|
Justifying Networking Security
Companies now expect security to help them improve their bottom lines.
Everyone understands that security becomes an issue when companies use Ethernet in industrial environments. But it's often difficult for companies to approve the time and funding needed to set up security systems that are efficient and cost effective. In the current downturn, justifying these expenditures is a critical aspect of securing corporate assets.
Avoiding waste is critical, but it can postpone investments and leave a company vulnerable to shutdowns and other problems that can occur if viruses, attacks or other problems cause networks to shut down. That changes when regulators in environments such as power generation force vendors to beef up their protection. The Independent Electricity System Operator (IESO), which monitors the electric power grid in Ontario, Canada, took major steps after the North American Electric Reliability Corp. (NERC) began enforcing security compliance regulations for utility companies in 2007.
Meeting NERC mandates required a major network overhaul. “We started from the ground up, taking out all the networks, then upgrading them and putting modern operating systems on our equipment,” says Ben Blakely, Information Security Officer for IESO.
The Toronto-based company also added a number of other software tools. “We added a patch management system, put in a lot of anti-virus scanners and added TippingPoint technology,” Blakely says. TippingPoint Technologies Inc., Austin, Texas, is a 3Com company that supplies network-based intrusion prevention systems. “We wanted to get a system that would gather data and monitor what was happening on the wire. But we also wanted to make sure we weren't blocking appropriate messages,” Blakely says.
Where's the money?
Steps like these are just as important in unregulated industries. But before making a move, many companies are looking at security from a new stance. Security must contribute to the bottom line, helping increase uptime and reduce risk while justifying all expenditures of time and money. That focus on return on investment (ROI) has gained importance, given the sluggish economy. “Security without a good return on investment is a waste of money. But if you do it well, you get a good ROI,” says Eric Byres, chief technology officer for cybersecurity consulting and products company Byres Security Inc., of Lantzville, British Columbia, Canada. “Like safety, security pays for itself”...Read
more
Opening the Door
Ethernet has become the leading industrial network over the past five years or so.
Of course, its popularity is built upon two long-standing and solid foundations. In the first place, Ethernet won the corporate networking wars many years ago. On the plant side, fieldbus networks finally gained a critical mass several years ago after much engineering and evangelistic work. Now the two are coming together as networking has become acceptable.
Moving networking into factories and plants was not easy. My first brush with a customer at an automotive factory about networking in the early '90s was quite negative. “We'll never run a wire from a programmable controller to anything. It's not safe,” he told me. Indeed, the first objections were safety related. But the work of the networking standards organizations and fieldbus suppliers has progressed to the point that there are actually networks specifically designed for safety systems.
Then came the Internet and the “World Wide Web,” now known simply as the “Web.” We wrote stories about how controls engineers could troubleshoot problems “from anywhere in the world” at any time. I was personally thanked (not entirely enthusiastically) by engineers who noted that their bosses now expected them to be on call 24 hours a day. Others saw the benefit of the ability to solve problems from home, obviating a trip to the facility.
This communication capability opened factory control systems to the outside world, bringing a new set of problems-namely, security. There are discontented, mischievous or criminal people who try to “hack” into any system they can. Now controls engineers not only need networking skills, they also need cybersecurity skills...Read more
| 
