As I discussed in an earlier blog, when an electronic control system is part of the security protection system of a chemical facility, or is simply a component of the facility that requires protection as part of the Site Security Plan, on site access to that control system has to be protected. I have discussed using physical security of keyboards as a method of controlling that access. Now it is time to look at using electronic access controls as part of the security procedures for the facility.
The simplest way to protect access to a computer electronically is to require the user to sign on when turning the computer on and require the use of a password or biometric device to complete the sign-on process. At shift change, in control rooms for example, the outgoing operator would be required to log-off of the system and the on coming operator would then log on. To control mid-shift access the Screen Saver option can be used; requiring password or biometric verification to turn off the Screen Saver.
While this system is simple in concept, operationally it is abit more difficult. First it requires that each person authorized routine access to the control system as part of their normal duties has access to a unique computer or work station. While that access point can be shared across shifts, within a shift that person should be the only one with access through that keyboard.
Setting up this type of access control for an electronic control system is straightforward, requiring no real programming knowledge. It does, however, require some training as to why the operator has to go thru the extra work of repeatedly signing on to the work station or computer. If passwords are used, employees need to be trained on proper password selection, use, and protection; they must be taught the reason for the use of the password protection and monitored in their proper use of the password protection system.
A more efficient way of controlling access to the electronic control system requires some system engineering and programming. The first thing that must be done is to determine which portions of the control system are actually security related. For example control valves on a highly hazardous raw material tank might require access controls where the control valves of a nearby fatty alcohol would probably not. Identification of these controls should be covered in the Site Security Plan.
Once these controls are identified, it then becomes a programming function to require password or biometric identification to access those particular controls. Adding dual access control, two different people using separate passwords of biometric identification, for especially critical functions is not much more difficult.
While either method can limit access to critical portions of the electronic control system for the chemical facility, the selection of which system to use will depend on the facility. Where the facility only has a limited number of operations of the control system that directly affect the site security; the programmed system is better. If operators spend most of their shift in front of the keyboard so that they are not constantly re-logging onto the system due to screen saver shutdown, then the log on controls are probably adequate. The team designing the site security plan will have to take these variables into consideration.
Finally, these access controls, like the physical security controls discussed in the earlier blog, are only as good as the auditing system put into place to ensure their proper use. If management is not willing or able to periodically check that these programs are being used, operators will find ways to short cut the system to make their jobs easier; that is simply human nature. The auditing system does not have to be punitive, but it does have to be visible to be effective; management has to demonstrate that they believe that the systems are integral to the security of the facility.
Posts
No comments:
Post a Comment