Editorial team
InfoWeb Marketplace · Editorial team
Published on 1 October 2021 · 5 min read
How to Protect PLC Systems Against Security Threats?
InfoWeb Marketplace · Editorial teamPublished on 1 October 2021 · 5 min read
While increased connectivity offers considerable benefits for manufacturers, it also heightens the cybersecurity risk facing control systems, as explained by Steve Ward, Director of Applied Engineering for the EMEA region at Emerson.
As cyberattacks continue to evolve and become increasingly difficult to detect and neutralize, companies must make modernizing their response capabilities a priority. Adopting a risk-based approach to cybersecurity can make it easier to identify potential vulnerabilities and to make decisions based on the likelihood and impact of each vulnerability. Here are some common questions to ask and different answers for addressing risks when striving to stay one step ahead of emerging threats while making digital use easier:
The easier it is to monitor network activity, the faster the production site can react when an attack is detected, thereby reducing its impact. Consequently, one of the most important steps in protecting PLC and programmable controller control systems against security threats happens even before detection. Monitoring the network's communication ports makes it easier to identify unexpected protocols, connections and communications. While unexpected activity on a network does not necessarily constitute a threat, it should always be treated as a warning sign and investigated.
Most companies know that they must install anti-malware software on their operator interface and SCADA system servers. However, it is just as essential to install this type of software on every device that connects to these control systems (laptop, tablet, smartphone, etc.) or that may share a network with them. Indeed, a compromised auxiliary device can greatly facilitate access to a system's data. Applied across an entire site, centralized anti-malware software can block, detect and remove malicious software, which strengthens the effectiveness of the monitoring process.
Even when perfectly prepared, attacks and security breaches can occur. In addition to preventing them, it is therefore also necessary to ensure that damage is limited where applicable. To limit damage on a network, one can in particular implement a robust approach with security controls at several independent levels, all of which would have to be defeated in order to compromise the entire system. An appropriate cybersecurity strategy with reinforced defenses helps avoid security problems and plant shutdowns. Segmenting networks into logical zones makes it possible to neutralize internal threats which, although less frequent, are often the most devastating. Although it is more complex to implement and maintain than traditional segmentation, the creation of separate zones, often called ?advanced network segmentation?, is considered one of the best ways to protect control systems. In addition, production sites must at a minimum ensure a secure deployment using firewalls and segmentation to block unwanted inbound traffic, and isolate networks so that data can only be transferred to intended locations. The use of advanced or application firewalls is an ideal approach to strengthen this capability.
Another way to limit the effects of a breach is to use redundancy or to provide backup components, so that a system can continue to operate in the event of a hardware failure or security breach. Finally, one of the main ways to limit the impact of a security breach is to put in place effective and reliable business continuity or recovery processes and strategy, so that a breach can be dealt with before its effects spread and to mitigate subsequent threats.
Disabling unused communication ports and services is a simple and effective measure in this area. For their PLC and programmable controller systems, production sites should use suppliers with proven certifications such as Achilles, covering the technical security requirements for the design of a control system. Certifications allow suppliers to formally demonstrate the compliance of their control system with cybersecurity requirements.
Monitoring machine-to-machine communications on the site is another essential measure for preventing attacks. All communications must take place securely through industrial automation protocols such as OPC Unified Architecture (OPC UA), which offers robust security features consisting of authentication, authorization, encryption and data integrity. By monitoring network communications, newly opened ports or the protocols used can alert to a potential threat.
Human error is often one of the worst threats facing a company. To drive change, it is important to adopt appropriate behaviors and to make staff aware of the measures to take to mitigate risks. For example, one of the main security threats relates to the choice of passwords. Even today, expressions such as ?motdepasse? or ?123456? are among the most common passwords. It is therefore vital to stress to users the importance of choosing strong passwords and to explain to them how to do so.
Authentication must also be put in place between client applications and the server so that only authorized users can access the latter. If your system supports such a level of security, multi-factor authentication and role-based access control are the best options.
The main risk posed by remote network access stems from the fact that it allows hackers to gain deep access to the company from the outside, and that once this access is obtained, it becomes very difficult to prevent unplanned shutdowns, loss of control and data, etc. Companies must also audit their PLC network to locate any obscure access vector that could be exploited by a hacker, and regularly monitor access points. A company can implement a multi-factor authentication system, requiring the user to identify themselves using two or three different methods (?factors?) in order to access a device, an application or information.
Two-factor authentication is the most commonly used method in this area. It verifies identity using two of the following different factors: something known to the user (a password, for example), something in their possession (a magnetic card or a software token) or one of their physical characteristics (fingerprint or facial recognition).
As cyberattacks continue to evolve and become increasingly difficult to detect and neutralize, companies must make modernizing their response capabilities a priority. Adopting a risk-based approach to cybersecurity can make it easier to identify potential vulnerabilities and to make decisions based on the likelihood and impact of each vulnerability. Here are some common questions to ask and different answers for addressing risks when striving to stay one step ahead of emerging threats while making digital use easier:
What are the ways to monitor the network and detect threats?
The easier it is to monitor network activity, the faster the production site can react when an attack is detected, thereby reducing its impact. Consequently, one of the most important steps in protecting PLC and programmable controller control systems against security threats happens even before detection. Monitoring the network's communication ports makes it easier to identify unexpected protocols, connections and communications. While unexpected activity on a network does not necessarily constitute a threat, it should always be treated as a warning sign and investigated.
Most companies know that they must install anti-malware software on their operator interface and SCADA system servers. However, it is just as essential to install this type of software on every device that connects to these control systems (laptop, tablet, smartphone, etc.) or that may share a network with them. Indeed, a compromised auxiliary device can greatly facilitate access to a system's data. Applied across an entire site, centralized anti-malware software can block, detect and remove malicious software, which strengthens the effectiveness of the monitoring process.
How can the damage caused by a breach be limited?
Even when perfectly prepared, attacks and security breaches can occur. In addition to preventing them, it is therefore also necessary to ensure that damage is limited where applicable. To limit damage on a network, one can in particular implement a robust approach with security controls at several independent levels, all of which would have to be defeated in order to compromise the entire system. An appropriate cybersecurity strategy with reinforced defenses helps avoid security problems and plant shutdowns. Segmenting networks into logical zones makes it possible to neutralize internal threats which, although less frequent, are often the most devastating. Although it is more complex to implement and maintain than traditional segmentation, the creation of separate zones, often called ?advanced network segmentation?, is considered one of the best ways to protect control systems. In addition, production sites must at a minimum ensure a secure deployment using firewalls and segmentation to block unwanted inbound traffic, and isolate networks so that data can only be transferred to intended locations. The use of advanced or application firewalls is an ideal approach to strengthen this capability.
Another way to limit the effects of a breach is to use redundancy or to provide backup components, so that a system can continue to operate in the event of a hardware failure or security breach. Finally, one of the main ways to limit the impact of a security breach is to put in place effective and reliable business continuity or recovery processes and strategy, so that a breach can be dealt with before its effects spread and to mitigate subsequent threats.
What are the other ways to reduce the attack surface of PLCs?
Disabling unused communication ports and services is a simple and effective measure in this area. For their PLC and programmable controller systems, production sites should use suppliers with proven certifications such as Achilles, covering the technical security requirements for the design of a control system. Certifications allow suppliers to formally demonstrate the compliance of their control system with cybersecurity requirements.
Monitoring machine-to-machine communications on the site is another essential measure for preventing attacks. All communications must take place securely through industrial automation protocols such as OPC Unified Architecture (OPC UA), which offers robust security features consisting of authentication, authorization, encryption and data integrity. By monitoring network communications, newly opened ports or the protocols used can alert to a potential threat.
What is the best way to manage the authentication of PLC users?
Human error is often one of the worst threats facing a company. To drive change, it is important to adopt appropriate behaviors and to make staff aware of the measures to take to mitigate risks. For example, one of the main security threats relates to the choice of passwords. Even today, expressions such as ?motdepasse? or ?123456? are among the most common passwords. It is therefore vital to stress to users the importance of choosing strong passwords and to explain to them how to do so.
Authentication must also be put in place between client applications and the server so that only authorized users can access the latter. If your system supports such a level of security, multi-factor authentication and role-based access control are the best options.
What is the best way to isolate a PLC network?
The main risk posed by remote network access stems from the fact that it allows hackers to gain deep access to the company from the outside, and that once this access is obtained, it becomes very difficult to prevent unplanned shutdowns, loss of control and data, etc. Companies must also audit their PLC network to locate any obscure access vector that could be exploited by a hacker, and regularly monitor access points. A company can implement a multi-factor authentication system, requiring the user to identify themselves using two or three different methods (?factors?) in order to access a device, an application or information.
Two-factor authentication is the most commonly used method in this area. It verifies identity using two of the following different factors: something known to the user (a password, for example), something in their possession (a magnetic card or a software token) or one of their physical characteristics (fingerprint or facial recognition).