This application note describes how to use the Tofino Industrial Security Solution to prevent the spread of the Stuxnet worm in both Siemens and non-Siemens network environments.
What is Stuxnet?
Stuxnet is a computer worm designed to target one or more industrial systems that use Siemens PLCs. The objective of this malware appears to be to destroy specific industrial processes.
Stuxnet will infect Windows-based computers on any control or SCADA system, regardless of whether or not it is a Siemens system. The worm only attempts to make modifications to controllers that are model S7-300 or S7-400 PLCs. However, it is aggressive on all networks and can negatively affect any control system. Infected computers may also be used as a launch point for future attacks.
How Stuxnet Spreads
Stuxnet is one of the most complex and carefully engineered worms ever seen. It takes advantage of at least four previously unknown vulnerabilities, has multiple propagation processes and shows considerable sophistication in its exploitation of Siemens control systems.
A key challenge in preventing Stuxnet infections is the large variety of techniques it uses for infecting other computers. It has three primary pathways for spreading to new victims:
- via infected removable USB drives;
- via Local Area Network communications
- via infected Siemens project files
Within these pathways, it takes advantage of seven independent mechanisms to spread to other computers.
Stuxnet also has a P2P (peer-to-peer) networking system that automatically updates all installations of the Stuxnet worm in the wild, even if they cannot connect back to the Internet. Finally, it has an Internet-based command and control mechanism that is currently disabled, but could be reactivated in the future.11/30/2010
A simple and cost effective solution for gathering HART information.06/15/2015
Have you ever thought of using batch sequencing and S88 recipe management techniques to control a continuous process? This paper will discuss the great similarities and subtle differences found in such applications. At Procter & Gamble we have successfully created several such hybrid process control applications. The results of these adventures greatly exceeded expectations. These systems benefited from an adaptation of the modular approach described in the S88.00.01 standard with some significant differences in the states of their Equipment Modules and Phases. The necessary modifications will be presented in detail.06/23/2008
The Kodak Park, located in Rochester, N.Y., is over 100 years old. The site has 1300 acres, two utility power plants, two company-owned water and waste water treatment plants, 150 buildings and 11,000 employees. The Kodak Park utility power plants have enormous generation output and demand requirements including 2,000,000 pounds per hour steam load and a 125 MW electric load.
The site also has 600 electric distribution meters, 600 additional non-electric distribution meters and many generation site meters. The utilities systems were operated and monitored by a group of disparate building automation systems and distributed control systems.
With such a vast energy and management system, Kodak shares many of the same concerns as regional utility companies conservation, optimization of resources and consolidation of data from various legacy systems. Any new technology solution added to this mix had to be compatible with our well-defined information architecture requirements.05/01/2009
This article will explore the use of a wireless diagnostic OLE for Process Control (OPC) server technology to embed diagnostic information in human machine interfaces (HMIs), thus optimizing industrial wireless network performance.11/01/2007
This whitepaper, written by Vince Marchant, a senior application engineer at Moore Industries, describes how Modbus works, and how it can be used in new and legacy process control and automation systems.11/05/2007
This white paper provides information about how data loggers can make earning LEED for Existing Buildings O&M credits simple.01/15/2009
The focus of this guide is on using data to evaluate the potential positive impacts of controlling chilled water coil differential temperature (ΔT) on overall chilled water plant efficiency.09/24/2014
Using Commercial Off-the-Shelf Mobile Devices in Industrial Automation: "Russian Roulette" or the "New Normal"?
Download this PDF and learn about the accelerating trend to use consumer devices in factory settings.05/01/2014
This white paper discusses how appliance transaction modules enable the sharing of data for tracking and tracing applications.
Automated tracking and tracing all aspects of a product from its initial ingredients or components, through manufacturing and into the supply chain, is not only a requirement in industries such as food and pharmaceutical, it has also become a viable strategy for all businesses. From automotive and metals to appliances and consumer goods, companies rely on tracking and tracing to lower material, production, inventory, labor and scrap costs while improving customer satisfaction.
By being able to see, analyze, manage and store selected data in real-time, companies are able to make swift changes to optimize selected areas within their production capabilities. They are also able to document their processes from incoming raw materials, through production and onto the supply chain.03/30/2009
IPLOM, a privately held company, manufactures environmentally compatible fuel products. As a small player in a competitive market, IPLOM needed to manage and optimize production in a real-time environment. IPLOM also needed to demonstrate the consistency of the products in real-time in an easily accessible Web site to its customers.
IPLOM first selected OSIsoft Sigmafine to provide mass balance yields. After one year, the company purchased the PI System and is now planning an RtWebParts implementation.04/24/2009
When a device is suspected of having a problem, don't grab the work order and go out into the plant to "see what might be wrong." There is a more productive approach!06/11/2015
Genentech Inc.s bulk manufacturing facility in Vacaville, CA has been in production for the past two years. Application of S88 design concepts has provided the needed flexibility for multi-product manufacturing. Furthermore, the DCS has provided the integrated manufacturing environment necessary to trace and track the multitude of process activities required for the production of a single batch. To meet increasing manufacturing capacity requirements, there is an effort underway to maximize yield and plant throughput. There is an increasing recognition that these goals may be realized by decreasing the time for postproduction analysis of batch production data and the generation of a Batch Assay History Report prior to its market release. Yields may be maximized by real time preemption of deviations in batch quality while the batch is in production. Such time demanding requirements are met by using the Web to deploy raw data and processed information to fulfill users data needs; when, where and how they need it. This paper discusses benefits realized through the use of Web technologies for supervisory batch control, batch production data analysis and batch report generation.08/26/2008
As the next generation of distributed control systems (DCS) becomes firmly established in the marketplace, each manufacturer must face the issue of upgrading. DCS vendors already have plans to phase out support of many current platforms, so it's critical that you develop your own plan for moving forward. The most proactive plants already have a plan in place, while others might continue scavenging for spare parts to keep their existing controllers alive for as long as possible. Of course, every control system has a limited lifespan and must be upgraded eventually. The big question is when. Download this white paper to learn when you should upgrade your DCS.06/04/2012
Sensing options enable users to choose the sensor most appropriate per application. However, making this choice is not often easy. This paper helps unravel the complexities and differences between sensor types and applications in which they are used.05/23/2006
This paper demonstrates how field device tool (FDT) technology standardizes the communication interface between field devices and systems, while complementing EDDL from design, installation and commissioning, to operation and maintenance, and eventual asset replacement.01/30/2006
Industrial application developers have had two main options for interacting with production processes via programmable logic controllers (PLCs): they can buy a preprogrammed monolithic, shrink-wrapped human machine interface (HMI), complete and ready to go or they can customize their own solutions.
Shrink-wrapped HMI software packages are appealing because many complex tasks are hidden from you. Purchase the development software from an authorized distributor, load it into your development PC and then configure, debug and test. Then, just deploy the necessary runtime applications, data servers and configuration files on to your target PC or PCs. What could be easier?
But cookie-cutter HMI software solutions might not necessarily be the best or most practical approach for your specific industrial applications.
For one thing, while the shrink-wrapped HMI software packages enable connections to other vendors' devices, software, and systems via OPC or other standards, such connectivity is seldom adequate for high security or real-time control. And no matter how advanced the integration technology the package uses, you will end up lagging behind the technology curve. For example, if you had bought a package using the distributed common object model (DCOM) and wanted to benefit from advances in security and robustness that Microsoft had made since you bought the package, you would have to buy a new package. Moreover, the monolithic nature of the shrink-wrapped offerings often makes it difficult to embed third-party capabilities directly into your solution, thus limiting your options further.
Then there's training. Because the development environment and behavior of each HMI vendor's software varies, you'll need to acquire specialized skills to accomplish similar tasks. Training courses, material costs and schedules also vary by HMI publisher and many times are offered only through exclusive distributor channels. You could consider hiring outside help, but because of the specialized training and experience, the talent pool can be relatively shallow and therefore proportionately expensive.
And for many, cost of multiple deployments is an even bigger issue. Before you can actually deploy your solution to PCs, portable devices, or Web servers, you must typically have to pay for additional runtime software licenses. If you have more than a couple of users, this could amount to a considerable expense, often making this approach cost-prohibitive, especially if you are paying for more functionality than you actually never need.
Finally, there are the intangibles. As well-designed and flexible as these shrinkwrapped solutions might be, they almost always force compromises that would not be necessary if the solution were custom built for your specific applications. Whether that is a matter of function or just pride, it can be significant determining your satisfaction with the resulting interface.09/10/2009
Every manufacturing industry is experiencing an increasing speed of business in several areas including changing schedules, customer needs, costs of materials, business models, and technologies. At the same time, many manufacturing sites - particularly in the discrete industries - have growing complexity in their operations which makes it more difficult to adapt. There are more SKUs and data to keep track of due to product proliferation, smaller lot sizes and compliance to government regulations.
The demands for improved speed and agility conflict with the plants' ability to respond. Visibility into current operations, including the control system, is the primary reason manufacturers buy Manufacturing Execution Systems (MES). This visibility provides the information necessary for informed decision making in real-time by all levels of personnel - plant floor to the executives.
MES applications contain the critical business processes for executing a production schedule. These systems perform the production-centric functions of planning, controlling, operating and informing. Control systems execute these functions to produce the goods needed to fulfill customer orders. By integrating MES with control systems, manufacturing becomes more agile for responding to change in this increasingly dynamic business environment. Integrating the control system with the MES allows for more effective and broader set of production management functions to improve operational performance.
To improve their response to operational issues, managers look to technology for connecting plant floor and business systems for automated business processes. Some manufacturers have implemented point solutions on a case-by-case basis. Because of the higher development costs and support issues, this approach is not acceptable. An integration platform is needed.08/20/2012
The date of January 1, 2005 sits vividly in the minds of manufacturers within the industrial control panel field. That's because that's the day when the National Fire Protection Association's (NFPA) National Electrical Code (NEC) 2005 Article 409 officially went into effect. The code required that short circuit current rating be clearly marked on the industrial control panels in order to be inspected and approved. The markings made it easier to verify proper over-current protection against hazards such as fires and shocks on components or equipment, whether it be for initial installation or relocation. It was the beginning of an era when things would become a little more complicated, but for all the right reasons of ensuring more safety within the industrial world.
The main vision of the NFPA is to reduce or limit the burden of fire and other hazards on the quality of life by providing and advocating scientifically based consensus codes and standards, research, training and education. These codes and standards were established to minimize the possibility of and effects of fire and other risks. Due to misinterpretations, inconsistencies and advancements in technology over the years, they have had to update their codes with consistency in order to comply with existing standards.
Therefore, the focus of this paper will look at the changes that occurred due to Article 409, the impacts that it had, who was affected by the code and how to comply with the code. Precautions like this article had been enforced in the past, but they were too vague, so people found ways to get around them.
The biggest change that took place within the article was the new requirements adopted for industrial machinery electrical panels, industrial control panels, some HVAC equipment, meter disconnect switches and various motor controllers. For the purpose of this paper, we will be concentrating on industrial control panels which are specified as assemblies rated for 600V or less and intended for general use. All in all, it states that the above products must feature a safe design and be clearly marked with specific information concerning Short Circuit Current Rating (SCCR) in efforts of aiding with the designing, building, installation and inspection of the control panels. This way, the above users can both reference and apply all the needed requirements for all new products and installations as well as for modifying existing ones.05/17/2010