Steps to secure your electrical control system
The UK’s Health & Safety Executive published its operational guidelines on Cyber Security for Industrial Automation and Control Systems in 2017, which provide advice on achieving compliance with relevant technical standards and regulations.
They provide guidance on measures to protect electrical control systems against cyber-attack and accidental or deliberate actions events, which can lead to undetected faults, failure, downtime and increased health and safety and accident risks.
Some types of control systems and equipment which may be vulnerable to cyber-attack, malware and viruses include:
- Distributed control systems
- Programmable logic solvers
- SCADA systems
- Safety instrumented systems
- Plant information systems
- Programming interfaces and data servers
- Network infrastructure
- Virtual machine environments
- Programmable switchgear
- Drives, sensors and actuators
Regardless of whether your electrical control system is connected to the cloud, it’s good practice to take a sensible approach to securing your systems. After all, threats don’t just originate online, they can come from maintenance activities, software upgrades, unauthorised access and user error, so it makes good business sense to protect them. Here are some steps to take:
Audit and documentation
To protect your systems and equipment, you need to know exactly what you have in place. So, auditing your electrical control system, documenting it, and recording any changes as your system updates or evolves is essential. Some things to consider include what network architecture you have and how it’s connected, what protocols are used and who has access – either physically or digitally. It’s also essential to know what software is running, what cybersecurity measures (if any) you already have in place, and how your systems are connected with the outside world.
Identify risks and vulnerabilities
Once you’ve audited and documented your plant, developing a risk management plan is the vital next step. Some of the things to consider here include:
- How many ways can your system fail?
- Where are the vulnerabilities?
- Which processes will be compromised if it does?
- Which areas of your plant are most vulnerable?
- What impact will downtime have on your business?
- Who’s responsible for responding to system failure and recovery?
Another key question to ask yourself here is who’s responsible for implementing your risk management plan and ensuring it’s followed?
Prevention and maintenance
Once you’ve created a risk management plan and understand where the weaknesses and vulnerabilities are, you can take proactive steps to address them. This might include investing in new hardware, software or technology to address some of the most significant risks or modifying your operating procedures to close any potential security loopholes.
Some things to bear in mind include making any adjustments to make your system more secure, understanding and complying with industry best practice, and improving staff awareness of any potential security risks and what they can do to minimise them. You may need to provide training to address this last point.
Operational technology security policy
Your organisation likely has an ICT security policy to protect its users, networks and data, but do you have one for your operational technology?
If not, why not? After all, your business probably relies on your production equipment running smoothly, so having the right policies and procedures in place to ensure it does is paramount. Once you have an operational technology security policy in place, it’s vital to ensure that all affected staff understand and follow it and are made aware of any updates as and when things change.
Disaster recovery
Again, your business probably has a disaster recovery plan for when your ICT infrastructure goes down, and you need the same level of detail for your operational technology. While electrical control systems offer many benefits to industrial production-based businesses, they are not bulletproof. Things can and do go wrong, even if you’ve been diligent in assessing and mitigating potential risks.
You need a recovery plan for each part of your system that could fail, which defines equipment recovery priorities, who is responsible for each phase of recovery and where any spare parts, backed-up data or software are stored so that you can respond to incidents quickly and effectively. If you fail to prepare, you’re preparing to fail when it comes to keeping your production equipment running smoothly. So, taking the proper steps to protect your electrical control systems is vital.
How Banelec can help you secure your electrical control system
Banelec is a world leader in creating secure electrical control solutions. We’ve integrated and secured electrical controls, along with PLCs and robotics, into automated systems for some of the world’s biggest manufacturing brands.
So, if you’re looking to make your processes smarter, safer and, crucially, more secure, our team of specialist electrical control system engineers can make it happen. We bring diverse experience, knowledge and personality to every project we work on to exceed your requirements and specifications.
Our automation services include complete systems, electrical controls, robotics and conveyor controls. Whatever you do, if you want to do it better, get in touch.