Open Systems Need Intrinsic Security

Wednesday, February 17, 2016 @ 09:02 AM gHale

By Gregory Hale
The gauntlet has been thrown down. One of the major automation users in the world wants to streamline its technology architecture where it is more open, more interchangeable and easier to address.

Oh, and at the same time, it has to be secure.

That challenge has hit the industry and ExxonMobil said at the ARC Advisory Group 20th Annual Industry Forum last week in Orlando, FL, it wants that mandate filled within the next three years.

Security: Ease the Pain …
… Experts See ‘More of the Same’
Safety: Steady as She Goes
Unsupported ICS: Not an Easy Upgrade
Age of New and Different
German Steel Mill Attack: Inside Job
IT Getting an OT Education

To get there ExxonMobil signed on mega integrator Lockheed Martin to build a multi-vendor interoperable prototype that is a standards-based, open, secure, and interoperable architecture, with commercially available software and hardware components.

The reason for that is pretty clear and it is something users in the industry have been talking about for years. Times are changing and, especially in the oil and gas industry, the days of tying into one supplier for a distributed control system (DCS) are about over.

Yes, a facility may have multiple DCSs from different vendors, however, they are not interoperable with each other. That has to change and ExxonMobil and Lockheed want to develop a proof-of-concept for a highly open process automation system.

Change with Meaning
“It is no longer sufficient to to just solve a problem, we have to do it as efficiently as possible,” said Sandy Vasser, facilities instrumentation and electrical manager for ExxonMobil Development Co., during his keynote at the ARC conference. “The number of projects are the same, but we have to think differently.”

He talked about the new approach characteristics:
• Reduce customization and rely on standardization. “We don’t want to do engineering to order. We want to be specific in our orders. We want to order standard solutions.”
• Reduce complexity and simplify
• Eliminate, simplify or automate processes
• Reduce number of dependencies
• Reduce the amount or automatically generate documentation
• Take managed risk
• Develop and enable trust with our suppliers and contractors

As a result, Vasser said suppliers need to offer products that can “age in place. We are asking to replace pieces at a time to keep things up to date.”

So that means no system stays in place for 30 to 40 years anymore.

With that mandate, it means technology needs to be secure by design.

“If we keep going this way, we will have a secure system that does a little bit of process control.”
– Sandy Vasser, ExxonMobil

“Security cannot be reactive,” he said.

Vasser added users and integrators keep bolting on more and more security which helps keep things secure, but it can become way too cumbersome.

“If we keep going this way, we will have a secure system that does a little bit of process control,” Vasser said.

Remaining Viable
During his part of the keynote, Don Bartusiak, chief engineer at ExxonMobil Research & Engineering, added to the concept of truly open systems.

Over the coming decade at ExxonMobil, he said, there will be a significant percentage of control systems that will face obsolescence. So to remain competitive in an industry that right now is not doing all that well, companies must lower capital costs which should improve profitability.

The problem is with entrenched DCSs in place and anchoring facilities across the globe, yes, you can update, but it does not allow users to reap the benefits of new technologies that can take advantage of any derived benefits.

Plus, he added, security is not intrinsic to the system. It is, in fact, not built on, but bolted on.

After laying out the scenario of what the industry looks like now, Bartusiak talked about taking advantage of the trends already in existence from other industries.

He added the defense avionics industries, for which Lockheed Martin is a major player, have transitioned from a proprietary stovepipe model to a fully open and interoperable system architecture. If the manufacturing industry can make that transition, then they will be able to take more advantage of opportunities from the Internet of Things (IoT), wireless and cloud services.

Acting as a backbone to the entire open system concept, Bartusiak said new security models are emerging to enable more secure data flow between the operations technology and the IT side.

“We have to do more than just slap on a firewall, we have to do a fundamental change,” he said. “That will mean security is built in intrinsically.”

Breaking from Tried and True
What ExxonMobil is talking about is a bold move for an industry that prides itself in remaining tried and true to technology that works. The problem is it needs to take advantage of the boost new technology will bring.

ExxonMobil’s goal here is not to just develop this type of open system for themselves, but a commercially available system for the industry. Why? While there are multiple reasons, but one major thought is simply the more users that demand this type of system, the more it forces suppliers to acquiesce.

So, the future is staring at the industry and it is only a matter of time before everyone catches on to this sea change in automation philosophy. It is interesting how everything seems to lock in together like a bicycle chain: Open technology, interoperability, plug and play parts, safety, all covered by a secure, protected environment.