I have been hearing talk lately about raising the standard in wireless security awareness for networks on the factory floor and in hard-to-reach remote locations. Why? I work in the industrial automation sector for a company that develops protocol gateways, protocol converters and wireless products. Wireless is the new buzz and security is always the big issue. As a topic, industrial wireless security is just hitting the factory floor and I can say through my research, is an interesting tour through the Internet and the world of white papers out there on the matter.
Most of the talk I hear is that most potential industrial wireless hazards would come from 'inside jobs', hackers who are disgruntled workers that might make a messy world of a wireless network because they already know passwords and integral rogue access points. The idea of a hacker who is not an 'inside man' actually breaking in, taking control, and causing catastrophic problems to an industrial wireless network is unlikely at best. You never hear in the news of some guy parking his motor scooter next to a factory wall with a laptop and Pringles can antenna, hacking data and taking control, then making end devices go bonkers and build backwards widgets because of jumping in through an all-too-open access point with easily interpreted data. The idea is feasible. The reality is just not there...
Yes, the recent
Rockwell security paper would have us all thinking that factory devices could get belligerent, spill toxic goo, blow up resources, and make all connections go haywire because of the invading hacker elite. Rockwell points to the Australian case of the Wastewater plant where in an inside job by a disgruntled employee, he caused wastewater to fill up more than just a lonely tin can down under. Look at the facts: that is just what the industrial wireless attack was, an inside job. Sure, anyone with multiple passwords (who likely built the network), and who is supposedly trusted can potentially lay waste to a wireless or cable-built network.
Is that really the reality of hacking data from a deviant passersby? No, this is not the corporate world where hotspots fill the New York air and Johnny with his computer can leave 40 people dirty messages on their desktop because they set their wireless security settings to 'default'.
Awareness, however, needs to be raised for the factory as well. The fact that data is in the air because of the nature of the wireless beast makes folks think data is up for grabs. But is it? Not if plant floor folks take heed of basic security techniques.
Recently, Wallace Gastreich in his white paper,
"Wireless Security on the Plant Floor" wrote about better ways to set up antenna arrays, how to better monitor access points, the do's and don'ts of authentication keys and key-rollover techniques, and in his research pointed out the possibility of a hacker stealing data from the factory floor and what they could do with such data. Gastreich writes regarding Frequency Hopping technology:
It is virtually impossible for a would-be intruder to access raw or encrypted data from FHSS devices. These industrial wireless modems provide the highest level of security...Why? One reason is that if the hacker with the pringle can were to actually spend three days figuring out the authentication codes through a rogue access point then would he be able to interpret proprietary data?
Not likely, according to Gastreich. "Who is going to be able to interpret a bunch of ones and zeros?" he said in a recent interview. "In a properly secured factory, hackers just aren't going to access data in the air that says, 'I am such-and-such device and this is my information'. The data is proprietary in many cases and would have to be an inside job for access to how to interpret the data."
So what about the inside job?
One case is all I could find other than a land-based viral worm attack on a Nuke plant in Ohio; I could find nothing. Maybe all inside guys with the passwords should be trusted... Maybe they should be watched like hawks. Oh heck, just feed them well, will you?
I asked Gary Mintchell of
Automation World and
Feed Forward what he might have heard in the buzz on wireless security. He wrote:
Interestingly enough, I hear almost nothing about wireless security other than the usual WiFi type security. It is something that the ISA SP-100 committee is considering, but they are not very far along. I have a writer researching the area. We'll see what he comes up with.Good luck. His writers have excellent access to the world of automation, but I just don't think there's going to be much out there in the realm of wireless security fears turned real scenarios in the industrial world of automation networks. Well, there is always the fear, but awareness, diligence, rotating authentication keys, minimal networks, a distance from corporate networks, smaller bubbles in wireless points of access, and using products that have the best security built in...
Just watch the guys in-house with the passwords, and when they are canned, change passwords and man the firewalls...
-N.L. Belardes