Get grounded; No hysteria

Instead of getting caught up in the hysteria of vulnerability or an attack, manufacturers have to understand their core technologies and make sure they protect them.

07/13/2011


ISS SourceInstead of getting caught up in the hysteria of vulnerability or an attack, manufacturers have to understand their core technologies and make sure they protect them.

“Yes, bad things do exist in the real world,” said Tyler Williams, co-founder and president of Wurldtech during his Tuesday talk at the 2011 Siemens Automation Summit in Orlando, Fla., entitled, “How to determine threats and risks of industrial control systems.”

“The world is becoming more connected and there is some apprehension about that.”

The end result of an attack is very real; it could be financial, health and safety, and a risk to your company’s reputation, Williams said.

“If you lose view and control, bad consequences can happen,” Williams said.

“The reality is there is a strong integration with previously isolated domains such as the enterprise, R+D, and engineering,” said Stefan Woronka, director of industrial security services in process automation at Siemens, who gave the talk with Williams. “The days of air gapped systems are history. Now you see the rapid adoption of IT into the work space.”

At the end of the day, though, users have to understand what their system are and where their priorities stand. In other words, they should go about doing a risk assessment to understand just what and where they have to protect.

After a risk assessment a company has to come up with a strategic plan. “You have to be proactive in the prevention and detection of bad things,” Williams said.

In addition, manufacturers have to develop roles and responsibilities for personnel. “You need a mission statement, but understand if the security issues does not affect the process, then don’t worry about it right now,” he said.

Another thing users have to do is demonstrate and define success factors. “Make sure security is included in all elements,” he said.

When you do call in a security expert, and they find vulnerability, you have to ask “How easy was it to find and what was the impact?” This way if the problem is not part of your core system, then you shouldn’t over react and spend money on something you don’t need to address right away.

Manufacturing engineers also have to understand when you start using terms like defense in depth you have to speak the same language as those who will fund any kind of security scenario. You must talk in dollars and cents.

“Defense in depth works,” Williams said, “but you have to put it in the business factors that catch the eye of executives. You should treat security like any budget line item, and make a strong business case first.”

- Edited by Amanda McLeman, Plant Engineering, www.plantengineering.com



No comments
Consulting-Specifying Engineer's Product of the Year (POY) contest is the premier award for new products in the HVAC, fire, electrical, and...
Consulting-Specifying Engineer magazine is dedicated to encouraging and recognizing the most talented young individuals...
The MEP Giants program lists the top mechanical, electrical, plumbing, and fire protection engineering firms in the United States.
Water use efficiency: Diminishing water quality, escalating costs; Lowering building energy use; Power for fire pumps
Building envelope and integration; Manufacturing industrial Q&A; NFPA 99; Testing fire systems
Labs and research facilities: Q&A with the experts; Water heating systems; Smart building integration; 40 Under 40 winners
Maintaining low data center PUE; Using eco mode in UPS systems; Commissioning electrical and power systems; Exploring dc power distribution alternatives
Protecting standby generators for mission critical facilities; Selecting energy-efficient transformers; Integrating power monitoring systems; Mitigating harmonics in electrical systems
Commissioning electrical systems in mission critical facilities; Anticipating the Smart Grid; Mitigating arc flash hazards in medium-voltage switchgear; Comparing generator sizing software
As brand protection manager for Eaton’s Electrical Sector, Tom Grace oversees counterfeit awareness...
Amara Rozgus is chief editor and content manager of Consulting-Specifier Engineer magazine.
IEEE power industry experts bring their combined experience in the electrical power industry...
Michael Heinsdorf, P.E., LEED AP, CDT is an Engineering Specification Writer at ARCOM MasterSpec.