SCADA Risk Management and Emergency … Management and Emergency Preparedness 2014 ISA Water / Wastewater and Automatic Controls Symposium ... Electrical Engineering and has worked

Standards

Certification

Education & Training

Publishing

Conferences & Exhibits

SCADARisk Management andEmergency Preparedness

2014 ISA Water / Wastewater and Automatic Controls SymposiumAugust 5-7, 2014 – Orlando, Florida, USA

Speaker: Mark LeinmillerAuthor: Jeff M. Miller, P.E., ENV SP

2014 ISA WWAC SymposiumAug 5-7, 2014 – Orlando, Florida, USA 2

Presenter

• Presenter: Mark Leinmiller– Mark is the Water Segment Manager for Schneider

Electric’s Water Wastewater Competency Center. He hasworked with electrical, automation, energy efficiency andproduction systems for over 20 years. Mark holds a B.S. inIndustrial & Systems Engineering from Georgia Tech.

• Author: Jeff M. Miller, P.E., ENV SP– Jeff is a Water Solutions Architect for Schneider Electric’s

Water Wastewater Competency Center. Jeff has a B.S. inElectrical Engineering and has worked as an engineeringconsultant and systems integrator for 24 years.

2014 ISA WWAC SymposiumAug 5-7, 2014 – Orlando, Florida, USA 3

Presentation Outline

• Intro

• SCADA Impacts

• SCADA Risks and Threats

• SCADA Risk Prevention and Mitigation

• Summary

2014 ISA WWAC SymposiumAug 5-7, 2014 – Orlando, Florida, USA

Are You a Gambler?

• How much do you putat risk?

• Do you know therules?

• Do you know theodds?

• What would you do tobetter the odds?


• What risks and threats doSCADA systems normally face?

• How can we prevent or mitigatethese risks?

• When disaster strikes how dowe recover?

How come youdon’t have

comfortableseats like ours?


IMPACTS

SCADA


How Would the Loss of SCADAImpact You?

• Required data recordkeeping

• Personnel Safety

• Regulatory Compliance

• Uninterruptedproduction and deliveryof safe water

Health & Safety

Services

Resources

Financial



• Business Continuity

• Process Automation

• Service Interruptionsor DelayedResponses

• Water Quality Issues

• Customer Satisfaction

Health & Safety

Services

Resources

Financial



• Additional manpoweron loss of automationor data collection

• Overwhelmedmaintenance staff

• Availability of backupor rented equipment

Health & Safety

Services

Resources

Financial



• Loss of Revenue

• Recovery Costs

• Waste

• Fines

Health & Safety

Services

Resources

Financial


RISKS AND THREATS

SCADA


Are You Prepared for Disaster?

• Fire, Earthquakes

• Extreme Weather

– Flooding, Lightning

• Power Failure

– Outages, CatastrophicFaults

• Security Threats

• Accidents

• Critical Failures


What is the Greatest ThreatYour SCADA System Will Face?

If I answerthis correctlywill I get free

stuff?


Beware …… and Be Scared Be Very Very Scared

Lack of Knowledge Transfer of aRetiring or Moving-On Workforce

Older Technologies Not Known orExpected by a Younger and More

Technology-Driven WorkforceGeneration


There’s More?

• Lack of SCADASpecific Planning

• Cyber Risks

• Maintenance andSupport Risks

• Environmental Risks

• Interrelated SystemRisks


Cyber Security

• Vulnerabilities

– Hardware Access

– Wireless

– Cross-NetworkConnections

– External NetworkConnections

– Hardware Access

– False Sense of Securitywith Partial Solutions

• Threats

– Malware / Spyware /Viruses

– Unauthorized Access –Hackers, Vandals,Internal

– Unintended CyberEvents

– Operator Errors


Miscellaneous Risk and Threats

• Maintenance &Support

– Version Control

– Updates and Upgrades

– Critical PartsAvailability

– Eg. RAID Hard Drives

– Knowledge– Eg. Automation Logic

– Staff Transitions

• Environmental

– Below Grade Locations

– Temperature Differentials– Condensation

– Cutting Oil

• Miscellaneous

– HVAC

– Location, Location,Location

– Conduit Entry


Threats to Wiring Infrastructure

Mitigation

• SPDs

• Pest Guards

• Equipment Locationand Conduit Routing

• Multiple PathCommunications

• Coordinated PowerDistribution


Water Water EverywhereA Tale of the Unexpected


Corrosion EverywhereTwo Tales of A City


RISK PREVENTION ANDMITIGATION

SCADA


Emergency Planning

• Awareness Culture

• Risk Analysis andBrainstorming

• Prevention andMitigation Plan

• Recovery Plans


Cyber Security

• Have a Plan

• Firewalls (sniffing)

• Access Control

• Unique Passwords

• Secured Equipment

• Achilles Certification

• Allow access or it maybe accessed aroundprotective measures


System Architecture Goals

• Redundancy

• Resiliency

• Prevention ofCommon ModeFailures

– Separate PowerSources

– Physically SeparatedNetwork Cabling

• Offsite Redundant orBackup Resources


Power Resiliency

• Backup Power

– UPS should last at leastuntil Standby GeneratorProvides Power

– UPS with health statusand annunciation

– Not easily disconnectedbut easily replaced

– Separated forredundant equipment

– Consider coolingcircuits

• Beware of risks ofrouting fiber withpower cables

• Protect equipmentwith SPDs


Installation Resiliency

• Separate TerminalCabinet

• No Conduit Leak orContaminate Paths

• AppropriateEnvironment andLocation

• Ensure AdequateCooling if Needed


System Architecture

TerminalServer

Servers


System Architecture

Remoteor CloudRedundancy

TerminalServer

Servers

•Remote or CloudServer

•Redundant SCADAServers

•Redundant NetworkSwitches

•Redundant PLCs

•Redundant WirelessCommunications


System Architecture

Remote orCloud

TerminalServer

Servers

•Remote or CloudBackup

•Mobile HMI

•Local HMI

•PLC-RIO Self HealingRing Network

•Non-Terminal ServerHMI in Control Room

•HMI-PLC Self HealingRing Network

•Terminal Server andFirewall

Resiliency


Be Prepared!


Have a Plan

• SOPs / Contingency Plans

• Means of Alternate Operation– Manual Controls

– Drills & Exercises

• Critical Components and Functions Identified

• Critical Spare Parts

• Version Control and Backup

• Accessible Documentation and References


Critical Parts and Tools

• Identified

• Available or StockingAgreements withSuppliers or Others?

• Pre-Configured?

• Kept in a safe andsecure location

• Everything needed torecover available?


Archival, Backup and Recovery

• Continuous?

• Auto Restore?

• Cloud Services?

• Multiple Copies ofLatest Configuration?

• Offsite or RemoteStorage

• Version Control

• Covert to AccessibleMedia Types!


Can you find your SCADA Guru?

• Emergency Contacts

• Informative Contacts

• Stocking Distributers

• Manufacture, Supplier,Representative

• Local and Corporate TechnicalSupport

• Original Engineer, Designer,Installer, Contractor

• History of System / ComponentContacts


What Threat You Will Face?


Questions?

Jeff M. Miller, PE, ENV SP

Solutions Architect

Water Wastewater Competency Center

8001 Knightdale Blvd.Knightdale, NC 27545-9023Office: 919.266.8360 | Mobile: 919.824.9114JeffM.Miller@Schneider-Electric.comwww.schnedier-electric.com

Mark LeinmillerSegment Manager

Water Wastewater Competency Center

225 Town Park Drive, Suite 400Kennesaw, GA, 30144Mobile: 770-329-3878Mark.Leinmiller@schneider-electric.comwww.schnedier-electric.com

Documents

SCADA Risk Management and Emergency … Management and Emergency Preparedness 2014 ISA Water / Wastewater and Automatic Controls Symposium ... Electrical Engineering and has worked