- Tactical Briefs
- Collaborative Manufacturing
- Control Panel Optimization
- Embedded systems & Trends
- Embedded Vision in Manufacturing
- Energy Efficiency
- Ethernet I/O Networking
- Factory Floor Network Deployment
- Factory Floor Network Reliability
- Fieldbus I/O
- Hands-on Guide to OEE
- HMI, From the Web to the Cloud
- Industrial PCs and the IoT
- Internet of Things
- Machine Safety
- Machine Safety Standards & Strategies
- Make a lasting connection
- Mechatronics @ Work: Insight & Technology Solutions
- Opening Up Your Gateway to Asia
- Real-time Operational Intelligence (RtOI)
- Robotics in U.S. Manufacturing
- Robots & Machines in Motion
- The Future of Industrial PCs
- The power of PackML
Power Plant Off-Line Three Weeks Due to Malware
I just got off the phone with Joe Weiss, noted control system cybersecurity consultant. He was filled with information, as always.
What do you think it would take to keep a power plant shut down for three weeks? Or even what the cost would be to take a power plant offline for that long? I'm thinking a crisis in the control system for the first answer, and more than a million dollars for the second.
Well, Weiss noted that ICS-CERT disclosed that a power plant was shut down for that long because of financial malware found on the control system network. That malware was apparently generated by "criminal software," which had been previously used to perpetrate financial crimes. Seems that a technician "unknowingly" inserted an infected USB computer drive into the network.
The IT department has a zero-tolerance policy for such malware and shut down the control system. Such industrial control system security authorities as ISA99 have been building a best practices around risk analysis and risk management. Such an analysis would have said that since the financial malware could not affect the control system and that the control system could easily be taken off the network, that it was a waste to shut down the plant.
The IT department took the decision away from the plant manager and took action by default.
- Control systems were designed to operate automatically independent of the network. In fact, a control system can continue to operate even with the network shut down.
- Many critical infrastructure control systems run Windows XP and Windows 2000 that have "auto run" features enabled by default making them an easy target for infection because malicious software loads as soon as a USB is plugged into the system unless operators change the setting (see Stuxnet). Many times, this includes turbine controls.
- Control system vendors use USBs to update firmware and other functions. There have been cases where the control system vendors' USBs contained malware.
- Little work has been done to determine if malware can impact control system performance. When do you care about the impact of the malware on control system performance?
- Patching control systems often is not done expeditiously because of the potential for shutting facilities down. Unfortunately this has already happened.
- There is a very significant cost when power plants and other large industrial facilities are not operating. This could be tens of thousands up to millions of dollars/day depending on the facility.
In this case, the IT department took the decision away from the plant manager and took action by default without looking at the situation or the business case.
Weiss concludes with the question, what if someone put even a placebo malware on a network with the sole intent of shutting down the process and IT shut the system down without a risk analysis?
Gary Mintchell has either worked in or covered manufacturing for his 30+ year career that included stints in product development, manufacturing engineering and IT-related projects. Having helped found Automation World in 2003, Gary retired from his day-to-day editor-in-chief duties in 2013. He continues to cover automation technology developments and related industry trends for Automation World. Contact Gary at [email protected] or follow him on twitter @garymintchell.
Recent Blog Posts
5 Keys to Automated Quality Inspection | May 05, 2015
The Shifting Role of System Integrators | May 04, 2015
Safety and Security Should Go Hand in Hand | April 30, 2015
Simplifying Machine-Robot Integration | March 14, 2015
What’s Next for Packaging Machinery Automation? | September 22, 2014
The best of the essentials!
Secrets to Automation Project Success
Sign up to receive timely updates from our editors and download this FREE Automation Project Survival Guide. It’s packed with field-tested best practices from industry experts that can help make your next automation project a success.