ESS.WP.925 Security for Control Networks
Security for Fuel Oil System Control Networks
Control Networks for fuel systems and other building systems have been identified as a source of vulnerability. Cyber Attacks on Data Networks have occurred using these systems for back door access. The resulting data breaches have been devastating for the facility owner as financial, medical, and security information is stolen.
Fuel System Networks
Earthsafe fuel systems typically include 3 to 30 PLCs networked together to share information. A C890 or C900 Master Controller provides a central monitoring point for the operator and includes a data interface to the wider building management system
Earthsafe fuel modules include C8, C80, C800 controllers that provide specific functions such as duplex fuel transfer pumps, tank fill control, day tank level contract, and fuel polishing. These controllers are linked in an Ethernet network to share information required for control and to provide monitoring status to the master controller and the larger building system network.
Networks are also vulnerable to damage or disruption form routine servicing of fuel system controls. We have the experience of being in data centers, where connecting to our fuel system network, means being exposed to virtually every PLC in the facility.
Isolation
Isolation is a key element in network security for Earthsafe fuel systems to control access. There are 2 parts to the need for this isolation. First to help protect the fuel system controls from unauthorized outside connection, or disruption from activity in connected building system networks. The second reason is to allow limited access to Earthsafe personnel for connection and monitoring or troubleshooting, with secure isolation from the larger building system network.
Remote Access for Internet of Things
The Internet of Things Concept is that the built in intelligence of our systems should be routinely accessed and monitored by Earthsafe for performance trends and alarm issues. This must be a nightmare scenario for facility network administrators, the idea that hundreds of technicians would be accessing its networks to look at their specific machines. However new network technology is available to allow this concept to work within a secure framework of authorized limited access to isolated network segments.
New Firewall Routers for Earthsafe Controllers
We now offer firewall routers in our C900 Master Controllers to Isolate and Authorize access to the fuel system control network. The Firewall Router has several functions: (a) allowing only authorized access between the building wide network and the fuel system network, (b) allowing on-site technician access to the fuel system network in isolation from the larger building system network, and (c) allowing the facility to turn on and off the capability for off-site technician access through secure VPN access.