Automation Direct STRIDE SiteLink SE-SL3011, User Manual

Page: 110 / 123

STRIDE
®
SiteLink Series Industrial VPN Routers User Manual 1st Edition
C-2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
A
B
C
D
Appendix C: Safety and Security Considerations
Security Considerations for Control Systems Networks
A video providing an overview of security considerations is
accessible by clicking the thumbnail at the right, or by copying
the following URL to your browser:
https://www.AutomationDirect.com/VID-CM-0028
Manufacturers are realizing that to stay competitive, their Automation and Control Systems
need to be more integrated within their plant. The systems often need to be integrated with
upstream Enterprise Data Systems, and even further integrated to allow information to be
accessible across multiple plants, or even through the Internet. This convergence of the IT
world with the Automation World creates challenges in maintaining secure systems and
protecting your investments in processes, personnel, data and intellectual property.
While Automation Networks and Systems have built-in password protection schemes, this
is only one very small step in securing your systems. Automation Control System Networks
need to incorporate data protection and security measures that are at least as robust as a
typical business computer system. We recommend that users of PLCs, HMI products and
SCADA systems perform your own network security analysis to determine the proper level of
security required for you application. However, the National Security Agency has provided
direction related to network security and safety under an approach described as “Defense in
Depth”, which is published at http://www.nsa.gov/ia/_files/support/defenseindepth.pdf .
This comprehensive security strategy involves physical protection methods, as well as process
and policy methods. This approach creates multiple layers and levels of security for industrial
automation systems. Such safeguards include the location of control system networks behind
firewalls, their isolation from business networks, the use of intrusion detection systems, and
the use of secure methods for remote access such as Virtual Private Networks (VPNs).
Further, users should minimize network exposure for all control system devices and such
control systems and these systems should not directly face the internet. Following these
procedures should significantly reduce your risks both from external sources as well as internal
sources, and provide a more secure system.
It is the user’s responsibility to protect such systems, just as you would protect your computer
and business systems. AutomationDirect recommends using one or more of these resources in
putting together a secure system:
• US-CERT’s Control Systems Security Program at the following web address:
www.us-cert.gov/control_systems/
• Special Publication 800-82 of the National Institute of Standards and Technology –
Guide to Industrial Control Systems (ICS) Security http://csrc.nist.gov/groups/SMA/
fisma/ics/documents/oct23-2009-workshop/nist-ics3_10-23-2009.pdf
• ISA99, Industrial Automation and Control Systems Security http://www.isa.org/
MSTemplate.cfm?MicrositeID=988&CommitteeID=6821 (please note this is a summary
and these standards have to be purchased from ISA)