Industrial cyber security - why prevention is better than cure

Wayne Ashworth, Product Manager of industrial IT provider SolutionsPT, addresses the increasing threat to industrial cyber security and why prevention is better than the cure.

Over recent years, industrial cyber security has been creeping further up the agenda and become a topic which can no longer be ignored. The issue has been surrounded by hype similar to that surrounding 'Y2K' and has crossed into the national and consumer media, as well as industry press.

Although the infamous Stuxnet attack of 2010 was not the first of its kind on industrial IT systems, it was the first designed specifically to target specialist industrial automation. Since then, IT managers across the world have had to re-evaluate their security.

Nevertheless, some companies are still not heeding the advice to act. Security strategies are too often driven by individual experiences, and managers often wait until they become victims of attack before taking the matter seriously enough to make changes to their systems.

Cyber security for industrial automation

It has also become clear that traditional IT approaches cannot guarantee safety from cyber-attack and that industrial automation requires a tailored approach. Conventional IT methods tend to concentrate on preventing loss of confidential information, rather than ensuring reliability and integrity of systems, and ultimately avoiding downtime.

It is a mistake to assume that an attack will come from an external source, as security breaches from within an organisation can often pose the most dangerous and imminent threat. Although usually not deliberate, internal corruption is frequently the cause of costly disruption to production. Patching - which is the practice of using software to fix or update a computer programme or its supporting data - is designed to alleviate technical issues, but can often introduce more problems than it solves, particularly if the patching is poorly designed. Also causing major problems are viruses, which have long been the most familiar mode of attack for many companies' IT systems.

However, malware is also emerging as a common form of attack. This is a type of software used maliciously to steal confidential information, attack systems or disrupt operations. For example, one of our blue-chip clients fell foul to malware on its system when an employee inserted a USB stick into a machine, unaware that it contained hidden malware which was inadvertently brought in from a home PC, and transferred onto the company's network.

The real cost of industrial cyber security breaches

This situation can cause major disruption to production and even the briefest interruption can cost a company immeasurably. Any single incident could see production at a plant that usually runs 24/7 brought to its knees, costing hundreds of thousands of pounds, setting back its schedule significantly and ultimately damaging customer relationships, illustrating just how imperative it is to put the best possible protection in place.

In addition, manufacturers often have a raft of secret formulas, processes and techniques that are crucial to their brand's success - and so the theft, loss or destruction of these can also have a devastating impact. All of these things make them even more vulnerable to breaches in security, regardless of whether they are intentional or accidental.

Prevention is better than cure

All in all, prevention is definitely better than the cure. A combination of system design, specialist security products and on-going managed services would provide the ultimate defence against threats.

Traditionally, IT changes to operational systems are kept to a minimum. It is more common to take the opportunity to 'design-in' security considerations when specifying new architectures. But, increasingly, decision-makers are turning to more than just the regular precautions of firewalls and virus-checking software.

Typically recommended is a secure and preventative architecture where open ports and USB sticks are never allowed on the network. An overhaul of the business security system would be carried out in order to create a security package specifically designed for the individual company's needs.

Industrial cyber security risk assessment

An initial risk assessment will identify the security 'holes' in any operation. Its architecture would be examined and reviewed to identify potential weaknesses or flaws in the network security. Often this can take the form of poorly laid out network topology, or potentially exploitable areas such as legacy systems and PLCs that are not protected and therefore open to viruses, malware, and other hostile and intrusive software.

From this, recommendations can be made on how to close any security holes and help to tailor the correct approach for that particular company and its system. It may require a number of different elements to make a plant secure. A combination of the right policies, procedures, physical security, network security, computer security and device security are all considered. Threat protection solutions are then installed to provide high levels of control, and monitoring of any attempts to communicate with a system. It will also detect and prevent access to the plant network.

Ultimately, the greatest danger posed by security breaches to the industrial and manufacturing sector is the threat of downtime. Addressing these risks with the correct, most applicable approach is key to maintaining availability, minimising downtime and retaining customer relationships.

For further information about industrial cyber security, go to www.industrialit.co.uk.

SolutionsPT Ltd

Unit 1, Oakfield Road
Cheadle Royal Business Park
Cheadle
SK8 3GX
UNITED KINGDOM

+44 (0)161 495 4600

info@solutionspt.com

www.solutionspt.com

More from SolutionsPT Ltd

SolutionsPT achieves elite AVEVA Select status

Posted 1 month ago

The digitally transformed machine builder

Posted 2 months ago

Next Industrial Revolution?

Posted 2 months ago

Revolutionising industrial operations – from edge-to-enterprise

Posted 5 months ago

New benefits through HMI choice

Posted 5 months ago

SolutionsPT launches "˜Tech Day' Series

Posted 4 years ago

SolutionsPT and Schneider Electric host OT Cyber Security series

Posted 4 years ago

Wonderware UK announces new dates for Next Generation Roadshow

Posted 4 years ago

SolutionsPT signs Citect deal

Posted 5 years ago

Lucozade Ribena Suntory targets energy savings with Wonderware

Posted 5 years ago

Wonderware Next Generation Conference to showcase innovations

Posted 5 years ago

SolutionsPT strengthens product and marketing team

Posted 5 years ago

New General Manager for SolutionsPT

Posted 5 years ago

SolutionsPT targets growth with key appointments

Posted 5 years ago

Wonderware to host Continuous Improvement in Manufacturing event

Posted 5 years ago

SolutionsPT and ecom deliver mobile computing in hazardous areas

Posted 6 years ago

Wonderware UK to showcase the real-time analytics revolution

Posted 6 years ago

SolutionsPT launches new roadshow for UK and Ireland

Posted 7 years ago

SolutionsPT to provide specialist cyber security training

Posted 7 years ago

SolutionsPT urges businesses: act now on XP deadline

Posted 7 years ago

NeoDyne announced as new Premier Partner by SolutionsPT

Posted 7 years ago

Benefits of Thin Client architectures in manufacturing

Posted 7 years ago

Big data in manufacturing - how to make it work

Posted 8 years ago

SolutionsPT and NeoDyne rewarded by ACP

Posted 8 years ago

Thin client trends explored in industry roadshow

Posted 8 years ago

SolutionsPT hosts free events to showcase software technology

Posted 8 years ago

Wonderware brings mobile visualisation to the forefront

Posted 8 years ago

SolutionsPT provides KPIs on the move with new software

Posted 8 years ago

Wonderware team rewarded for achievements in technical support

Posted 8 years ago

New appointment is a SMART move for industrial IT company

Posted 8 years ago

Research reveals more virtualised technology in automation

Posted 8 years ago

New role at SolutionsPT to focus on industrial communications

Posted 8 years ago

Enhanced Wonderware software for data communication

Posted 8 years ago

Availability Virtualised in Automation roadshow dates

Posted 8 years ago

WAM software for effective alarm reporting management

Posted 8 years ago

White paper highlights solution to OEE manufacturing paradox

Posted 9 years ago

Welcome to the Internet of Things for Industrial Automation

Posted 9 years ago

everRun high-availability software prevents downtime

Posted 10 years ago

Next-generation PACs suit complex control tasks

Posted 13 years ago

Wonderware and Pantek restructure into SolutionsPT

Posted 14 years ago

WonderWorld / Pantek Project Excellence awards

Posted 15 years ago

ArchestrA Bulk Import utility for PLCs and HMIs

Posted 15 years ago

More technical articles

Login / Sign up