By Gregory Hale
Safety and security are at a true inflection point in the manufacturing automation industry that the two disciplines seem poised to have a heavy impact every area of a process.
“When people can go home and count their own fingers and toes, that is good,” said George Schuster, senior industry specialist at Rockwell Automation during a safety and security discussion at Rockwell Automation’s Automation Fair 2012 in Philadelphia last week.
“Safety predates security by 10 years and safety has gotten to the point where you can buy your SIL3 devices, I look forward to the day when security is thought of in the same way,” said Doug Wylie, manager of networks and security at Rockwell Automation.
Security is in its infancy when it comes to awareness on the plant floor, but users are starting to get the picture.
“The majority of users are beyond the denial phase and they really do look at it as not if, but when they will get hit by an attack,” said Brad Hegrat, business manager for industrial security at Rockwell Automation
“Most users are through that ‘it’s not going to happen to me’ phase because they have either had or seen near misses,” Wylie said. “They look at what can they do that is within their sphere that they can control.”
Both security experts agreed elevated the level of attacks brings a new range of danger to the industry.
They talked about Stuxnet, which was a joint operation between the United States and Israel to halt or severely delay the Iran nuclear buildup and the latest attack called Shamoon, which ISSSource reported was a retaliatory strike against Saudi Aramco by Iran because of the Stuxnet attack.
“Shamoon was far more simplistic,” Hegrat said. “It was inelegant and Neanderthal in its nature; it clubbed its victims. Stuxnet was designed not to be found. Shamoon was loud and was meant to be seen and heard.”
One of the fears of these super attacks against the oil giants is companies within their supply chain also falling victim to a virus.
“Supply chain security is the tough nut to crack,” Wylie said.
It is easy, however, to get caught up in the fear, uncertainty and doubt with the entire potential of any kind of attack, but there are positives, and the industry is moving forward.
One of the bright spots is users are starting to apply global standards. “That is encouraging. Our procedures have been aligning with these standards because there is some good stuff out there,” Wylie said.
The potential for change, while daunting at first, is also a positive coming out of the defense in depth approach.
“We will be forever fighting a losing battle if we don’t change our mentality on how we do enterprise networking,” Hegrat said.
Sometimes people and money can play a factor in how much safety or security hits the plant floor.
“Cultural change is by far the biggest hurdle to get over. I don’t see it as a money issue,” Schuster said.
On the safety side, they have to have the same approach as security when it comes to evaluating risk.
“A discipline in the safety process is how do you evaluate risk? Howe do you put a number on it?” Schuster said.
In the end, he said, it all comes down to verify and validate.
“How do we verify system design before it is completed so it meets all the requirements,” Schuster said. Also part of the safety environment is the maturing of the standards. As the technology is changing and allowing users and machines to do more, the standards are attempting to keep pace. One example he talked about was the changing role of a robot.
“The standards are changing as they become more developed and more specific, they can tell us how to do safety on a robot,” he said. “The standards are getting deeper and wider.”
Everyone knows safety is vital in the manufacturing sector, and likewise security, but there are different levels of implementation of both disciplines.
One interesting point is companies employing top tier safety and security often are more productive and more profitable. But that begs the question, why doesn’t everyone work toward becoming a top tier company?
“Often companies don’t know where to begin,” Schuster said. “You throw safety at me and it could bring my plant to its knees. Some have a crisis and that becomes a defining moment and they make a decision. Others just see the light and enact a plan.”