Cyber security needs to be taken seriously. And, as Matt McDonald writes, it is not just the high profile targeted attacks that industry needs to watch out for.
Back in 2010 ‘somebody’ carried out a cyber-attack on Iran’s nuclear program.
They did so with Stuxnet, a drone-like computer virus that was more sophisticated than anything that had come before it. And they successfully destroyed one fifth of the nation’s nuclear centrifuges.
The attack attracted plenty of attention and raised plenty of legitimate fears about the future of warfare and the possibility of cyber terrorist attacks.
This cyber-attack led to concerns about not just the security of nuclear installations but also of other large industrial plants in the mining, energy, and oil and gas sectors.
Should those sectors be preparing themselves for another Stuxnet?
“That was a targeted attack,” Chee Ban Ngai who leads Honeywell’s Industrial Cyber Security business in the Asia-Pacific told Manufacturers’ Monthly.
While these are an obvious concern, he said, non-targeted cyber threats are also a big problem.
“What we are very worried about is cyber threat intrusion that [arise] from the use of poor practices from the engineers and operators in plants,” he said.
“We are talking about contaminated USBs or ensuring the hygiene of a laptop that a vendor brings into a plant.”
High stakes
Ngai pointed out that the stakes are high in the mining, oil and gas, and energy sectors.
“We’re talking about chemical reactions. We’re talking about the environmental impact. We’re talking about the risk to human safety.” And on top of this, he said, these industries are crucial to the nation’s economic wellbeing.
Ngai explained that, in terms of cyber security, these industries all face the same types of threats.
“The common denominator that they face is that they are quickly migrating out from the proprietary process control systems,” he said.
“Most of them are in the midst of introducing open system architecture. Many of them are upgrading windows servers and windows operating systems as part of the platform to manage the control environment.”
And the moment they decided to make those changes they opened themselves up to increased cyber risks.
Risk Manager
To deal with this increased risk, in recent years Honeywell Process Solutions has invested heavily in cyber security. For example, the company recently launched the Honeywell Industrial Cyber Security Risk Manager, a digital dashboard designed to proactively monitor, measure and manage cyber security risk for control systems for refineries, power plants and other automated production sites.
Ngai explained that the approach the company uses is to first provide customers a cyber-security assessment in order to uncover any threat they are facing. If found, these are reported to management and remediation is provided.
“Risk Manager comes in very nicely after that because what we can see then is that the plant… will have achieved a baseline security level, sort of like a clean slate…when the risk manager moves in and starts monitoring the system,” he said.
Risk Manager uses advanced technologies that translate complex cyber security indicators into clear measurements and key performance indicators, and provides essential information through an easy-to-use interface.
The intuitive workflow allows users to create customised risk notification alerts and perform detailed threat and vulnerability analysis so they can focus on managing risks that are most important for reliable plant operations.
“It empowers customers. It allows them to have a more participative role instead of relying on security experts to watch over them,” Ngai said.
With Risk Manager, he added, they can watch over themselves “and of course escalate for higher support if they find something which is beyond their means to address.”
Cyber Security Lab
In an effort to advance its development and testing of new cyber security technologies the company also recently opened the Honeywell Industrial Cyber Security Lab in the US city of Duluth.
The lab includes a model of a complete process control network that Honeywell cyber security experts will leverage for proprietary research, hands-on training, and to develop, and test industrial cyber security solutions. This lab will help accelerate development time of new cyber protection technologies and speed availability to customers.
“Most importantly, the lab will allow us to certify our methods, our solutions, our approach, such that we can quickly roll them out to customers when we carry out the cyber security investment,” said Ngai.
Concluding, he explained that no nation is immune to cyber security threats.
“When we carry out assessments…from Australia, to New Zealand, to Malaysia, the ASEAN countries, even to India one of the common things we see is that there is a huge catch up to do in terms of basic hygiene.”
Given the importance of the resources sector to Australia, the problem is worth taking seriously.