GRADUATE COURSE DEVELOPMENT FOCUSING ON SECURITY ISSUES FOR PROFESSIONALS WORKING IN THE MANUFACTURING INDUSTRY

Shimon K. Modi1, Stephen J. Elliott, Ph.D.2

1 Shimon K. Modi, Purdue University, Industrial Technology, 401 N Grant St, W Lafayette, IN, 47906, USA, shimon@purdue.edu 2 Stephen J. Elliott, Ph.D., Purdue University, Industrial Technology, 401 N Grant St, W Lafayette, IN, 47906, USA, elliott@purdue.edu

Abstract In the past decade, global business has experienced substantial growth; the manufacturing industry has played a large role in this expansion. Growth of the manufacturing industry, increased intelligence of manufacturing equipment, plus connectivity of equipment and software within and among companies has increased the probability of attacks and threats to these systems. Security infrastructure technologies in the manufacturing industry have not kept pace with the technological advancements that spurred the industry’s growth. A course is being designed at Purdue University to provide the working professional with knowledge in the integration of Automatic Identification and Data Capture (including biometrics) into the manufacturing environment. This paper discusses the issues and challenges facing the manufacturing industry and how these are incorporated into the curriculum design. Index Terms –biometrics, case study, logical and physical acces, manufacturing security.

MOTIVATION AND BACKGROUND

Computer integrated manufacturing systems have changed ways in which industrial manufacturing equipment interacts with different systems within and outside the manufacturing environment. Manufacturing equipment has become more sophisticated. The increased connectivity between this more sophisticated manufacturing equipment and internal and external systems has changed the way that manufacturing security systems are designed. As manufacturers move towards a more connected and collaborative environment in their quest for market share in the global environment, concerns are raised regarding potential for compromises to proprietary manufacturing processes and intellectual property; such compromises could expose industry on a worldwide scale to devastating consequences. According to a 2003 report, manufacturers were urged to reexamine their security policies. This report noted that only 40 percent of respondents had completed physical risk assessments; that figure dropping to 35 percent when asked about cyber-security [1].

These figures, discussions with industry leaders and anecdotal evidence pointed to the need to offer such a course. The course examines a fundamental problem: the manufacturing community uses industrial manufacturing equipment that does not require any strong form of individual authentication or identification as a prerequisite to performing a product manufacturing transaction. Initiatives, legislative mandates and security briefs have been launched and disseminated throughout the manufacturing community. The Instrumentation, Systems, and Automation Society (ISA) regularly distribute information on this important subject. For example, ISA-TR99.00.01-2004 Security Technologies for Manufacturing and Control Systems categorizes security issues related to hardware and software systems, including “Distributed Control Systems, Programmable Logic Controllers, Supervisory Control and Data Acquisition Systems, Networked Electronic Sensing Systems and monitoring, diagnostic, and assessment systems” ([2] pg. 2). The technologies associated with protection of these systems include: “authentication and authorization; filtering/blocking/access control; encryption; data validation; audit; measurement; monitoring and detection tools, and operating systems” ([2] pg.2). And whereas this report only addresses physical and logical security, additional benefits can be gained by ensuring these technologies comply with governmental regulation (such as the Food and Drug Administration’s 21 CFR 11, as required in the health and pharmaceutical industry) and safety requirements.

According to [3] and the ISA-SP99 committee report, “computer systems in the manufacturing environment typically rely on traditional passwords for authentication” (pg. 3) adding to the risks to their security. A study conducted by the American Society for Industrial Security and PricewaterhouseCoopers (ASIS/PWC) determined that the greatest losses occur in information related to research and development (R&D) and manufacturing processes. This is particularly relevant to the pharmaceutical industry. The Pharmaceutical Industry Profile for 2002 noted that this industry’s R&D budget grew from $1.3B in 1977 to an estimated $32B in 2002.The use of biometric technology to incorporate access control, authentication, electronic signatures, and action traceability will grow rapidly in the

pharmaceutical industries as a result of new and evolving electronic records regulation and the business-critical need to safeguard intellectual property. New regulations in the United States and European Union require the pharmaceutical industry to ensure the integrity, authenticity and confidentiality of regulated electronic records. There is also increased need to protect intellectual property because, unlike many industries, patented and non-patented intellectual property is the primary source of pharmaceutical companies’ revenues. The course will first target the user community within these pharmaceutical organizations, particularly operators of distributed control systems about which the FDA has expressed concern regarding the authentication of individuals who perform any type of transaction in the manufacturing process subject to the regulations and guidelines of 21 CFR Part 11.

As manufacturers move toward a more connected and collaborative environment among geographically disparate facilities as a means of better competing in the global market, concerns for the possibility of exposing their proprietary manufacturing processes and intellectual property to compromise and damage on a worldwide scale are increasing. Industrial automation suppliers (e.g., Emerson and Rockwell Automation) will need to regard the security of plant systems with the same sense of urgency that the IT community now uses to address the security of computing and the Internet behind and in front of firewalls. It is also important to consider the potential impacts of the Sarbanes-Oxley Act and HIPAA on the manufacturing environment, made even more complicated by perceptions and speculations of less than completely understood regulations.

These various initiatives enable an increased number of manufacturing systems to be designed to provide remote operations capability. To date, there have been no means to ascertain the identity of machine operators and whether they or their actions were authorized. Security in the manufacturing environment has lagged behind advancements of interconnectivity and sophistication of manufacturing systems. Using passwords as the sole means of authentication fails to provide the level of security that modern manufacturing equipment necessitates. According to a white paper by ARC Advisory Group, as the sophistication of security attacks has increased, the knowledge required by the attacker has decreased. But security should not be considered only from a technological perspective; it must also be considered from social and personnel perspectives.

With the objective of addressing these issues, a graduate-level course was designed to meet needs of today’s professionals, as well as students who intend to work in some sort of manufacturing environment. Students enrolled in this class are expected to possess a basic knowledge of biometrics and other forms of automatic identification and data capture technology as a result of having successfully completed prerequisite courses.

COURSE STRUCTURE

The primary objective of this course is to provide those seeking knowledge in this area with the skills required to analyze security issues within the manufacturing environment so that they can lead or participate in teams involved in developing design solutions for those problems. Since no single security framework fits all manufacturing environments and problems, a wide range of factors must be considered in the design of security frameworks. The course will be offered over a 16-week period and will accommodate offsite (remote) participation; three classroom sessions held on weekends during the semester will address those topics and hands-on activities that cannot be managed remotely. The course will include practical case studies: one in which the students will have to develop the security plan for a particular facility and another in which the students will assess the physical security weaknesses within their own manufacturing facilities. The course’s modules are noted below: • Security principles relative to industrial technology and

industrial distribution • Government regulations affecting manufacturing • Physical security • Logical security • Policy development • Course Project - Case study application

Security Principles

This module introduces basic security principles and how they relate to the manufacturing environment. Topics covered include confidentiality, integrity, availability, access control and nonrepudiation. In today’s manufacturing environment, physical and logical security is seen as independent components. Nonetheless, understanding the basics of security can help to avoid pitfalls in the overall design of the security framework and to determine requirements of the security framework within the context of the business processes.

The course addresses security principles common to the many different manufacturing environments that match the participants’ various backgrounds. Other topics in this module include general authentication and authorization technologies; advanced automatic identification and data capture technologies such as biometrics and token authentication (RFID and smart cards); as well as device-to-device authentication. Firewalls and virtual local area networks (VLANs) will be reviewed, per ISA recommendations [2].

Government Regulations

This module explains the government regulations that were intended to address the manufacturing industry and the implications of these regulations on the manufacturing

environment. The United States has passed several regulations requiring companies take into account general concerns such as physical and logical security. The Sarbanes-Oxley Act of 2002 and the Food and Drug Administration’s 21 CFR Part 11 are two such regulations that require companies to apply specific controls to ensure authenticity, integrity and auditability of electronic records. Traditional authentication technologies do not comply with these regulations. A security system program that relies on usernames and passwords does not provide authenticity, integrity and auditability of records. A more robust authentication system is required in order to comply with these regulations. Biometrics has been suggested as a solution to satisfy this stringent requirement. Several implications relative to business processes must be understood in order to optimally design a security framework that complies with these requirements. This module will cover existing government regulations that apply to the manufacturing environment and will explain their implications on existing business processes.

Physical Security

Physical security systems are the first line of defense for asset protection, restricting access to different parts of the manufacturing environment. Physical security systems are generally designed around the periphery of the manufacturing environment, thereby deterring potential intruders. Automatic identification and data capture technologies play a vital role in physical security. Biometrics provides additional security, but only if used in suitable environments. Security professionals who recognize the advantages of biometrics may fail to consider the environment in which the technology will be deployed. For example, the biometric system deployed for physical access purposes will be exposed to a wide range of climate conditions [4], [5]. Performance of face recognition is diminished when the deployment environment is affected by varying levels of light [5]. A biometric system unsuited to the particular target environment will fail to provide additional security, perhaps even less security than a traditional physical security system.

Certain environmental factors specific to the manufacturing environment, such as grease or dirt residues on machine operators’ fingers, can affect fingerprint recognition performance [6]. This module is intended to increase awareness of environmental issues that may have an impact on biometrics so that those issues can be taken into consideration during the design of a physical security framework. More and more companies are considering utilizing an integrated security framework, one that seamlessly blends physical and logical security. Biometrics provides that advantage, and this module will focus on how to maximize the potential of these advantages from a physical security framework perspective.

Logical Security

Increased internetworking of resources in the manufacturing environment is accompanied by increased security risks. Companies are challenged to safeguard their systems while providing their employees with the advantages of technology. At present, the established methodology of authentication in the manufacturing environment is knowledge-based — usage of usernames and passwords. Replacing knowledge-based authentication methods with biometrics provides an extra level of non-repudiation in the authentication framework, as well audit control logs that knowledge-based authentication cannot provide. Commercially available biometric solutions provide single sign-on capabilities that replace “antiquated” knowledge-based authentication mechanisms. This module focuses on the advantages and disadvantages of using different biometric modalities for logical access. Remote authentication is another type of logical access whose security risks are significantly higher than those associated with logical access from within the manufacturing environment. Biometric technology suitable for use in today’s manufacturing environment can provide a higher level of protection, but a number of other issues must be evaluated when considering the deployment of biometrics for remote authentication. This module discusses the issues related to use of biometrics for logical access control.

Policy Development

Security in any system is only as strong as the policy that supports it. Security technology can continue to advance but will never, on its own, overcome the obstacle of the human factor. Development and implementation of sound policies will foster realization of the benefits associated with technological advancements. Good policies must take into account the concerns of the people who will use the new security mechanisms; without user cooperation, the system will not perform as well as advertised. Policies are the basis of procedures and guidelines that form a strong foundation for effective implementation [7]. This module addresses the basics of policy development with the intent of striking a proper balance among business objectives, security and personnel approval.

COURSE PROJECT

The various modules in this course are intended to expose students to the many facets of building a security framework and expand their knowledge gained from this course and the companion course (TECH 621W AIDC for the Enterprise). The curriculum includes a five-phase course project, introduced at the end of the first module. Each successive phase of the course project builds upon the previous phase’s work and reinforces the knowledge gained from that module. Students will be presented with a

particular manufacturing environment scenario and will follow this scenario throughout all phases of the course project. In the project’s first phase, students will be required to document basic security requirements. In the second phase, the students will revisit their documented security requirements, assess whether they satisfy government regulations and, if necessary, modify them accordingly. The intent of the iterative process is to hone students’ ability to adjust requirements to satisfy changing regulations and to incorporate utilize requirements flexible enough to accommodate new requirements without disrupting the security framework. In the third phase, the students will be required to design a physical security framework that provides maximum security to their manufacturing environment scenario and that adheres to the security requirements generated during the project’s first two phases. The physical security framework will have to take into consideration different factors, such as environmental conditions and cost. In the fourth phase, the students will be required to design a logical security framework that provides maximum security to the logical components of their manufacturing environment scenario. The requirements of this phase may include designing logical access security for remote operators. In the final phase of the project, the students will be required to integrate the physical and logical security frameworks they designed in the project’s third and fourth phases. As part of the project’s fifth phase, students may be required to modify their overall security frameworks so that the physical and logical security frameworks are seamlessly integrated. At the end of the course, the students will be required to submit a paper (a “term paper”) that outlines the methodology they followed throughout the five-phase project and then make a presentation. One component of the term paper will be a draft of policies for the integrated security framework; the draft must demonstrate the students’ ability to consider different situations, such as offer an alternative to biometric authentication if a user cannot enroll in a particular biometric system. The course project will allow the students to apply what they have learned in the classroom within the parameters of a real-world scenario.

COURSE OBJECTIVES

The course is targeted to reach security professionals who want to incorporate biometrics into their security infrastructure. The main objective of the course is to expose students to components of the manufacturing environment security spectrum, including intellectual property protection, and to maintain integrity of business processes. By the end of this course, the students should be better equipped to design an efficient overall security framework in accordance with conditions of the manufacturing environment.

FUTURE DEVELOPMENT

Radio Frequency Identification (RFID) is gaining prominence as an automated identification technology that could be used in the manufacturing environment. RFID can do more hold product data. For example, combinational use of RFID and biometric technologies could be used in providing a dual-layer identification methodology for employees working in the manufacturing environment. The knowledge and experience of working with biometric technologies allows manufacturing professionals make better informed choices about the direction of their security technologies. Other automated identification technologies might also be combined with biometrics. The use of new and existing infrastructure could provide additional layers of security.

CONCLUSION

This paper was written to outline the development of a graduate-level course for security professionals who want to incorporate biometrics and other automatic identification capture technologies in the manufacturing environment. This course might be considered as a vehicle for advancing the maturity of biometric technology in that it applies classroom concepts and adapts them to real-world scenarios. This is the first time such a curriculum has been developed with the intention of providing industry practitioners with the ability to create security frameworks using biometric systems. As the course progresses, its developers anticipate that the course will evolve to accommodate more technologies, as well as feedback from the students.

REFERENCES [1] Hill, D., "Manufacturers Plan for Physical and Cyber Security,"

Automation World, 2003. p. 1. [2] ISA, ANSI/ISA TR99.00.01-2004 Security Technologies for

Manufacturing and Control Systems, 2004, pp. 34-38. [3] Riley, D., "Purdue Proposal," S. Elliott, Editor. 2005. [4] Elliott, S., "Biometric Technology: A primer for Aviation Technology

Students," International Journal Of Applied Aviation Studies, 3(2), 2002, pp. 311-322.

[5] Kukula, E., & Elliott, S., "Securing a Restricted Site - Biometric Authentication at Entry Point," IEEE 37th International Carnahan Conference on Security Technology, 2003, pp. 435-439.

[6] Sickler, N, "An Evaluation of Fingerprint Quality Across an Elderly Population vis-à-vis 18- to 25-Year-Olds," Industrial Technology, 2003.

[7] Peltier, T., R., “Information Security Policies, Procedures, and Standards,” Auerbach Publications, 2002.