Automation Security

Introduction Over the past decade, the traditional corporate network has come under siege from a proliferation of viruses and malicious intruders. As a result, numerous network security technologies, methodologies, and policies have been developed to secure the business system. In comparison, process control systems, with their reliance on proprietary networks and hardware, have long been considered immune to cyber attacks. Now, with the move to open standards such as Ethernet, TCP/IP, and web technologies, the plant floor requires its own security procedures to eliminate undesirable access to production systems and to maximize the uptime and efficiency of process networks 1. Web-based Automated Process Control systems are a new type of applications that use the Internet to control industrial processes with the access to the real-time data. Supervisory control and data acquisition (SCADA) networks contain computers and applications that perform key functions in providing essential services and commodities (e.g., electricity, natural gas, gasoline, water, waste treatment, transportation) to all Americans. As such, they are part of the nation's critical infrastructure and require protection from a variety of threats that exist in cyber space today. By allowing the collection and analysis of data and control of equipment such as pumps and valves from remote locations, SCADA networks provide great efficiency and are widely used 2. IEEE Standard 1402-2000, Guide for Electric Power Substation Physical and Electronic Security, states: " The introduction of computer systems with online access to substation information is significant in that substation relay protection, control, and data collection systems may be exposed to the same vulnerabilities as all other computer systems. As the use of 2 computer equipment within the substation environment increases, the need for security systems to prevent electronic intrusions may become even more important. " It is fortunate, that vulnerabilities of computer systems are well known and well documented. However, it is important to successfully apply that knowledge to industrial networks. Figure 1. presents electronic intrusion vulnerabilities for industrial networks. Over the last 20 years, there were increasingly more complex, sophisticated, and capable control systems installed. These have included more sophisticated basic and advanced regulatory control, advanced process control, optimizers, and artificial intelligence 3. The field of intelligent instrumentation is going through a major transition. The first "smart" transmitters were pioneered by just a few companies some 15 years ago. After a rather slow start in the market, one can say that in the past five …