Securing your system: five steps to better industrial security

According to the Global State of Information Security Survey 2016, 38 per cent more security incidents were detected in 2015 than the previous year. As a result, industrial businesses across the world are implementing new strategies to improve security.

Reassuringly, 91 per cent of survey respondents have a risk-based security framework in place, but the most cited source of compromise still lies with employees. Rather than jumping to the conclusion that these compromises are intentional, consider how much the usual employee actually knows about keeping your system safe.

Here Reinhard Mayr, product manager of industrial automation software specialist, COPA-DATA discusses the five vital steps any manufacturer can take to improve the security of connected automated systems.

Assess existing systems to identify potential threats
For most automated systems, an integrated user administration service is used to protect information and stop unauthorised personnel from gaining access. However, for the added security necessary in today’s facilities, COPA-DATA recommends encrypting all data that is transmitted over networks to other stations and companies. When the information reaches the receiving end, digital certificates can be implemented to assure the recipient that the information is legitimate and hasn’t been tampered with during transmission.

However, for automated SCADA systems, encrypting data can be a disadvantage to productivity. Transmission of encrypted data can only be done over a high-performance network, lengthening the process for standard users. Also, for bigger facilities using more than one system, the level of encryption needs to be consistent. If one system is working at a lower level, then money and resources are being wasted encrypting more extensively across other networks.

SCADA engineers need to identify the security risks in their application and pinpoint what data needs to be protected. For example, if employee training records were to be accessed, the consequences wouldn’t be as drastic as, per say, if more private product specification documents were instead compromised.

It’s logical to assume that many companies have confidential product information stored on their network. The last thing they would want is for this private data to be made available to competitors and the wider audience, or worse destroyed, as it could mean losing years of research and significant product advantages just because of one security flaw.

Set up a SCADA security system
Trends like Industry 4.0, Smart Grids and Smart Factories are all opening systems up to security risks. Previously, manufacturing and IT departments had isolated systems, increased connectivity is bringing the two together. It is almost impossible to share information over a network and not risk unauthorised personnel gaining access. However, industrial automation software, such as COPA-DATA’s zenon has the ability to encrypt data across the network and provides centralised user administration, so obstructions are in place to stop breaches.

The ability to set parameters is one of the most significant features that zenon provides to strengthen industrial security. Standard products, firewalls and interfaces that open communication ports are usually not configured, meaning intruders can see which doors are open. zenon fits into local settings, meaning the open ports aren’t as easily identified. Think of it as zenon camouflaging your system’s weakest points.

Provide additional security for sensitive information
When implementing security measures, it’s important for the user to decide what information is considered sensitive to the company. In an ideal world, everything would be encrypted, but cost and transmission issues will usually impede this. A solution would be to identify the areas with a higher risk of a potential security breach and use your findings to design your counteractions.

While the standard features of zenon make networks secure to external threats, potential threats from inside the facility still need to be considered. Although it’s something that most companies don’t like to think about, these situations are increasingly common. The easiest way to stop internal threats is to give only one or two users access to a security system’s project data. This way, security features can’t be shut down by unauthorised personnel and companies can rest assured their system is secure.

Keep your policy updated
When setting up your initial security policy, commitment from CEOs and management is extremely important as the most challenging step is ensuring that the entire workforce has a common mindset. If there are breaches in one area of the company, protection measures elsewhere can become obsolete.

Your security policy should include a regular risk assessment, carried out at least once every twelve months. This allows you to identify potential breaches and assess how vulnerable your system is to attacks. There needs to be a spread of knowledge within the company on the growing importance of cyber protection, so ensure that staff regularly engage with the policy. Staff members need to know that cyber attacks aren’t limited to standard office computers.

Security is an issue throughout the increasingly connected production line and everyone needs to be familiar with the company cyber security policy.

Train the team
When new industrial automation software is implemented, the provider should ensure standard training on all of its features, from operating the user administration platform, to identifying encryption requirements. COPA-DATA runs dedicated workshops with customers to help establish provisions based on the features that zenon offers.

The current problem with internal security training is that the majority of industries aren’t aware of the risks. They may have heard of the term cyber security, but still associate it with office environments. The energy sector shows the most awareness because of recent smart grid breaches. However, in many other sectors that use industrial automation, there’s a low level of knowledge, which correlates to organisations’ levels of commitment to improving their cyber security.

Over the past few years, the amount of security breaches has been rapidly increasing. To counteract this, companies should be prepared to increase their focus on the topic and employ the help of Chief Information Security Officers or external specialists. If your staff are aware of the consequences of a security breach, they may be more willing to make changes to current procedures.

Not all internal security breaches happen intentionally, and it’s likely that your employees don’t consider them as they go about their day-to-day activities. Following these five simple steps can give you peace of mind, a workforce that is engaged and on board with security policies and a secure automated system.

[su_button url=”https://www.copadata.com/en-gb/” target=”blank” style=”flat” background=”#df2027″ color=”#ffffff” size=”10″ radius=”0″ icon=”icon: arrow-circle-right”]For more information on COPA-DATA click here[/su_button]