Cybersecurity

Introduction

Cybersecurity is a branch of network administration that addresses attacks on or by PCs and through PC networks that can result in accidental or intentional disruptions. The objective of cybersecurity is to help provide increased levels of protection for information and physical assets from theft, corruption, misuse, or accidents while maintaining access for their intended users.

No single cybersecurity approach is adequate. Schneider Electric recommends a defense-in-depth approach. Conceived by the National Security Agency (NSA), this approach layers the network with security features, appliances, and processes. The basic components of this approach are:

• Risk assessment

• Security plan built on the results of the risk assessment

• Multi-phase training campaign

• Physical separation of the industrial networks from enterprise networks using a demilitarized zone (DMZ) and the use of firewalls and routing to establish other security zones

• System access control

• Device hardening

• Network monitoring and maintenance

This section defines elements that help you configure a system that is less susceptible to cyber attacks. For detailed information on the defense-in-depth approach, refer to the Recommended Cybersecurity Best Practices on the Schneider Electric website.

Schneider Electric's Approach on Cybersecurity

Schneider Electric adheres to industries best practice in the development and implementation of control systems. This includes a defense-in-depth approach to secure an industrial control system. This approach places the controllers behind one or more firewalls to restrict access to authorized personnel and protocols only.

WARNING

UnAUTHENTICATED aCCESS AND SUBSEQUENT UNAUTHORIZED OPERATION Evaluate whether your equipment or complete environment are connected to your critical infrastructure and, if so, take appropriate steps in terms of prevention, based on defense-in-depth, before connecting the automation system to any network. Limit the number of devices connected to a network inside your company. Isolate your industrial network from other networks inside your company. Protect any network against unintended access by using firewalls, VPN, or other, proven security measures. Monitor activities within your systems. Prevent subject devices from direct access or direct link by unauthorized parties or unauthenticated actions. Prepare a recovery plan including backup of your system and process information. Failure to follow these instructions can result in death, serious injury, or equipment damage.

Cyber Threats

Cyber threats are deliberate actions or accidents that can disrupt the normal operations of PCs and PC networks. These actions can be initiated from within the physical facility or from an external location. Security challenges for the control environment include:

• Diverse physical and logical boundaries

• Multiple sites and large geographic spans

• Adverse effects of security implementation on process availability

• Increased exposure to worms and viruses migrating from business systems to control systems as business-control communications become more open

• Increased exposure to malicious software from USB devices, vendor and service technician laptops, and the enterprise network

• Direct impact of control systems on physical and mechanical systems

Sources of Cyber Attacks

Implement a cybersecurity plan that accounts for various potential sources of cyber attacks and accidents, including:

A deliberate cyber attack on a control system may be launched to achieve a number of malicious results, including:

• Disrupt the production process by blocking or delaying the flow of information.

• Damage, disable, or shut down equipment to negatively impact production or the environment.

• Modify or disable safety systems to cause intentional harm.

How Attackers Gain Access

A cyber attacker bypasses the perimeter defenses to gain access to the control system network. Common points of access include:

• Dial-up access to remote terminal unit (RTU) devices

• Supplier access points (such as technical support access points)

• IT-controlled network products

• Corporate virtual private network (VPN)

• Database links

• Poorly configured firewalls

• Peer utilities

Reporting and Management

To submit a cybersecurity question, report security issues, or to get the latest news from Schneider Electric, visit our Schneider Electric website.