide a holistic,
proactive approach.
Whitelisting. whitelisting, a newer
signature-based solution, is currently
being updated, improved and
deployed for control systems, say
the experts. whitelisting is " superior
to, but the opposite of antivirus
technology, " says Emerson's Peterson.
" with antivirus tools, there
are signatures that are discovered
after viruses and malware become
known. when antivirus software
sees those signatures, the script is
prevented from running. whitelistChemiCal
engineering www.Chemengonline.Com may 2016

http://www.honeywellprocess.com http://www.Chemengonline.Com

Chemical Engineering May 2016

Table of Contents for the Digital Edition of Chemical Engineering May 2016