How to retrieve data from a scada-PLC system without infecting it with virus? 2

[SA07]

Hi

Often we have to retrieve data, alarms, trends, print screens of process values and share. Is there a way of doing this without infecting the system with virus if we use a pen drive between our office laptop and the system?

Initially we were using a CD. Nowadays most laptop do not have a CD drive and the personnel find this tedious.

Is there any anti-virus installed on a scada-PLC system e.g Siemens PLC 400 for a power plant? Does Siemens, ABB, Schneider recommend to install anti-virus on their system?
Are there examples of power plant shutdown of scada-PLC due to virus in the past? Thks

 

[esperantes]

Please make sure to keep your control system updated and protected with validated Microsoft security updates and verified 3rd party Antivirus files. You may also wish to make sure with your service provider that common antivirus software's like McAfee and Symantec updates are verified for relevance and system compatibility with your control system software.
Esperantes

 

[thebard3]

I don't believe there are any specific security issues that are particular to automation equipment that wouldn't also apply to a business enterprise system. Whatever IT security procedures and processes are employed should be used everywhere in your business.

You may find some interesting and helpful discussions here- Link

Brad Waybright

The more you know, the more you know you don't know.

 

[IRstuff]

You should check that the system does nothing upon insertion of a flash drive; Windows systems have the option of running Windows Explorer, or opening a specific file on the inserted drive, or doing nothing.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[MacGyverS2000]

thebard3 has the answer.

And if you want an example of shutdowns, all one has to do is Google StuxNet... that will put the fear of God into any SCADA/PLC maintenance tech.

Dan - Owner

http://www.Hi-TecDesigns.com

 

[FreddyNurk]

The short answer is that if you're using USB drives to transfer such data, you're doing it wrong.

The long answer, as an augment of what thebard3 has said, is that the system should be configured such that access to such equipment via things like USB sticks for data retrieval is never required.
Access to some sort of historian, only via authenticated users, would be one of the ideal cases. It used to be the case that such access was at least partially obfuscated via use of serial communications, but with ethernet, most equipment is effectively wide open should anyone look hard enough for it.

I am only too well aware, however, of the general issues in getting both IT and OT to agree on what is needed, how to implement it, and who is to support it.

EDMS Australia

 

[sushilksk]

We have used Hyperterminal for sending data over serial connection between SCADA PC and other PC, it is slow but safe.

 

[FreddyNurk]

Hyperterminal has been pulled from Win10, if a serial means of extracting data is desired, better off using PuTTY.

EDMS Australia

 

[SA07]

Often colleagues do print screens on workstation and must share them with others through mail.

 

[MacGyverS2000]

It doesn't matter what you want/need to do... there's simply zero method that will completely prevent infection, barring turning the machine completely off and leaving it in that state forever.

Dan - Owner

http://www.Hi-TecDesigns.com

 

[davidbeach]

The system needs to write the data to a table and the historian reads the data from the table. No direct interaction between the process system and the historian.

I’ll see your silver lining and raise you two black clouds. - Protection Operations

 

[MacGyverS2000]

Writing/reading a table indicate access from more than one path/direction... and this is what virii take advantage of.

Dan - Owner

http://www.Hi-TecDesigns.com

 

[IRstuff]

Sure, you can print out hard copy, scan/OCR into something else; bad for the environment, but infection free. No guarantees about the infectibility of the printer, though.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[davidbeach]

If the process device is only pushing out data and never receives anything it can't be infected. The data in the table could become compromised before the historian reads it, but there shouldn't be a path into the process equipment.

I’ll see your silver lining and raise you two black clouds. - Protection Operations

 

[MacGyverS2000]

Think you can't infect a computer from a scanned image? Think again... BTDT.

Dan - Owner

http://www.Hi-TecDesigns.com