VPN Module Simplifies Secure Remote SCADA Communication

Using simple, drag-and-drop technology, this plant floor solution doesn’t require an IT expert. Eric Byres, chief technology officer at Byres Security Inc., calls it “a VPN that people can actually use on the plant floor.” His reference is the Tofino Virtual Private Network (VPN) product line, to be introduced this week by Byres Security and MTL Instruments, a division of Cooper Crouse-Hinds, as part of the Tofino Industrial Security Solution, extending cyber security beyond plant walls. “You don’t have to worry about passwords or certificates or keys; there’s none of that,” Byres says. “You can simply say, ‘I want this device to talk to that device,’ and drag-and-drop ’em. And all of the complex stuff is hidden.”

Indeed, the Tofino VPN Server LSM (for loadable security modules), the Tofino VPN Client LSM, and the Tofino VPN Client License are designed specifically to make authentication and encryption of SCADA and automation communications easy for control engineers. According to Byres, it is the first solution for securely connecting industrial control facilities and people together over untrusted networks (such as the Internet) that does not need an IT expert to set up and administer. The products will be available as of July 31, 2009.

Security for the Tofino VPN is provided by Secure Sockets Layer (SSL). In addition to providing secure tunnels for communication, the Tofino VPN solution integrates seamlessly with the Tofino Firewall LSM and the Tofino Modbus TCP Enforcer LSM. This close integration makes certain that only “permitted” messages are distributed, and not potentially dangerous transmissions such as a virus originating from a remote PC, or a user sending inappropriate programming commands.

The Tofino VPN features an integrated SCADA-capable firewall that provides a high degree of granularity in setting access rules. For example, it allows the designation of specific computers (such as remote human-machine interface PCs) to have read-only access to PLCs for operational diagnostics, whereas a limited set of maintenance laptops can have remote programming access to PLCs.

Uses of the Tofino VPN include:
•    Monitoring and controlling remote sites from a central location
•    Providing secure access to control systems for remote personnel
•    Securing communications between critical controllers
•    Allowing legacy non-IP control traffic to travel over IP networks.

The Tofino VPN LSMs create secure tunnels for communications between:
•    Tofino Security Appliances (Tofino SAs)
•    Tofino SAs and PC
•    Tofino SAs and supported third-party devices.

For more about the Tofino VPN solution and the complete Tofino Industrial Security Solution, visit www.tofinosecurity.com.