Chemical Engineering September 2010 - 19

Westfalia Separator®
in cyber security. An example of this
is the Roadmap to Secure Control Systems
in the Chemical Sector (www.uscert.gov/control_systems/pdf/ChemSec_Roadmap_First_Edition.pdf),
which
is a document published in September
2009 that presents a security
vision for industrial control systems
in the CPI, proposes a comprehensive
plan for implementation, and identifies
milestones over a ten-year period.
Preparation of the roadmap was truly
a cooperative effort that included the
DHS and a substantial number of volunteers
from CPI companies.
Citing the roadmap and other efforts
in cyber security standards,
Ernest Rakaczky, portfolio manager
of control system cyber security for
Invensys Operations Management
(Plano, Tex.; www.iom.invensys.com)
says " In a lot of ways, the chemical
sector is leading the way. " Rakaczky
stresses the importance of control
and IT experts working together toward
the common goal of security. He
says that typically, firewall technology
is changing faster than controller
technology. With a core competence
in control, Invensys builds its control
systems so that they can easily be
updated with the latest security systems.
This built-in ability to update
the control system allows the user to
take advantage of the newest technologies
without large investments.
Threats to control systems can come
from a variety of sources. Firewalls
are very effective at preventing intrusion.
People with access to the control
system, however, are a credible threat,
whether through accidental means
(such as unwarily using personal devices
or USB sticks), or through intentional
means (such as by a disgruntled
employee for example). " A malicious
insider is the tough threat, " says Graham
Speake, principal systems architect
for Yokogawa Corp. of America's
(Newnan, Ga.; www.yokogawa.com/us)
IA Global Strategic Technology Marketing
Center in Dallas, Tex. Threats
to control systems are " no longer theoretical "
says Speake, citing the recently
discovered Stuxnet worm that was
distinctly targeted to attack a specific
control system. " One way to increase
security, " says Speake, " is to build
more security into products so that
no matter how you put them together
they are still secure. " Yokogawa says
it has taken a step in that direction by
developing the world's first field wireless
devices based on the ISA100.11a
industrial wireless communications
standard (Figure 2).
What makes the Stuxnet worm such
big news in the control community is
not just that it was deliberately made
to attack control systems, but that it
is highly sophisticated - enough so
that it attacks a previously unkown
vulnerability and it wraps libraries to
hide PLC programming changes. " The
worm is a wake-up call. A lot of operations
people and even security decision
makers had still been on the page that
malware is only an incidental threat
to control systems and physical processes,
and that sophisticated threats
... were not something they had to
worry about. All that has changed
with Stuxnet, " says Andrew Ginter,
chief security office with Industrial
Defender, Inc. (Foxboro, Mass.; www.
industrialdefender.com).
A basic principal of cyber security
plans offered by Industrial Defender
is Defense-in-Depth (Figure 3), which
presumes that no single mode of security
mitigation is impenetrable and
therefore several layers are needed.
The company's approach includes
three major categories including: intrusion
prevention, which is applied
at network perimeters with a firewall,
and within servers and end-point devices
via the recently introduced Host
Intrusion Prevention System (HIPS);
access management, which provides
rigorous authentication and authorization
before allowing access through
the perimeter; and monitoring and response,
which integrates intrusion detection,
performance monitoring and
event management.
Third-party management. An interesting
shift is occurring in that more
companies are looking for outside security
management of not only physical
security systems, but also cyber
security systems. Ginter explains that
while there has been a reluctance to let
information out to third parties, companies
are getting more comfortable
with this through cloud computing and
" software as a service " , where computers
and functionality are rented. He
capitalcare
Comprehensive Protection
for Your Investment
You are pursuing a clear objective
with your investments: a high
level of performance at minimum
cost. We have customized
our range of services to take full
account of this throughout
the entire life cycle of your centrifugal
technology. Westfalia
Separator®
capitalcare is the
modern, appropriate response
to your growing needs for process
effi ciency and availability
of your plant. Our tailor-made
service products mean you benefi
t from the competence and
experience of the technology
leader:
Field service
Original spare parts
Repairs
Condition monitoring
Training
Service level agreements
Applied consulting
Your direct route to 24 / 7 service:
www.westfalia-separator.com / service
Liquids to Value
GEA Mechanical Equipment
GEA Westfalia Separator
Werner-Habig-Straße 1 · 59302 Oelde (Germany)
Phone +49 2522 77-0 · Fax +49 2522 77-2089
www.westfalia-separator.com
Circle 16 on p. 62 or go to adlinks.che.com/29254-16
SE-2-60-002

http://www.us http://www.cert.gov/control_systems/pdf/Chem http://www.iom.invensys.com http://www.industrialdefender.com http://www.westfalia-separator.com http://www.yokogawa.com/us http://www.westfalia-separator.com http://adlinks.che.com/29254-16

Chemical Engineering September 2010

Table of Contents for the Digital Edition of Chemical Engineering September 2010