Abstract:
An OT device includes a processor and a memory, accessible by the processor. The memory stores a first policy that includes a first set of settings associated with operation of the OT device. The memory also stores instructions that, when executed by the processor, cause the processor to enforce the first policy, receive a second policy and an indication of a trigger, wherein the second policy comprises a second set of settings associated with the operation of the OT device, receive an indication that the trigger is enabled, determine that the trigger is true, and, in response to the receiving the indication that the trigger is enabled and the determining that the trigger is true, enforce the second policy.
Abstract:
Technology disclosed herein describes a system and method for aggregating event information in an industrial automation system for analysis and response. In an implementation, industrial automation devices perform industrial automation processes in an industrial automation environment. A computing device receives event data relating to events that occurred on an associated industrial automation device of the industrial automation devices. The computing device normalizes the event data to generate normalized event data which describes the events. The computing device supplements the normalized event data with context information relevant to the associated industrial automation device to generate complete event data. The computing device identifies an anomaly for an industrial automation device of the industrial automation devices based on analyzing the complete event data associated with the industrial automation device. In response to identifying an anomaly, the computing device performs an action to mitigate damage from the anomaly.
Abstract:
A secure method for establishing communications to provision modules in an industrial control system generates a certificate signing request to obtain a signed security certificate. A mobile device is located proximate to the module with the certificate signing request, and the mobile device has previously established itself as a secure communication interface on the network. The mobile device establishes a first connection between the module and the mobile device via a short-range protocol and a s second connection between the mobile device and a signing server via a network. The mobile device retrieves the certificate signing request via the first connection and transmits the certificate signing request to the signing server via the second connection. Because the mobile device has previously established itself as a secure interface, the transmission of the certificate signing request to the signing server may be made via a secure connection.
Abstract:
A model-based industrial security policy configuration system implements a plant-wide industrial asset security policy in accordance with security policy definitions provided by a user. The configuration system models the collection of industrial assets for which diverse security policies are to be implemented. An interface allows the user to define security policies for a plant environment at a high-level by grouping the industrial assets into security zones, and defining any additional communication permissions in terms of asset-to-asset, asset-to-zone, or zone-to-zone conduits. Based on the model and these policy definitions, the system generates asset-level security setting instructions configured to set appropriate security settings on one or more of the industrial assets, and deploys these instructions to the appropriate assets in order to implement the defined security policy.
Abstract:
An industrial precompile and encrypt system facilitates secure distribution of a digital industrial asset to a target device in an industrial automation environment while permitting common, expected user workflows such as interfacing with the asset; replacing failed target devices; verifying and validating the asset and its usage; securely troubleshooting the asset, editing the asset, or replacing the asset in a running system.
Abstract:
Techniques to facilitate temporary escalation of access privileges for a control program associated with a machine system in an industrial automation environment are disclosed. In at least one implementation, a request is received from a user for a temporary access level increase to utilize protected functions of the control program. An encrypted string is generated comprising a temporary password authorized to access the protected functions of the control program. The encrypted string is provided to the user, wherein the user provides the encrypted string to an administrator and the administrator authenticates the user for the temporary access level increase, decrypts the temporary password, and provides the temporary password to the user. A login request is received from the user with the temporary password, and the temporary access level increase is responsively granted to allow the user to utilize the protected functions of the control program.
Abstract:
An automation control and monitoring system includes a server configured to receive a subscription request from a client component. The subscription request provides one or more criteria to the server. The server is configured to provide a set of data, via a first notification, to the client component based upon the one or more criteria in the subscription request. The server is configured to provide, via additional notifications based on the subscription request, additional sets of data, modifications to the set of data, or both, when additional data or modifications corresponding to the one or more criteria are available.
Abstract:
An automation control and monitoring system includes a server configured to receive a subscription request from a client component. The subscription request provides one or more criteria to the server. The server is configured to provide a set of data, via a first notification, to the client component based upon the one or more criteria in the subscription request. The server is configured to provide, via additional notifications based on the subscription request, additional sets of data, modifications to the set of data, or both, when additional data or modifications corresponding to the one or more criteria are available.
Abstract:
A method includes receiving, at a certificate authority, from a first organization in possession of an operational technology (OT) device, a first certificate signing request and a public key, verifying the first certificate signing request, generating, a certificate, transmitting the certificate to the first organization for storage in memory of the OT device along with the public key, receiving, from a second organization in possession of the OT device, a second certificate signing request and the public key, verifying one or more second pieces of information in the second certificate signing request, generating a new certificate, and transmitting the new certificate to the second organization for storage in memory of the OT device along with the public key.
Abstract:
An OT device includes a memory and a processor. The memory stores a first policy, a second policy, and program instructions. The first policy includes a first set of settings associated with the operation of the OT device. The second policy includes a second set of settings associated with the operation of the OT device. The program instructions, when executed by the processor, cause the processor to receive first data associated with a first event, identify a first action in response to the first event based on the first policy, perform the identified first action, receive a command to enforce the second policy and stop enforcing the first policy, receive second data associated with a second event, identify a second action in response to the second event based on the second policy, and perform the identified second action.