Click to download Ethernet Basics manual - Grant Industrial Controls

Automation networks & Security 105
example, cables that are pulled out or wrongly plugged in. Production standstill or something
even worse can result from the use of an USB stick that it is infected with a virus and is
plugged to a PC that is connected to a machine. Data traffic from the office network can
cause delays on the production network.
On the other hand, there is a distinct possibility that the data that is hacked will be misused.
The company can be blackmailed in such a case. Recent studies show an increasing trend
in the area of industrial security incidents. The more accidental events are more and more
supplemented with external incidents such as viruses, Trojan horses, system hacking, sabotage,...
. Hackers have acquired more and more knowledge of control systems and SCADA
applications. Hackers carry out their activity less and less for the fun of it and more and more
with the intention to blackmail a certain company. This has become an organised crime.
Security is a must.
9.3.3 Objective of security
The main objectives of security are threefold:
• confidentiality: security that data do not end up with a third party.
• Data integrity: protection of the data against unwanted adaptations or against their
destruction.
• availability: resources are available and function correctly at the time that they have to
do so.
Security will therefore prevent an unauthorised person from entering the system, will make
sure that the system functions normally at all times and that all data in the system can be
handled in a confidential manner.
9.3.4 Security in the office world versus security in the automation world
Introduction
The integration of open systems can give the impression that the security problems within
the production world can be solved by copying the approach in the office world. However,
there are important differences between both domains. The office IT is not the same as production
IT. It has to be checked what elements from the office IT are used and not used in the
production IT. There is a standard under development (ANSI/ISA99) to completely describe
the what, how and why of the security in the automation world.
Main objective of security
First of all, there is an important difference in the main objective of security.
In the office world, the main aim for security is always the confidential handling of data.
In the automation world, the main aim for security will always be the availability of the production
system.