Unleash Security Synergies in Your Connected Chemical Plant

The same IIoT technologies that can improve plant performance can also help protect it from cyberthreats

You don’t typically consider victims of cyberattacks to be lucky, but that’s the case for one petrochemical plant in Saudi Arabia. The plant was infected with the malware Triton. And if the malware had done what experts say it was capable of doing, it could have put lives in danger by releasing toxic gas or causing explosions at the plant [1]. Luckily, the code was flawed, and the only outcomes were a pair of emergency shutdowns triggered by the flaw.

Still, incidents like this serve as a reminder that cybersecurity breaches can be more than disruptive and expensive. They can also be dangerous for plants and people.

Fortunately, securing an organization’s connected chemical operations doesn’t need to compete with efforts to improve its bottom line, because the same digital capabilities that can make a company more competitive can also help protect its plant.

 

Five security opportunities

As engineers design and implement their chemical cybersecurity strategy, they should capitalize on the aspects of their connected operations that have shared security and operational benefits. Five key examples include the following:

1. Real-time inventory data

It’s hard to mitigate cyberthreats if you don’t know what assets in an operation might targeted by cyber-actors. That’s why a comprehensive, real-time understanding of your connected equipment and systems is essential.

Historically, taking an inventory of your equipment required physically sending someone to all of your production sites. This process is time consuming, especially if you have dispersed units, multiple sites or remote operations. It’s also limiting, because the data captured only gives you a snapshot in time of your inventory.

The Industrial Internet of Things (IIoT) is changing this. Now, using software or connected services, you can use the same communications path as your control systems to gather asset data.

With a continuous, real-time inventory of your operational equipment, you can keep up with risks to your production environments. For example, you can quickly see if security advisories, firmware updates or new patch releases are relevant to your installed base.

You can also better manage your operations for the long-term. For example, the data can help you track lifecycle risks and plan your modernization strategy.

2. Process visibility

It’s not enough to just know what assets you have. You also need real-time visibility into how, when and where people are accessing or manipulating them.

A threat-detection service can identify normal behavior across your chemical network and constantly monitor your operations for deviations from that baseline. Operators can then be alerted of any irregularities or potential threats in real time.

This visibility can help you uncover a threat, such as an external security attack, at multiple stages, including:

• When they first gain a foothold on your network
• When they are moving around the network to do recon on your operations
• When they are making changes to assets (systems, equipment, networks) to carry out an attack

The service can also help you detect more common human errors and operational issues that, while lacking malicious intent, can still disrupt your operations. For instance, it could reveal that an original equipment manufacturer (OEM) remotely accessed and made changes to a controller in the wrong location.

3. Asset management support

A recent study revealed that a widening skills gap in manufacturing jobs may leave an estimated 2.4 million positions unfilled between 2018 and 2028 [2]. To lessen the impact of this skills shortage, more companies are looking to outsource the responsibility of managing their industrial control assets. And who better to monitor, maintain and modernize the assets than the companies that supply them?

Such service providers may offer the capabilities to continuously scan a plant’s process-control network to identify, interrogate and monitor control hardware, capturing key data  (such as its part number, series version and firmware version) and tracks status, health and parameter changes.

As an added benefit, such services may help plants to comply with corporate cybersecurity policies. Another potential operational improvement that can be realized is more proactive maintenance that helps to reduce operating costs and increase throughput.

 

4. Disaster Response and Recovery

In the event of a security incident or even an unexpected downtime event, you need a plan and policies in place to help you recover as quickly as possible. This will help you minimize the impact of the incident and maximize your uptime.

A response plan can help you contain, eradicate and quickly recover from cybersecurity threats to your chemical operations. It should include the steps workers need to take to return to a fully operational state.

Policies are just as crucial. For example, such policies should define a method for backing up your critical operational assets. Without backups, you could find yourself the victim of ransomware and having to decide: Should we pay someone to re-engineer our systems or pay the attacker to get back control of our current systems?

One solution, which can be required in your policy, is asset management software. It can automatically back up application codes and configurations for devices like controllers, drives and operator workstations.

Implementing a virtual infrastructure is another way to improve disaster recovery. For example, one chemical producer deployed a distributed control system built on a virtualized infrastructure in one of its new plants. The application- and location-redundant solution provides backups and fault tolerance in its network, systems and application architectures.

5. Security best practices

There are security best practices — known as defense-in-depth — that every chemical company should use to achieve a fundamental level of security [3].

Some are simple, like changing the default logins used in any new network equipment you purchase. Software with authentication and authorization is another best practice. It allows your information technology (IT) or security team to define who can access the software, what actions they can take and where they can perform those actions.

Other security fundamentals are more complex. For instance, control and business system traffic should not be treated the same on your network. If the network infrastructure that handles both these traffic types goes down, then your entire enterprise is no longer functional. That’s why you should use an industrial demilitarized zone (IDMZ) to segment control and business system traffic.

In addition to securing your operations, these best practices can also have operational benefits. Network segmentation, for example, allows you to connect remote employees and partners with on-site workers to more quickly troubleshoot and resolve downtime issues.

Start with a strategy

You can optimize and secure your operations in tandem in a connected chemical plant. But first, you need a cybersecurity strategy to know where you can improve performance and where your cybersecurity threats lie. Then you can see where these two areas overlap.

For help getting started, reach out to a service provider that can help you plan, implement and optimize your connected chemical plant strategy. ♦

Edited by Mary Page Bailey

References

1. Giles, M., Triton is the world’s most murderous malware, and it’s spreading, MIT Technology Review, March 5, 2019.
2. Deloitte Perspective, 2018 skill gap in manufacturing study, November 2018.
3. Rockwell Automation and Cisco, Industrial Networks Design Guides: Converged Plantwide Ethernet (CPwE).

Author

Ramon Farach is the Global Chemical Industry Technical Consultant for Rockwell Automation (Email: [email protected]). He is responsible for providing industry and technical insights to help understand and solve customer challenges, develop product and service messaging, and support product development. Farach has 20 years of chemical industry experience in process engineering, operations support, process design, installation and commissioning, research and development, process control and environmental health and safety. He holds a B.S.Ch.E. from Georgia Tech and is a certified ISA/IEC 61511 SIS Fundamentals Specialist. He is located in Nashville, Tenn.