Emerson Exchange 365

cyber security

hi

kespersky company offer special product for cyber security "Kaspersky Industrial CyberSecurity (KICS)" .Can This product  be installed in DeltaV network? please if someone have any experiance about this product or any other products, share it.

Thanks

Mohsenv

MOH

• 22 Feb 2016 4:11 PM
• Cancel

8 Replies

• Colin Welsh

  

  • 22 Feb 2016 4:26 PM

  Hi Mohsenv,
  
  I'd stear clear of anything which is not supported by Emerson, and I don't think Kaspersky is. Emerson validate Symantec virus definitions/Patches against DeltaV to ensure there are no issues with them. The latest approved patches are available from Guardian support I think so they should be relatively easy to download.
  
  You can setup your IT antivirus software to download the latest updates from Symantec, but you would need to check those against the approved list from Emerson. Emerson also do a service called GSUDS - below is some info from one of our more experienced DeltaV engineers...
  
  The GSUDS software downloads the following updates for a specified DeltaV System ID:
  
  DeltaV and AMS Device Manager Hot Fixes
  - Microsoft Operating System Security Updates
  - Text file containing the filename of the latest Symantec Anti-Virus Updates tested for DeltaV
  - DeltaV, AMS Device Manager and Ovation Device Install Kits
  - HART, Fieldbus, Profibus and DeviceNet Device Install Kits
  
  The GSUDS software does not have to be installed on a DeltaV system. The main advantages of using it are not having to review the MS updates to check if Emerson has approved them – which could be a considerable amount of work – and that the AV definition file is always a version that has been tested by Emerson. Prior to installing Emerson hotfixes for AMS, DeltaV and SIS a review and risk assessment may be required to understand the impact of any changes and the amount of DeltaV downloading required. Release notes for all the hotfixes are available on Guardian.
  
  Hope this helps...
  
  Colin

  • Cancel
• MOH

  

  • 22 Feb 2016 5:18 PM

  In reply to Colin Welsh:

  Hi Colin
  thanks, for your answer. after siemens plc's attacked by staxnet virus , concern about changing logic by virus arise. I 've heard , kaspersky product is passive and log activity in network ( is passive firewall) and is not antivirus.
  Thanks

  • Cancel
• Alfred Pol

  

  • 22 Feb 2016 11:22 PM

  In reply to MOH:

  First of all, is it absolutely necesary to connect DeltaV network to Plant LAN / Internet? If so the only supported method is through a phyical Router/Firewall.

  I would suggest to have a look at the Emerson Whitepaper on Best Practices for Cyber Security: http://www2.emersonprocess.com/siteadmincenter/PM%20DeltaV%20Documents/Whitepapers/WP_BestPrac_CyberSec.pdf

  • Cancel
• butlermd

  

  • 23 Feb 2016 12:29 AM

  In reply to Alfred Pol:

  In case you are wondering why one would feel a control system must be connected to the plant LAN there are reasons beyond maintaining the automation systems.
  
  ERP data is used in advanced corporations where technical expertise groups, accounting, shipping, accounting, sales, management of product, sales, inventory, raw materials, and production reporting require.

  • Cancel
• Ben Bishop

  

  • 23 Feb 2016 2:45 AM

  Remember that Stuxnet infected an "air gapped" system. The virus infected the system through a USB flash drive inserted into a process control network PC. DeltaV's EasySecurity permits the lockdown of workstation USB ports and CD/DVD drives remotely by engineers. The Emerson SmartFirewall is a perimeter firewall that sits between the Level 2.5 "Plant LAN" and the Level 3 network, with easy to program rules, preloaded with the most common communication protocols. The GSUDS update service described earlier keeps DeltaV and Microsoft updated with tested and approved hotfixes. Emerson's cybersecurity solution is a "defense in depth" strategy that seeks to mitigate threat vectors through physical and software methods. Use of cybersecurity solutions not tested and supported by Emerson is not recommended.

  • Cancel
• MOH

  

  • 23 Feb 2016 4:08 AM

  In reply to Ben Bishop:

  Hi
  Thanks, but document address by Alfred is too general ( close all non specific deltav port, installl firewall, ...)
  Thanks

  • Cancel
• Tracy Waller

  

  • 23 Feb 2016 11:38 AM

  I wouldn't install anything that specifically authorized by Emerson. Kaspersky is supported on Ovation, not DeltaV. Use Symantec Antivirus via KBA AP-0800-0025. Also, KBA NK-1300-0084 talks about "Mitigating Cyber Security Concerns when using Removable Mass Storage Devices".

  • Cancel
• MOH

  

  • 23 Feb 2016 12:40 PM

  In reply to Tracy Waller:

  Hi all
  Thanks for your answers. I find good refrence for cyber security " ics-cert" .
  i will check to find other referance and documents. please if you find or have experince share it.
  ics-cert.us-cert.gov/.../overview-cyber-vulnerabilities
  thanks

  • Cancel