Chemical Engineering October 2016 - 66

partial picture of what is happening
within the overall control network.
In our example, the remaining 80%
of cyber assets came from the proprietary
industrial control systems,
such as distributed control systems
(DCS), programmable logic controllers
(PLC), or safety instrumented
systems (SIS). Unlike a workstation,
ICS systems have no standard
protocols to pull detailed configuration
information (such as I/O cards,
firmware, software installed, and
control strategies).
There is also no option to put an
agent on such systems to push data
out, as doing so invalidates vendor
support. These systems give
hackers the greatest opportunity to
wreak havoc in a plant, and they also
create opportunities for well-intentioned
engineers to make mistakes
that adversely affect operations.
Create a cyber asset inventory
Efforts to collect an inventory of
cyber assets within a control network
typically take three forms - manual,
vendor-supplied, and IT-only. The
following discussion examines the
positives and negatives of each approach.
Manual
inventory. Manual gathering
of inventory data is the most
prevalent approach used today.
Companies will send engineers into
plants to perform a physical inventory,
and they will gather a limited
set of common data points, related
FIGURE 2. Knowing, in detail, the full extent of the facility's (and the company's) cyber assets is a critical
step for developing a plan to both prevent and respond effectively to potential cybersecurity threats
to such information as manufacturer,
model and version. The data are
consolidated in a spreadsheet and
used organizationally.
This approach is convenient, but
is not economical, because engineers
walking a plant are expensive
resources and having them carry out
inventory duty has high opportunity
costs. Similarly, the manual gathering
of inventory data is inherently prone
to errors due to the human element,
and this approach will typically yield
an incomplete assessment, potentially
missing swaths of important
information, including control logic
and shutdown interlocks. Such a
data inventory can also quickly become
outdated over time. Finally,
there are few options for automaPLANT
DESIGN RUNNING IN OUR VEINS -
YOUR FUTURE ON OUR MIND
Free selection rather than ready-made kits:
we integrate processes - not just parts - for
more efficiency, flexibility and security. Innovative
plant design from the plant architects.
tion using a simple spreadsheet, as
such a tool does not enable security
policy monitoring and managementof-change
processes.
Vendor-supplied solutions. Control
system vendors often provide a
managed service offering that essentially
throws additional outside
help at manual inventory efforts. All
of the problems with a manual inventory
still exist, but internal resources
noted previously are freed to do
other high-value duties. Many vendors
will also offer tools to manage
cyber asset inventories, but these
tools rarely extend beyond their
own control systems. Companies
that adopt such tools run the risk of
creating solution silos that ultimately
add complexity to a cybersecurity
The architect of your visions
Hall 9/B41
www.zeppelin-systems.com
Circle 41 on p. 78 or go to adlinks.chemengonline.com/61500-41
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
031401605_AZ-Messe_K_Chemical Engineering_200,4x95,6mm_RZ.indd 1
OCTOBER 2016
61
08.09.16 15:54

http://www.zeppelin-systems.com http://adlinks.chemengonline.com/61500-41 http://WWW.CHEMENGONLINE.COM

Chemical Engineering October 2016

Table of Contents for the Digital Edition of Chemical Engineering October 2016