Customer wants us to upgrade the security features that determine access and levels of access to various parts of their control and automation system. They have issues with passwords being shared and keycards being borrowed or duplicated. Should we be looking to use fingerprint or retina scanners or the like? Just how industrial could we expect them to be? Are they cost-effective compared to more traditional security measures?
From May 2006 Control Design
Answers
Biometrics Available, But Dont Neglect HMI Software
Your customers security concerns certainly arent unusual. Many factors have contributed to an increase in security in nearly every industry. World events have contributed to these concerns, but in many industries, federal regulation (FDA, TREAD Act, Bioterrorism Act, etc.) have played an even larger role. Biometric verification has been a common answer to resolving identity verification issues, and as a result the market has responded with quite an array of vendors offering biometric input devices.
Many of these devices are designed to meet NEMA 4, NEMA 4X, and other industrial standards. Theyre commonly used in environments that I would consider light industrial, such as pharmaceuticals, semiconductor, chemical, etc. Harsher environments such as foundries, steel, heavy manufacturing and others might require some additional protection for these devices.
Manufacturers of fingerprint readers include U.S. Biometrics, Digital Persona, Lumidigm, Secutronix, and even Microsoft. There are a wide variety of solutions available, from modules that you would integrate into your panel and office-grade readers, to standalone, fully-sealed, industrial-rated readers.
There are even some manufacturers that integrate fingerprint readers into industrial computers and HMI hardware. These include AJM Automation, which uses a Parker-CTC HPX PowerStation.
An important consideration in an application like this is the HMI software thats providing the security. All of the input and verification devices in the world cant provide adequate security if the software behind them isnt up to the task. You might want to consider your HMIs capabilities in the areas of user administration, which includes unique user identification, inactivity logouts, password aging and length rules, restricting access to tools, and functions on a user basis, as well as OS considerations such as compatibility with active directory or domain-based integration. In some of the regulated environments, these considerations might expand to include capabilities like electronic signatures, secure audit trails, and capturing approved reasons for a change.
Parker-CTC produces an HMI product called InteractX, which provides the tools for compliance in even the most rigorous security environments (FDA 21CFR11). It meets all of the requirements above and more. You also might want to review the capabilities of your current HMI, and ensure that its able to support the security upgrades your customer is requesting. If not, a product like InteractX might be just the solution youre seeking.
Andy Balderson, product sales manager
Parker Hannifin, Electromechanical Automation, Rohnert Park, Calif.
Biometrics Are Simple, Inexpensive, Reliable
The use of biometric devices such as fingerprint or iris scanners is no longer science fiction. The need to use stronger passwords or devices to assure security of shop-floor systems is increasing. The issue with stronger passwords (passwords with combinations of letters and numbers) is that theyre often difficult to remember. Having users write them down violates the whole idea behind having them in the first place. To avoid this issue and avoid having users type in these longer and secure passwords, customers are turning to biometric devices to satisfy this need.
With GE Fanucs iFix Version 4.0, customers can add biometrics, which is typically the ability to use an iris scanner or fingerprint reader instead of entering a password. These devices arent expensive. Fingerprint readers are under $100, and iris scanners are available for about $250.
iFix 4.0s integration toolkit option delivers a set of biometric interface tools that enable a developer to marry iFixs electronic signature dialogs with any biometric solution. We also provide connectivity to a third-party biometric technology solution from a company called Saflink. Users install Saflinks SAFsolution on their computers, and its software manages all their biometric devices, and integrates with Windows Security. iFix then references the SAFsolution software any time an electronic signature password is required. Its a very simple, cost effective, and reliable solution.
Craig Thorsland, Proficy HMI/SCADA, and global process marketing
GE Fanuc Automation, Charlottesville, Va.
Enforce Security Policies; Justify Biometrics Costs
A relatively simple and cost-effective way to upgrade security is to improve management support and enforcement of security and access policies. By clearly defining the security requirements and educating personnel on the importance of these procedures, employees can better understand their role in keeping the plant floor secure.
If policy reinforcement from management doesnt help, biometric technologies are a more aggressive option. However, fingerprint identification technologies tend to get dirty in industrial environments, so retina scanners and other biometrics might be a better option.
As for cost-justification, the same concerns are true for any security technologyit depends on the cost of the control. For example, if a security technology costs $500 to implement, but downtime on the line that it secures costs $10,000 per day, then the cost of the security technology is justifiable. If the cost of the control is significantly more than what it mitigates, you will want to look for another option.
Bryan Singer, senior business consultant, chairman ISA SP-99
Rockwell Automation, Milwaukee
Octobers Problem
Should We Switch to PC-Based Control?
Weve gotten along pretty well with PLC-based machine controls. We supply machines to the contract liquid filling industry where we and our customers havent had to deal very much with enterprise connectivity issues until now.
Were having some difficulty sorting the competing vendor arguments that 1) we should just augment our PLC controls with a PC-based HMI to obtain the needed connectivity, or 2) we need to convert entirely to PC-based control to eliminate integration and support issues. Any advice?
Send us your comments, suggestions, or solutions for this problem. Well include them in the October 2006 issue and post them on ControlDesign.com. Send visuals, tooa sketch is fine.
E-mail us at [email protected] or mail to
The Answer to Your Problems, CONTROL DESIGN,
555 W. Pierce Rd., Suite 301
Itasca, IL 60143.
You can also fax to 630/467-1124.
Please include your company, location and title in the response. Have a problem youd like to pose to the readers? Send it along, too.
