Safety & Security First: part two

Technical measures reduce security risks

A safety system must have a variety of security features to harden it against safety-security risks or to reduce the risk in plants. The technical measures affect different areas:

• PC environment
• Engineering tool
• Communication
• Secure control
• Safety application

PC environment: Avoid common cause errors

The BIOS password is the outermost security layer to protect the PC and the engineering tool of the safety system against unallowed access. In accordance with the basic principle of supporting only that which is required, the operating system environment user guidelines and group guidelines must be set up with reduced access rights.

The use of a firewall and antivirus software, or better yet an Application Whitelisting, further improves the security protection. In this regard an Application Whitelisting, also referred to as application whitelisting, is indeed more complex in configuration; however, it offers better security protection, particularly against previously unknown malware, than is offered by antivirus software, because only the programs released by the user are allowed to be executed.

In order to properly configure the various security measures, the required ports and user rights for the engineering tool must be known. In addition, the engineering software must be compatible with the security software of other manufacturers. Thus the user can flexibly implement the security products that are prescribed or that are most suitable. The principle of diversity also applies for these levels of protection, as use of products from different manufacturers avoids the same type of errors.

Engineering tool: Comprehensive protective measures

SILworX®, the engineering tool for HIMax, runs on a standard PC with Windows. The software is compatible with all major antivirus protection programs and consequently can be used with the antivirus software that is standardised and released for the respective company. SILworX protects itself against faulty installation data and manipulation via a CRC (cyclic redundancy check) that occurs each time the software is started or code generation takes place. In addition, MD5 checksums for the installation data are available to the user to check the correctness of the installation.

SILworX has additional features that promote security. A database file in a HIMA-specific format contains the data for the project generated with SILworX as well as the encrypted user ID and passwords. The function-relevant project parts are additionally protected via a separate CRC so that a change in the project data can also be detected and traced with the available secure code comparer.

It is possible to create a project archive automatically each time the controller is loaded. All changes can be traced via this seamless version history. This backup function also permits identification and restoration of the last valid project as part of a recovery procedure.

Two-level user management for project access and controller access ensures additional protection. The first level includes the right to access the project data. At this level personalised users can be created with individual user password and assigned to user groups.

In the second level the access rights are defined per controller. From among the created user groups the administrator can select which group may access the respective controller. A individual password is defined in each case. This password can be as complex as desired because it does not need to be known by the user.

Advantages of this procedure are that the user knows only his own password, and if there is a change of individual users or their passwords the controller itself is not changed. Thus the security protection is increased, and if there is a change in employees or a password update it is not necessary to make changes in the safety controller.

Accesses are recorded in the project log and in the controller diagnostics, which enables easy traceability.

Stefan Ditting, Product Manager, HIMA Paul Hildebrandt GmbH
Thomas Janzer, Product Manager, HIMA Paul Hildebrandt GmbH

Edited from source by Joe Green

Read the article online at: https://www.hydrocarbonengineering.com/refining/05032015/safety-security-first-part-one-384/