Website: PC Ninja

In a nutshell …

Myth 1: Consumer protection exists in cyberspace
Myth 2: Firewalls and virus scanners protect my computer and my enterprise
Myth 3: My government has the solution and will protect me
Myth 4: Physical assets are more valuable than information
Myth 5: Laws are keeping pace with technological innovation

I would like to especially call out Myth 2. There seems to be a false sense of security with installing firewalls, intrusion detection systems, virus scanners etc. within enterprise and industry. I have come across many situations within the manufacturing and control systems space where the engineers are totally satisfied with the security of their networks (as they have firewalls and virus scanners in place). However, what they don’t realize is that their network is still vulnerable and open to other forms of security breaches/ problems.

Security within a network is not just about physical implementation and should not be centered around it (which unfortunately a lot of people do). Security within enterprise or/and automation systems should be policy based with physical implementation (like firewalls and virus scanners) being one part of puzzle. No matter how big or small your network is, it is a good practice to have policies in place — you always want to be prepared for eventualities.

“Oops, I didn’t mean to do that!”

Security problems don’t just happen with viruses, it could be as simple as a factory worker accidentally pressing the wrong button, uploading the wrong ladder logic program, accidentally pulling out the wrong network cable from the network switch or accidentally dislodging the power cord.

Securitysearch.com gives a good definition of a “Security policy”:

“…a security policy is a document that states in writing how a company plans to protect the company’s physical and information technology (IT) assets. A security policy is often considered to be a “living document”, meaning that the document is never finished, but is continuously updated as technology and employee requirements change. A company’s security policy may include an acceptable use policy, a description of how the company plans to educate its employees about protecting the company’s assets, an explanation of how security measurements will be carried out and enforced, and a procedure for evaluating the effectiveness of the security policy to ensure that necessary corrections will be made.”

I would like to add to the Myth list –

“Myth 6: My network is 100% secure”
“Myth 7: Hackers always cause network security problems”

There is no such thing as a network being 100% secure. A good secured network is one that has policies/ steps to minimize loss of investment and control breaches/ exploits (purposeful or accidental).

There is also a common perception that network security problems always originate from the outside (from hackers or crackers). Not all security problems are purposeful, they can be accidental too and could originate from within the company. A good security policy accommodates and plans for internal and external occurrences.

To end this off, here are some steps companies should take to protect themselves:

1) Learn and educate yourself — Get a good understanding of the types of security threats you face in your environment
2) Do a risk assessment that reveals the crucial/beneficial areas of your network investment
3) Create policies and procedures that integrate security in accordance to your assessment
4) Integrate/ deploy up to date technical controls
5) Plan for eventualities and how to respond to them
6) Continually update/ revise policies

Of course, I am just scratching the surface here as network security has many facets to it. It does however give you something to think about and is something that can’t be taken lightly.

Do you have other Myths to add? Let us know in the comments area.

Ethernet/IP, the industrial communications protocol that enables communication between machine I/O information systems, factory floor devices and enterprise systems has an open-source software stack. The stack was created and recently released by the Vienna University of Technology’s Automation and Control Institute and written in the C Programming language.

This is great from the standpoint of reducing development costs and cutting the risk of implementation. It may very well be a catalyst for vendor adoption and implementation of (the already popular) Ethernet/IP protocol. I’ll go as far as to say that it may also increase custom development from independent outfits/ system intergrators and internally within the larger industries.

Link to the license and royalty free adapter stack download @ SourceForge

We did participate in last year’s show and was disappointed with the amount of attendees and the geographics of them. It seemed that the attendees just didn’t have a good mix geographically and were too concentrated — the majority of attendees seemed to be from Texas and the nearby states. The general consensus from those I’ve talked to this year weren’t any different. The event this year drew 8000 attendees, where only 200 registered for the educations programs and there was noticeably less exhibitor booths, a significant drop from the 2008 Expo.

Vendor neutral trade trade shows like ISA Expo seem to be rapidly becoming a thing of the past. Companies are participating more in targeted technology, vendor specific/automation based trade shows (e.g. Rockwell Automation’s Automation Fair). Companies are also leveraging the power of the internet and distribution channels in getting their product announcements out. With several more cost effective ways to announce product releases on the Internet, countless social networking outlets, and limited travel restrictions due to the economy, the lure of traditional trade shows is just not the same as it was. The increasing costs of exhibitor booths, hotel accommodations and the extra costs of booth amenities like electrical outlets, internet, shipping etc. also play apart.

It remains to be seen whether this new format will be embraced (considering the fact that the educational programs this year were poorly attended). The cost/quality of this type of show would be a factor in whether people would fly in for 4 days — ISA would have to make it extremely worth their while. A suggestion has been to move it out of Houston and host it in different states every year. Having it in different states tends to create mixtures of vertical industry focus. I have found that having it in Houston every year tends to shift the focus to the Oil/Gas related industry (for obvious reasons; although not purposely done). It will be good to have a change from that (unintended) focus. Having it in different locations could also play to their advantage as allows them to create a themed approach of the event based on geographical location.

The announcement wasn’t much of a surprise to me, considering the declining participation compared to Expos of previous years and in local ISA chapters too (one in particularly has disbanded in our region). My overall impression is that this announcement was sort of a rushed decision — it seems that they are putting a sudden stop to the Expo without a clear picture/direction of what they are going to do next year.

The service will document the current physical network assets and wired/ wireless infrastructure, detail the data activity within the network and test the infrastructure against industrial standards/specifications and recommended practices.

It would be useful for companies needing network audits, a detailed assessment of what their network consist of and may also help pinpoint problem areas within an industrial network.

This service complements Kazio’s other core services. It is meant as a quick service solution to those needing documented evidence for network improvement, optimization, management and maintenance.

About Kazio Networks

Kazio Networks provides turnkey Industrial Ethernet network solutions; offering full wired/ wireless design, installation, analysis, management and support services for discrete and process networks. Past project experience includes assisting the Pharmaceutical, Life Sciences, Food and Beverage, Wastewater, Aerospace, Automotive, Metal/Steel, Power and Energy sectors.

For more information, visit: http://sn.im/sotns or call: 484-334-2757.

Press release

Research Triangle Park, NC (9 Sep 2009) – The ISA Standards & Practices Board (S&P) has voted to approve the ISA-100.11a wireless standard “Wireless Systems for Industrial Automation: Process Control and Related Applications,” thereby making it an official ISA Standard. The approval of this major new industry standard by the ISA S&P Board certifies that ISA’s accredited procedures have been followed in the development of the standard.

The ISA-100.11a standard received final approval by the ISA100 committee in July of this year with 81% of the voting members approving, before being passed along to the ISA S&P Board. With the ISA S&P Board approval, the ISA-100.11a standard will now be submitted to the American National Standards Institute (ANSI) for approval as an ANSI standard, and will be submitted to the International Electrotechnical Commission (IEC) for consideration as an IEC standard.

“The ISA-100.11a standard was developed by a committee consisting of over 600 end users and equipment manufacturers from around the world, and represents a truly consensus standard created in an open, unbiased forum by a global team of industry experts,” said Wayne Manges, ISA100 co-chair from Oak Ridge National Laboratory. The ISA100 committee was established by ISA to address wireless manufacturing and control systems in areas including:

• the environment in which the wireless technology is deployed;
• technology and life cycle for wireless equipment and systems; and
• the application of wireless technology

“The committee has been very active in pursuing its charter and I am delighted that this initial standard has been issued,” said Manges.

The ISA-100.11a standard is intended to provide reliable and secure wireless operation for noncritical monitoring, alerting, supervisory control, open loop control, and closed loop control applications. The standard defines the protocol suite, system management, gateway, and security specifications for low-data-rate wireless connectivity with fixed, portable, and moving devices supporting very limited power consumption requirements. The application focus addresses the performance needs of applications such as monitoring and process control where latencies on the order of 100 ms can be tolerated, with optional behavior for shorter latency.

“To meet the needs of industrial wireless users and operators, the ISA-100.11a standard provides robustness in the presence of interference found in harsh industrial environments and with legacy
non-ISA-100 compliant wireless systems,” said ISA100 co-chair Pat Schweitzer of ExxonMobil. The standard addresses coexistence with other wireless devices anticipated in the industrial workspace, such as cell phones and devices based on IEEE 802.11x, IEEE 802.15x, IEEE 802.16x, and other relevant standards. Further, the standard allows for interoperability of ISA-100 devices.

The standard is available at www.isa.org/ISA100-11a. For more information on the full scope of ISA100 committee activity, visit ISA100.org or call +1-919-549-8411.

About ISA

Founded in 1945, the International Society of Automation (www.isa.org) is a leading, global, nonprofit organization that is setting the standard for automation by helping over 30,000 worldwide members and other professionals solve difficult technical problems, while enhancing their leadership and personal career capabilities. Based in Research Triangle Park, North Carolina, ISA develops standards; certifies industry professionals; provides education and training; publishes books and technical articles; and hosts the largest conference and exhibition for automation professionals in North America. ISA is the founding sponsor of The Automation Federation (www.automationfederation.org).

Areas of focus (but not limited to) would be Patient Services, Surgery/Procedure/Operating Rooms, Emergency, Ambulatory Care, Women’s Health, Diagnostic and Treatment, Caregiver, Service/Support, Facilities, Operations, and Critical Care.

The working group has recommended that “work areas” for heathcare systems are expanded (as opposed to non-heathcare infrastructure standards) and that the required permanent links for each necessary cabling established.

The standard will also support biomedical systems (RFID, BAS, nurse call, security, access control, pharmaceutical inventory, etc.) that use, or have the potential to use, IP based infrastructure systems.

This standard is developed by the TR.42 Premises Telecommunications Cabling TR-42.1 Commercial Building Cabling Subcommittee.

Available through Sourceforge.net here, it allows users to test Industrial Ethernet TCP/IP systems that require deterministic operations. The current version analyzes network traffic and performance of a device on ODVA’s Ethernet/IP network only but NIST has said to be releasing additional versions for other Industrial Ethernet types (release date unavailable).

Test Tool for Industrial Ethernet Network Performance document (distributed by ISA)
NIST test tool download (Sourceforge.net)