Designing secure networks for process control

In most industrial plants, there is a strong drive to provide business applications with some access to real-time data generated from process control systems. Often, this has been in the form of a process historian database server connected to both the distributed control systems/programmable logic controller (DCS/PLC) systems and the business users. It can also take many other forms such as remote X-Windows sessions from the DCS, or direct file transfers from PLCs to users spreadsheets. Regardless of the method, it involves a network connection to both the process and the business side. These network connections are increasingly Ethernet based on both sides, rather than proprietary industrial protocols. At the same time, most control systems now use Ethernet networking as a critical component of their system architecture. This can be for controller-to-controller communications, controller-to-operator console communications or even I/O-to-controller communications. Losing any of these links will directly impact production. The issue is that problems on the business network can be passed on to the process network through this process data link, seriously impacting production. Protecting that process system from external network problems is the focus of this article.