How safe is your plant from cyber attack? Engineers at the Coors Brewing Co., in Golden, Colo., thought the company’s bottling system was decently secured until someone with access logged in and inadvertently changed a timer for a maintenance device on a filler. “It was supposed to squirt grease into the bearing every 20 minutes and it was changed to once every eight hours,” explains Matt Meyer, plant engineer at Coors. The bearing soon froze. The line that fills 1,200 bottles per minute ground to a halt. The damage? “It was enough to create a $100,000 loss,” says Meyer. With well-intentioned engineers monkeying around in the automation system, who needs terrorists or disgruntled employees?

When Coors personnel clamped down on plant security, the culprit they were trying to circumvent was a well-meaning electrician. “We realized we needed to create different levels of security so we could determine who has access to PLCs (programmable logic controllers) and who can change PLCs,” says Meyer. “We found that electricians were tweaking PLCs for efficiency, but then the changed PLC became a big problem.” Rockwell Software, a Milwaukee business of Rockwell Automation, helped Coors put security into a manufacturing system that was designed primarily for efficiency and reliability.

Easy Internet access to control systems makes life simpler for plant personnel. Managers can monitor plant activity from home now. But the technology also allows those managers to change plant settings from home. Most manufacturers use security to disallow remote configuring—yet it’s technically possible. And in some instances, bad guys—or well-intentioned good guys—have figured out that plant networks are pretty easy to access. The plant is fully networked and the network systems are now based on easy-to-operate open standards.

Unintended holes

The big challenge to manufacturers comes from changes in the nature of their automation systems. Over the past few years, these systems have become information networks, and those networks are now made up of open systems. That’s great news from an operations viewpoint. It’s also good news for anyone who may want to crack into the system. “Manufacturers have networked their equipment significantly to better run their plants,” says Mitchell Ashley, chief technology officer and vice president of engineering at StillSecure, a company in Louisville, Colo., that specializes in plant network security. “Many of these manufacturers have based their networks on readily available software such as Microsoft Windows, and they don’t think in terms of securing the operation.”

The trend toward open standards has created unintended holes in manufacturing networks. Connections to the outside world are not new; connections using Windows are. “People have been connecting manufacturing processes to the outside world for a while, but they were custom systems—expensive and divorced from open standards,” says Rich Ryan, president of Rockwell Software, a division of Milwaukee’s Rockwell Automation Inc. “Now, controls have IP (Internet Protocol) addresses and use the same software we use in our offices. You can bring it all up on a browser from home.”

William Moore, security analyst at ARC Advisory Group, in Dedham, Mass., agrees that the biggest recent change in system vulnerability comes from the move to open software. “The change from proprietary systems to the commercial off-the-shelf technology is a lot of the reason security issues have come up.”

The upside of open systems is that they offer wide interoperability among all locations. This benefit is usually viewed as being greater than the downside brought by increased security risk. “People want open systems because they communicate so well. They don’t want to go back to closed systems,” says Rashesh Mody, chief technology officer at Wonderware, a Lake Forest, Calif., division of Invensys Systems Inc.

Assessing the risk

Those controlling plant operations now have to include security as part of their risk management world. Risks on the plant floor used to center on order delivery metrics and physical safety. Now, plant managers have to determine how easily someone could maliciously (or inadvertently) bring the line to a crashing halt. “Somebody at the manufacturer needs to do risk assessment. That’s the bottleneck,” says Wonderware’s Mody. “Once you figure out the risk, you can do the mitigation. You also know how to keep it updated and you know how quickly you can react.”

In the chemical industry, companies are scrambling to adopt cyber security measures in order to avoid government regulation. “These companies don’t want to hear someone say, ‘I’m from the government and I want to help,’ ” explains ARC’s Moore. “If an enlightened management can institute proper security procedures, they ...