Oil and Gas Report: Keeping Connected Safety Systems Safe
Credit to Author: Guest Blogger| Date: Mon, 21 May 2018 14:00:29 +0000
Greg Hale, Chief Editor of ISSSource
We are pleased to host Greg Hale, chief editor of ISSSource, as our guest blogger in the Oil & Gas section as he shares the outcome of interviewing several Schneider Electric experts on the topic of safety and reliability:
Author’s remarks…Increased connectivity in the oil and gas industry is already here, but that connectivity – and the advancement of the Industrial Internet of Things (IIoT) – can bring additional agita to safety and security professionals working on any platform. Attacks against critical infrastructure are increasing. As the attack against a Saudi Arabian gas facility showed, a connected system linked to a safety system has the potential to fall victim if there is a lack of proper cybersecurity practices, policies and procedures. The same is true for the attacks against the Ukrainian power grid in 2016 and 2017. That all could sound like a hopeless situation. But the reality is there are answers and solutions.The following story can help guide users to finding the right solution to protecting and keeping safety systems safe so they can do their job.
Safety, Connectivity and IIoT
Increased connectivity across any manufacturing enterprise, from the oil and gas industry all the way to making buttons for a clothing line, has the potential to hike business intelligence, productivity and profitability.
The catch is, though, with the coming age of that hike in connectivity, better known as the Industrial Internet of Things (IIoT), cybersecurity becomes a huge factor that can make or break a manufacturing enterprise. Add in the potential for an increased attack surface with more Internet-connected devices and not only do automation systems face turbulent waters, but so does the last line of defense: Safety systems.
As the attack against a Saudi Arabian gas facility that occurred in August 2017 showed, a connected system linked to a safety system has the potential to fall victim if there is a lack of proper cybersecurity practices, policies and procedures.
While that may sound dire, the reverse is true. With manufacturers taking cybersecurity seriously and with proper cyber hygiene, any facility can prosper in the age of IIoT.
“It is definitely recognized getting security right is just as important as getting safety right. If you compromise any part of the safety system, it doesn’t matter how much time, money and effort you have spent designing and implementing the system correctly, if they are defeated they will not do the job you need,” said Sven Grone, Safety Services Practice Lead Asia Pacific & Middle East for Schneider Electric.
With IIoT continuing its growth curve, Gartner, Inc. forecasted 8.4 billion connected things will be in use worldwide this past year, which was up 31 percent from the year before, and will reach 20.4 billion by 2020. Total spending on endpoints and services was predicted to almost $2 trillion last year.
Ample Connectivity
With the forecasted increase in connected things of almost 250 percent by 2020, there is no doubt that safely managing connectivity will increasingly be the focus for any manufacturing facility.
“The more information you extract from devices in the field, the better you can manage your system and be armed with information to deal with potential issues before they become an incident,” Grone said. “Getting the information from the field and being able to act on it lets you operate the plant in a safer fashion, provided you’ve recognized the potential vulnerabilities these increasingly connected devices bring, and you have a comprehensive plan in place to mitigate and manage these.”
Along those lines, the opposite is true: Not having a solid cybersecurity program could stall the growth of IIoT and the potential benefits of increased productivity and reduced costs, which are goals of manufacturers today.
“Unless we adequately address cybersecurity, I don’t see any IIoT in a high criticality environment, but on the reverse, maybe 90 percent of processes are not critical,” said Yusuf Kapadia, Principal Technical Safety Consultant, Safety Systems Portfolio at Schneider Electric. “So, something in an organization that produces specific components in the multi-millions in a day, these industries are very much Internet-connected and have produced massive amount of improvement in terms of throughput in profitability. Oil and gas is a different thing though, almost everything falls under a high criticality environment.”
Avoiding Hype
With increased connectivity, a well-thought out plan involving the entire manufacturing team is needed, one important factor is not getting caught up in the hype – especially when it comes to safety.
“Number one, you only connect where it makes sense,” said Steve Elliott, Senior Director at Schneider Electric. “Everybody is on the back of the tidal wave of emotion saying I have got to have IIoT and be connected and digital. Does it make sense to my business? Is it solving a business problem? You need to follow three simple steps: Does it makes sense? If so, what are the risks and threats that can hit me? And then how do I protect against it and what do I have to do. It is that simple, there is no rocket science in it.”
With that boost in connectivity, collecting and analyzing safety data is key, however, getting that information and not compromising the system in the process remains vital.
“You want the data from the safety system because there is valuable information to be had. If you listen to what the safety systems are telling you, you’ll find a lot of hidden value,” Elliott said. “So, get the data and save it somewhere securely so the user can consume it. You will not write to the safety systems, as a matter of fact, you should keep this as far away from that as possible.”
“IIoT does have a play from a safety vigilance perspective from a dashboard type of application providing plants with a much better understanding of about how safe their plants are in any given hour,” said Michael Chmilewski, Vice President Process Safety Business at Schneider Electric. “But not from a perspective of ever putting a safety system anywhere near devices connected to anything outside the plant.”
Employing Good Practices
This was one of the problems the Saudi Arabian gas facility faced in that attack in August 2017 when an Internet facing system fell victim to the attack called Triton, Trisis or HatMan and affected the DCS and safety system.
“What happened with Triton was a complete failure in good practices, policies and procedures when it comes to cybersecurity,” Chmilewski said.
With a safety system, the argument has circulated for years about whether it should be separate, interconnected or interfaced with the control system and that discussion has just ratchetted up over the past six months.
Safety as an Island
“You will never have a safety system that is a black box sitting in the corner just doing its thing like you would have had 40 to 50 years ago,” Grone said. “Nowadays, the systems need to be managed because you have to get information out of them. The key is understanding what they are connected to, recognizing what the potential threats are, and have the right risk mitigation plan in place.”
“Safety as an island is the next default,” Kapadia said. “You would need some kind of data intelligence and some kind of value driven software. As long as you place it within an island, it should be OK.”
“I think it is important to isolate the safety system as much as possible and monitor and manage whatever network traffic between the two there is,” Chmilewski said. “So, you are only sharing the information you need for the DCS to do its job, which should be allowing only the protocol and the traffic that is necessary to pass data back and forth between the two.”
No matter if the safety system is separate or connected, IIoT’s increased connectivity promises great rewards, but manufacturers need to heed the call to understand and adopt a solid cybersecurity regimen to ensure a protected safety system.
“Safety is your last line of defense,” Kapadia said, “If you are not cybersecure, then you’re not necessarily safe. Learn from others, not from your own mistakes.”
To learn more…Downlonad your FREE WhitePaper Five steps for enhancing industrial process safety through IIoT and Digitization here
The post Oil and Gas Report: Keeping Connected Safety Systems Safe appeared first on Schneider Electric Blog.