Representative End User Clients
Representative Automation Clients
Representative Software Clients
At our recent Industry Forum in Orlando, the core themes of digitalization and cyber security dominated the agenda and the event buzz. These two core themes are highly dependent, as with ubiquitous connectivity comes a greater need for increased cyber defenses as the surface area for cyber-threats grows exponentially. Without resource prioritization accompanied by robust cyber defenses and strategies, the best scenario will be an organizational, ecosystem or even economy left crippled and unable to function in a digital world. At the forum, I attended a breakfast presentation by Honeywell’s Lead Cyber Security Researcher and expert on cyber-physical systems, Marina Krotofil, who is using her Jedi hacking skills to combat the dark side. Her talk primarily focused on her research disproving common myths perpetuated by the media on the level of sophistication needed to attack and defend an ICS. For this blog, I want to highlight an industrial IoT use case she discussed which is fresh and powerful that caught my attention; Flowserve’s IIoT application for a connected centrifugal pump being used as an additional layer for cyber defenses. Honeywell and Flowserve have been official collaboration partners in IIoT space since Oct 2016.
Marina prides herself on thinking outside the box, and this application of IIoT is not only looking beyond the obvious, it is quite brilliant and showcases the potential of IIoT. If a hacker penetrates your process control system and remains undiscovered, they could alter your process without signaling alarms. Marina described the possibility of a slight change in the upstream valve positioning causing reduced flow pressure which would eventually lead to cavitation in the pump; Marina classifies this cyber-threat as the “Evil Bubbles” attack. The sensors, which are located on an independent IIoT network, can recognize that the integrity of the process is failing and act as a safeguard by triggering events and generating alarms that something is wrong, before excessive damage to costly equipment occurs. If the attacker attempts to hide true flow pressure from the operator by spoofing sensor signals, pump monitoring measurements can be used to detect inconsistent forged data. Because the sensors are on a separate network, there is a significant jump in the level of effort needed to be able to attack both networks simultaneously without being discovered.
This example shows how the scope for IIoT in process applications has gone beyond asset optimization and reduction in unplanned downtime to include cyber security, process validation, and safety. This high-level thinking can be applied to other IIoT applications and provides additional justification for investing in IIoT sensors and networks. We must accept that the transformation clock will only keep progressing, and pervasive cyber-threats is just part of that manifest destiny. The good news is that great minds, such as Marina, are continuously developing new technologies and strategies to mitigate the risk and success of malicious cyber-threats in the future.
Marina prides herself on thinking outside the box, and this application of IIoT is not only looking beyond the obvious, it is quite brilliant and showcases the potential of IIoT. If a hacker penetrates your process control system and remains undiscovered, they could alter your process without signaling alarms. Marina described the possibility of a slight change in the upstream valve positioning causing reduced flow pressure which would eventually lead to cavitation in the pump; Marina classifies this cyber-threat as the “Evil Bubbles” attack. The sensors, which are located on an independent IIoT network, can recognize that the integrity of the process is failing and act as a safeguard by triggering events and generating alarms that something is wrong, before excessive damage to costly equipment occurs. If the attacker attempts to hide true flow pressure from the operator by spoofing sensor signals, pump monitoring measurements can be used to detect inconsistent forged data. Because the sensors are on a separate network, there is a significant jump in the level of effort needed to be able to attack both networks simultaneously without being discovered.
This example shows how the scope for IIoT in process applications has gone beyond asset optimization and reduction in unplanned downtime to include cyber security, process validation, and safety. This high-level thinking can be applied to other IIoT applications and provides additional justification for investing in IIoT sensors and networks. We must accept that the transformation clock will only keep progressing, and pervasive cyber-threats is just part of that manifest destiny. The good news is that great minds, such as Marina, are continuously developing new technologies and strategies to mitigate the risk and success of malicious cyber-threats in the future.