Industrial Security – state of art technology drives integrated approach

By Phil Millette, Business Leader - Industrial Security, EMEA

Safety and Security have long been regarded as separate functions and technology decisions have in the past been made separately for each. A motion detector on a fence line, for instance, can trigger an alarm, prompting a security guard to investigate. If the threat is deemed serious, the guard can radio the control room to alert process operators.

With the current threats posed by terrorism and sabotage, as well as increasing occurrences of equipment and material theft, industrial facilities have placed increasing importance on security in recent years. Accidents or intentional damage in chemical and hydrocarbon processing plants can affect workers, contaminate the environment and result in significant property damage. This can lead to business interruption costs, cleanup costs, legal fees, fines and negative publicity. Critical infrastructure such as chemical and petrochemical plants, oil refineries, liquid and natural gas distributors, pulp and paper mills, mining operations and pharmaceutical plants require comprehensive security strategies to ensure that plants, employees and surrounding communities remain safe.

The on-going function of oil and gas facilities is critical – and the location of these facilities often means that new approaches are needed to ensure continued function and mitigation of dangers as indicated above.

It’s only natural, therefore, that a wide variety of security systems ranging from access control and video surveillance, right through to perimeter fences and IT security, have gradually been incorporated into the overall plant integration strategy.

Securing the Plant

Unfortunately, there is no 'one-size-fits-all' approach to industrial security. For each facility there are many variables that must be considered ranging from the physical location of the plant right through to what the plant produces that will affect the overall solution. As such, the first step in designing any kind of safety and security architecture is assessing the vulnerabilities being faced and understanding the risks that are created as a result. The ensuing strategies are dependent on the distinguishing characteristics of specific facilities and the business goals of the corporations that operate them.

In the field of video analytics, motion detection is still the basic technique and widely used on fence cameras. The speed of processing has improved to a point where more cameras can be set up for analytics processing. This is important since it reduces video activity flood that operators face with too many screens to watch. The same technology is also being used, in enhanced form, to recognize vehicle number plates at plant gates.

At the periphery of a facility, the use of video cameras, and the resulting imagery, to better manage in a safer manner, the operations of a facility. Video is now much cheaper to acquire, install and maintain. It was not so long ago that many facilities finally started to get rid of their tape video recording, with racks of tapes. With video storage completely digital, just as it is in the home, video can be applied throughout a facility, resulting in a merged purpose of sorts for video – a convergence of security and safety. A theme we will keep coming back to.

Wireless networking in facilities is also taking new strides – affecting both safety and security. The ability to communicate and improve work flow, for example in Safe System of Work, using the same interaction tools in the field and plant graphics and for live process data, as in the control center, means that the widening use of IP networking over wireless infrastructure will continue.

The capability to catch relevant events and alerts and make them available to command and control also means the same ability to be shared with process control & safety systems. Fire & Gas detection and response systems can therefore provide the same form of such real time events and alerts, allowing an integrated approach to managing security events as well as a wider range of emergency situations.

Detecting and minimizing the effects of abnormal situations is crucial to ensuring the safety of the plant, the personnel, the production and the environment. Fire and gas solutions are essential for:

Monitoring areas where hazardous levels of explosive or toxic gas are not normally present
Providing early warning of the buildup of gas or fire before it becomes a hazard to people, infrastructure and the environment Automating emergency actions with a high-integrity integrated safety and control solution to mitigate further escalation Complying with national and international laws or local codes of practice that ensure health and safety policies are employed, and Recovering from abnormal situations quickly to resume full production

Further advances have taken place over the last several years, adopted by industry leaders. These include the capability to manage security across multiple sites in real time, with a built-in backup, within the architecture of installed systems. This means added security from using multiple monitoring centers, using, of course, multiple means of communication to facilitate this and in some cases integrating legacy systems.

New technologies

New technologies are coming to market to address new needs in managing security in demanding situations.

The latest biometric advances now provide the ability to read iris and face shape, and recognize someone in a fast moving environment. Combining these with other biometric tools adds to the available list of techniques to authenticate someone at a specific point in time or location. Other techniques, such as hand geometry and fingerprints, are already seeing significant usage in the Oil and Gas industry. The latest smart cards that combine different capabilities such as ensuring that a card is only valid in a given person’s hand, is definitely an emerging technology.

Managing physical security is now enhanced with a new generation of small and medium sized Unmanned Air Vehicles. These can provide quick and safe launch as well as hovering capability similar to a helicopter, but in a much smaller size, for immediate reconnaissance where people have slow or no immediate access, or can provide regular overhead view and deterrent by patrols. Recent improvements have been for added capabilities while reducing costs and providing a variety of mission profiles that can be handled. They are equipped with high resolution video or other payload, providing live feed of the video stream to a remote command and control centre.

Cyber Security

Relentless assaults by hackers, viruses, worms and spy-ware have elevated the issue of cyber security to mission-critical status within most industries. Today, protection from a cyber attack is more than just a security issue; it is a fundamental business one. According to the Computer Security Institute, 90% of surveyed companies (large corporations and government agencies) detected security breaches in the past year and 80% acknowledged financial losses due to security violations. The British Columbia Institute of Technology (BCIT) maintains a database of cyber attacks, and specifically tracks and investigates industrial facility incidents. Its database shows that 50% of incidents result in process control facility losses greater than $1 million. 29% of those incidents involved a loss of view of the network and 41% resulted in loss of production.

Companies in the energy sector should establish a baseline of their current cyber security processes, procedures and safeguards that are used to protect the process control network (PCN) from external threats. Companies in the industrial and petrochemical sectors have realised the difference between protecting facilities and data, and protecting processes that are operated or controlled with information technology. Security measures that are appropriate for data networks could be disastrous if a compromised process threatens to damage productivity, capital assets and possibly human life.

The PCN is one of the most critical areas of any facility and it can also be one of the most vulnerable to the growing threat of cyber terrorism. Cyber threats can be classified in four categories:

• Indiscriminant and potentially destructive – Probably the most common threat faced by industries and private users throughout the world, this category includes virus, Trojan horse and worm attacks.
• Performance impacts and potential safety issues –Threats such as network spoofing and “denial of service” attacks can clog a PCN with spurious requests, preventing the operator from receiving a legitimate alarm.
• Confidentiality – Another of the most-publicised cyber threats is eavesdropping and password cracking which allows hackers to access confidential information such as business figures or recipe data.
• Confidentiality, integrity, and performance – This area is especially dangerous if the intruder has malicious intent. It includes data tampering, impersonation and packet modification.

To protect against potential cyber attacks, Honeywell integrates security into the system architecture. A hierarchical architecture establishes access restrictions at each network level while still supporting the business requirements for shared information. This high-security model includes a process for locking down nodes before software is installed. Honeywell has a team that is dedicated to the rapid qualification of Microsoft security hot fixes and antivirus software to ensure they will not disrupt the integrity of the system. 

Since processes are an important part of securing the system, Honeywell has developed a suite of Process Control Network (PCN) Security Services that evaluates system vulnerability and risk, and recommends appropriate changes.

Safe & Secure: they go together

It is now possible to have an integrated capability to manage the security of a site, with tight links to process Fire & Gas systems as well as buildings’ Fire & Gas systems together with shared video imagery between process management and site security management. In the recent past, process equipment safety, enabled by Emergency Shutdown Systems – Safety Instrument Systems (such as Honeywell’s Safety Manager) have gradually become more integrated into the process automation platform – as exemplified by Experion PKS’ integration capability.

Oil & Gas facilities need to operate at maximum possible throughput to get full advantage of the fixed costs. Whether for offshore platforms, FPSO operations, or onshore producing fields with remote operations, all of these facilities can benefit from a vulnerability assessment and/or review of their current security position, with a potential to gain uptime from detected or deterred security breaches that may threaten production levels if left unchecked. An integrated response in technology use can then make the achievement of improved security a more cost effective effort.