KapStone s Cyber Security Initiative

Transcription

1 KapStone s Cyber Security Initiative Presented by James Wardlaw KapStone Paper & Packaging Co.

2 Agenda About KapStone Paper & Packaging Pre-security project network architecture Reasons for upgrading New cyber security scheme Benefits of the project 2

3 About KapStone Paper & Packaging Capacity: 2.7 Million Tons Paper Mills 4 Saw mill 1 Converting Plants 22 3

4 Pre-Security Project Architecture Power House ` PI #3 Pulp/Utilities 15 K Tags PI Clients DCS/PLC Pulp Mill Woodyard PI #2 Environmental 1K Tags ` Water/ Wastewater DCS/PLC PI #1 Paper Machines DCS/PLC/Gauging Systems ` Paper Machines 15 K Tags 4

5 Pro s and Con s of this network Pro s Easy device configuration (plug & play) Simple network, simple troubleshooting Con s Weak security everything on IT network Any network disruption caused data loss, no redundancy 5

6 Shortfalls of this PI System Con s 3 PI Systems to maintain No buffering due to lack of resources on old control systems Comm faults resulted in PI data loss 6

7 3 Goals for Improvement 2-year schedule Consolidation/Maintainability Improved Reliability Improved Security 7

8 Resources Applied The Rockwell security audit Control systems, PI and network OSIsoft cyber security expert, Bryan Owen OSIsoft field service, Dennis Hui IT Network Administrator Process Control Engineers 8

9 Consolidation 1 Power House ` PI #3 Pulp/Utilities 15 K Tags PI Clients DCS/PLC Pulp Mill Woodyard PI #2 Environmental 1K Tags ` Water/ Wastewater DCS/PLC PI #1 Paper Machines DCS/PLC/Gauging Systems ` Paper Machines 15 K Tags 9

10 Consolidation 2- PI2010 New MS Clustered Server with Disk Array Power House DCS/PLC/BatchFL/OPC/RDBMSI ` PI #2 Utilities/Pulp/Environmental PI Clients Pulp Mill Water/ Wastewater PI #1 Paper Machines DCS/PLC/Gauging Systems ` Paper Machines 10

11 Reliability Imperative to improve data reliability to Mill Systems and Business Systems Alternatives considered Microsoft Cluster PI High Availability PI 2012 HA does not support MS cluster 11

12 Security Requirements Isolate process network from Business utilizing DMZ Restrict access to process network This is what funded the project 12

13 Pattern 1: DMZ PI System Control Network DMZ Corporate Domain PI Interface Protected Domain PI ProcessBook PI Datalink TCP PI ProcessBook PI Datalink Web Server PI Coresight PI Notifications PI Webparts 13

14 Pattern 2: PI High Availability Control Network DMZ Corporate Domain PI Interface Protected Domain PI ProcessBook PI DataLink PI ProcessBook PI DataLink Web Server PI Coresight PI Notifications PI Webparts TCP

15 Final KapStone Configuration Control Network DMZ Corporate Domain PI Interface Protected Domain TCP 5450 GE/Proficy Server HA 5450 TCP PI ProcessBook PI DataLink PI ProcessBook PI DataLink Remote Desktop Gateway

16 Advantages of new architecture Much more robust security for process network Ability to isolate control network from business network without affecting operations 16

17 Advantages of PI High Availability Patch & maintain PI Server at will Plant floor can connect to both servers for improved availability Built-in disaster recovery 17

18 KapStone Security & Reliability PI 2012 HA 40k Tags 2 Collective Servers with SAN Improve security of control network Improve data reliability Reconfigured network and added DMZ Added PI High Availability All Interfaces now use Buffering Reduced maintenance cost Best practice security Reliable data for Business Systems 20

19 James Wardlaw Process Engineer / IT Analyst KapStone Paper and Packaging Corporation 21

20 Brought to you by