Terminator termination! Byres say goodbye to Tofino!

Eric Byres and his wife Joann Byres (Tofino co-founder and Belden Vice President) have announced that they are retiring from the Tofino Security group at Belden effective January 30, 2015.

Joann & Eric Byres

In Eric's last blog at Tofino/Belden he states, "As we reflect back on almost a decade and half in the industrial security business, we remember the wild ride it has been to create and grow both a SCADA security business and the industry as a whole. From our early days of critical infrastructure security research, to Stuxnet, to last year’s release of the Tofino 2.0 product line, we have seen a lot of changes.

"When we think about what we aimed to achieve, we’re glad that some of our core beliefs have gained widespread acceptance. This includes the principle of “security simplicity” and the necessity of Deep Packet Inspection (DPI) for industrial protocols. We also tried to contribute to the ICS security industry overall and our work on standards, particularly with ISA, was rewarding.

"Stepping away from industrial security, Tofino firewalls and endless airport security checks is going to be a big change. "

Eric in full battle gear!

This blog then outlines the influential work accomplished during their time batteling against the evils of the syber, especially in their innovative work following the discovery of Stuxnet and the initial warnings they issued, "Security threat to the control system world!"  in 19th July 2010.

The world of industrial automation owes a debt to the "Stuxnet Terminator" and his work against this and many other "little varmints!"

We wish them both well in their retirement and having seen details of some of the ideas they have for their retirement we know that the will continue to make an impact on the standard of living of disadvantaged youth in our unequal world.

Secure critical industrial infrastructure

New ConneXium Tofino Products Deliver a Simple Way to Secure Automation Systems

Schneider Electric has selected Tofino Security technology, from Belden Inc.,  to protect its industrial automation systems. The new ConneXium Tofino Security Solution is a suite of products that hardens industrial systems against network incidents and cyberattacks, improving operational security, reliability and performance.

In the last decade, industrial automation systems have been increasingly linked to business systems as organisations look to work smarter and more efficiently. Legacy industrial communication systems originally designed to work only within facility walls are now a hub of information activity, with intelligence passing back and forth between the plant floor and, when necessary, the outside world.
At the same time, the cyber threat level for critical infrastructure, especially threats aimed at energy, water and transportation systems, has increased dramatically.

“Processors and manufacturers are continuously threatened by new and increasingly dangerous cyberattacks, which require greater vigilance and security,” said Dave Doggett, program director for Industry Cyber Security at Schneider Electric. “The ConneXium Tofino Industrial Security Solution provides a key element in mitigating risks by managing the traffic to and from Schneider Electric automation devices before patches are applied or new more secure products deployed.”

“In addition this capability can be used to enforce plant procedure by blocking inappropriate programming commands to devices, preventing mistakes. By collaborating with the experts at Tofino Security, we are able to provide our customers with an easy-to-deploy industrial grade firewall that works seamlessly with our systems.”

The core of the new product line is the ConneXium Tofino Firewall, a rugged security appliance. By inspecting each network message that passes through it, the firewall can ensure that only the right network messages from the right computers can be sent to critical controllers. Hacking attempts, deliberately corrupted messages and even network traffic storms are stopped dead by the ConneXium Tofino Firewall.

The popular Modbus protocol is further secured using the Deep Packet Inspection capabilities provided by the ConneXium Tofino Modbus TCP Enforcer module. Only “allowed” Modbus commands from “allowed” devices go through the firewall, preventing incidents caused by inappropriate remote programming or deliberately corrupted messages from malware until appropriate patches or changes can be applied to the control system.

The firewall is configured using the new ConneXium Tofino Configurator, Windows-based software that includes Tofino’s patented Plug-n-Protect technologies. “We have worked hard to make the ConneXium Tofino a solution that can be used out of the box,” said Eric Byres, CTO and vice president of engineering at Tofino Security. “Engineers don’t need to be security experts to secure their facility with Tofino.” See Eric Byres article on the Tofino Blog, "Making SCADA Security Simple with the Schneider ConneXium Tofino Firewall" (14/11/2012).

An example of the Plug-n-Protect technologies included in the ConneXium Tofino are 15 pre-configured templates for major Schneider automation products. Engineers simply select the models of Schneider product they are using in their plant from the templates. They then decide which devices they want to allow communications to and the ConneXium Tofino Configurator automatically determines the appropriate rules. The software also includes expert technology that looks for common mistakes in firewall programming and proposes possible improvements.

Bob Lockhart, senior research analyst, Pike Research commented, “Automation systems face unique cyber security challenges that require protection, built by companies that understand how those systems work. Lacking extravagant IT budgets, automation systems also require cyber security systems that just work, with a minimum of human intervention. Companies want to focus on their core business, not the enabling technology.”

Once in the field, it is easy to keep the ConneXium Tofino Firewall up-to-date using Tofino Security Profiles. These are sets of tailored rules and protocol definitions that defend against newly disclosed vulnerabilities and malware. Each Tofino Security Profile is packaged so that it can be quickly deployed without impacting operations, thereby providing a quick and effective defense against new threats. For example, recently Schneider Electric utilized the Tofino Security Profile feature to make available mitigation against publicly announced vulnerabilities in its Modicon PLC product line, allowing customers quick access to a mitigation prior to the subsequent release of new firmware without the need to interrupt production for a firmware update until a scheduled maintenance period.

The ConneXium Tofino Security Solution is the latest offering in the ConneXium family of industrial communications and security products. Earlier in 2012 the ConneXium Eagle Firewall was released, providing boundary protection and encryption for industrial facilities.

New position to focus on security business

Byres Security, now part of of Belden, has strengthened its organisation with the appointment of Frank Williams as Senior Product Manager. Williams has 30 years of senior management experience in bringing new technologies to market in the process automation industries. In his new role, Williams will focus on strategy, platforms and sales channels for growing the Byres’ Tofino Security line of business.

During his career, Williams has been a key player in taking new technologies like industrial computers, industrial-grade human machine interface (HMI), fieldbus devices and industrial wireless from early to mainstream adoption in the automation industries. His most recent positions were chief executive officer of ELPRO Technologies Pty Ltd., a world leader in industrial wireless products (ELPRO is now part of Cooper Bussmann Wireless) and president and chief executive officer of Action Instruments, a global supplier of single conditioners, measurement and data acquisition solutions for industrial and process businesses (Action Instruments is now part of Eurotherm, a division of Invensys). Williams also brings his extensive industry network to Byres Security.

“Industrial cyber security is the next major impactful technology to hit the automation and process control industries,” he said. “Realising this, I reviewed and searched the security landscape and decided to put my energy behind the Tofino Security suite of solutions. I believe it has the best technology available for protecting industrial networks from the rapidly growing threat of industrially-focused malware.”

“We are very excited to have Frank join our team,” commented Joann Byres, vice president and general manager of Byres Security. “He adds a wealth of automation industry business and management experience into our group, and he will be invaluable as we ramp up development and sales channels as part of Belden.”

• See Frank Williams first contribution on the Tofino Blog Site: Industrial Data Compromise – the New Business Risk (11/1/2012)

SCADA security simulator

Byres Security (now part of Beldon - see our blog Major Acquisition strengthens war on Stuxnet etc...) has released the new Tofino SCADA Security Simulator (TSSS), part of the Tofino Industrial Security Solution. The product is a complete control system in a box, designed to demonstrate the vulnerability of SCADA and PLC components to security failures, and to test new solutions. It makes the impact of security failures to critical industrial processes easy to grasp, and it shows how to secure processes using the Tofino Security Appliance (TSA). The TSSS is an important tool for helping infrastructure operators, vendors, systems integrators, government agencies and researchers improve Industrial Control System (ICS) security.

Eric Byres demonstrates the new TSSS in this video!

“Cyber threats to industrial processes have been difficult to demonstrate, making it hard to test designs, train staff or research mitigating technologies,” remarked Eric Byres, CTO and VP Engineering of Byres Security. “Now, with the Tofino SCADA Security Simulator anyone can understand both the impact of security breaches on industrial processes and how to stop them.”

A typical TSSS demonstration starts by showing how SCADA and Industrial Control Systems operate, using a widely deployed PLC to control production. Next, SCADA specific malware attacks the control system and destroys the process. Finally, the system is secured using leading technology such as the Tofino Industrial Security Solution. The TSSS provides hands-on experience and reveals the impact of SCADA security in a tangible and visual manner.

Joel Langill, CSO of SCADAhacker.com, explains: "You can only be so effective when trying to explain cyber security to someone using a deck of PowerPoint slides. When you shift the discussion to an actual demonstration showing both an attack and a successful mitigation to an attack, people actually understand it."

Joel continues: "As a security consultant, I use the TSSS not only for simple demonstrations of cyber security controls, but also to implement various security strategies in an offline manner. I can then develop corresponding Tofino Security Appliance configuration schemes which can be applied to online production systems. I find it very handy to be able to use the TSSS with a variety of SCADA / HMI applications, and with associated field control equipment like PLCs, RTUs and application servers."

The Tofino “complete SCADA simulation system in a box” is available in a portable carry-on case, or in a large “trade-show” format. It comes with simple step-by-step instructions for demonstrating SCADA operations, security risks and security solutions. Simulations are available for gas pipelines, power facilities, chemical plants and water utilities. The product is available now from Byres Security and from Tofino Certified VARs.

• See Eric Byres's blog: A Truly Portable SCADA Security Simulator (29/9/2011)

Control system security and OPC

Effective OPC solutions mean better control system security

MatrikonOPC and Byres Security have just published a new white paper on security and OPC. Eric Byres explains: "OPC is the world’s most widely used industrial integration technology for SCADA and ICS systems. Due to this popularity, I believe it is vital that controls and network professionals understand how to deploy it securely."

Click for Blog: OPC Security:
More than the Sum of the Parts

For the past decade, industrial control system professionals have wanted to believe that ‘air gaps’ truly existed between their systems and the rest of the world. They have also hoped that ‘security by obscurity’ would keep them safe from security threats.

Those days are over. Recent security incidents such as the game-changing Stuxnet worm are a wakeup call for the industrial automation industry. While the risk of cyber attacks and malware are no longer in doubt, the question remains, “Exactly how can an engineer reliably secure his or her control system?”

Complicating the situation is the widespread use of commercial off-the-shelf (COTS) information technologies like Windows and Ethernet on critical control systems. The use of these common networking, computer and software technologies has certainly reduced costs and increased business agility. However, it has also increased the demands to balance the need for accessibility to control system data with the need to safeguard the integrity and usability of mission critical systems.

One of the most effective ways to manage the conflict between the demands of efficient access and the demands of effective security is to minimize the variety of interfaces and protocols operating between the control system and external networks. Having one approved connectivity solution serving multiple corporate requirements not only reduces administration costs, but also reduces the opportunities open to the attacker or worm. This is known as "reducing the attack surface” of a system.

Thus the key task for an administrator is to select an appropriate communications technology that can be used by the widest variety of control AND business systems. While there are a number of possible candidates, OPC is without question one of the easiest and most widespread standards to address the demands of universal data access in the industrial automation world.

By layering defenses that are OPC-aware, high security solutions can be created that meet both the security and access expectations of a company, all without administrative overload on the network or controls team. The result is a standards-based solution that has been proven across numerous control systems.

Furthermore, since OPC is so universal, it has the potential to be the only protocol needed for enterprise to control system communications. And following the security principle of “reducing the attack surface”, an OPC-based solution is possibly the most secure solution for control system interfacing available today.

It is important to emphasize the standards in recommending an OPC security solution. There are many so called “security solutions” that are secure only because they are obscure. It only takes one determined hacker (such as Luigi Auriemma who published 34 SCADA/HMI vulnerabilities in March 2011) to break into proprietary systems and publish the exploit code on the Internet. Then “security by obscurity” is useless.

In terms of providing network-focused security, an OPC-aware solution is the Tofino Security Appliance with the Tofino OPC Enforcer Loadable Software Module. It is designed to secure ANY OPC product, because it uses core IP, TCP, RPC and DCOM standards exactly as they were intended. Similarly, for application-focused security, and for granular role and user-based security, the MatrikonOPC Security Gateway is fully based on the OPC Security specification and provides complete security for OPC architectures.

These two products have been successfully tested together with the Tofino technology providing front line protection from 99.99% of all network based attacks such as Denial of Service, unapproved clients, malformed DCOM connections etc. Once network traffic related to OPC has been vetted, the MatrikonOPC Security Gateway enforces the specific security policies chosen by the administrator– ensuring each user only gets access to the specific data he or she has authorization to work with.

The bottom line for control engineers looking for a reliable security solution is: if you use one protocol for control system communications and if you select standards-based OPC security products, you can achieve high security without administrative overload.

For a detailed discussion of defense in depth for OPC Security, download the White Paper “Effective OPC Security for Control Systems – Solutions you can bank on”.

How Stuxnet spreads!

Eric Byres, CTO of Byres Security Inc., Andrew Ginter, CTO of Abterra Technologies and Joel Langill, CSO of SCADAhacker.com announce today the release of their joint White Paper “How Stuxnet Spreads – A Study of Infection Paths in Best Practice Systems.”  It is the first paper to detail how Stuxnet could infect a control system site protected by a high security architecture using modern, vendor-recommended best practices. The paper shows that current best practices are insufficient to block advanced threats. It then discusses what operators of control and SCADA systems need to do to protect their critical systems from future threats of this type.

• Click on image for more on Stuxnet!

Stuxnet is the first known malware to have been designed specifically to compromise a control system and sabotage an industrial process. It has been described by Symantec's forensic experts as the “most sophisticated” piece of malware they have ever seen.

The paper follows the progress of the worm as it moves through a hypothetical control system, configured according to vendor-recommended security best practices. In spite of strong security measures, the worm is able to compromise a sequence of machines, culminating in the compromise of the PLC devices which directly control the physical process.

While Stuxnet is presumed to have targeted the Siemens WinCC and PCS7 systems used at Iran’s uranium enrichment plants, its existence creates a new cyber security standard for all automation and critical infrastructure sites around the world.

Andrew Ginter remarked “The Stuxnet worm is the best-documented example of an advanced threat designed to sabotage an industrial control system. Other recent attacks have targeted control systems for industrial espionage. Control systems are now targets of advanced threats and today's best-practice defenses must be improved before they can stand against these kinds of adversaries.”

“By explaining how Stuxnet works, our paper helps security professionals understand what it takes to properly secure a state-of-the art industrial control system,” said Joel Langill. “The reality is that the majority of critical facilities are protected much less thoroughly than the hypothetical site described in our paper, and now they need to step up and protect against Stuxnet-like malware.”

“Our paper goes into great detail on Stuxnet infection pathways and highlights the difficulty of preventing infection from an advanced threat. While best practices for prevention should be implemented, control system operators should also put into practice early detection, mitigation, and containment strategies,” remarked Eric Byres. “Such strategies include putting into practice zone-based security as described in ANSI/ISA-99 Standards, paying particular attention on securing last line of defense critical systems, and understanding the unique security challenges of control systems versus IT systems.”

The paper concludes that changes to improve the cyber security of industrial control systems are urgently needed.

First fixed configuration firewall for Modbus TCP!

Honeywell is expanding its use of Tofino technology with the release of its third Byres Security/MTL Instruments product – the Honeywell Modbus Read-only Firewall. Designed to secure any Safety Integrated Systems (SIS) used in industrial processes, the firewall detects and blocks any network messages that might change data, programs or settings in critical systems. The new security appliance provides an additional layer of protection against unwanted and harmful network traffic, thereby increasing network security, reliability and performance.

Honeywell products that use Tofino technology
• NEW - Honeywell Modbus Read-only Firewall
• OneWireless Firewall
• Honeywell Modbus TCP Firewall

Safety Instrumented Systems, such as Honeywell’s Safety Manager™, are the last line of defense against accidents in hazardous industrial processes such as oil refining and energy generation. They monitor the process continuously and automatically shut down the plant in a safe manner if they detect anomalous conditions. Their importance to the safety and reliability of the operations and staff of the entire facility means it is essential that SIS are secure from all threats, both accidental and malicious.

This is unique in the industry as it is the first fixed configuration firewall to use Tofino’s “deep packet inspection” technology against the popular SCADA protocol, Modbus TCP. This technology scans every network message, only allowing a very limited set of valid Modbus “Read-only” commands through to the safety system. These are safe commands that cannot be used by malware to change the functionality of the safety system. The firewall’s fixed rule sets remove the possibility of tampering or mis-configuration and significantly reduces the effort required by the plant to maintain the firewall.

This new product is Plug-n-Protect™ and pre-configured so that the firewall is simply installed into live networks between the safety system and other control systems. There is no configuration needed. Unlike IT-style firewalls that require highly-trained staff for installation, it can be used by facilities that need a solution that works instantly once it is connected to the network.

The Honeywell Modbus Read-only Firewall is not just for Honeywell safety systems. It can be used with any safety system product connected to Honeywell Experion systems via the Modbus TCP protocol. To date, Honeywell has tested and confirmed the firewall with three major vendor’s SIS products.

“We are delighted that Honeywell continues to expand its relationship with us, showing that Tofino technology is effective for Honeywell customers, and that there are multiple applications for Tofino within Honeywell’s product lines,” said Joann Byres, CEO of Byres Security Inc.

“Honeywell is a true industry leader in its focus on security for critical systems.” remarked Eric Byres, CTO of Byres Security Inc. “The fact that Honeywell has tested this product for other vendor’s safety systems shows that they want a solution that works for the entire industry.”

Controlling spread of Stuxnet

New application note:  Preventing the spread of the Stuxnet worm in both Siemens and non-Siemens network environments.

One of the key things Byres Security have learned in their test lab (and confirmed by INL at the ICSJWG  - US Industrial Control Systems Joint Working Group - meeting last week) is that the Stuxnet worm is very aggressive once it accidentally gets into a control system. And once it is in, it is almost impossible to remove, since the worm just keeps popping up as it re-infects PCs.

We have a number of links to Stuxnet related articles at the bottom of our blog "Stuxnet – not from a bored schoolboy prankster!"

To counteract this they wanted to create a document to give specific guidance on how to prevent Stuxnet and Stuxnet-like worms from migrating between ANSI/ISA-99 security zones in a control system. Of course the configuration examples they use are based on their Tofino Industrial Security Solution, but the concepts are generally applicable to other firewalls.

The paper (pdf) is available on the Tofino Blog from Monday 7th September 2011.

Stuxnet paper updated

The single most visited page in the Read-out Blogs is that written by Nick Denbow last month (Sept 2010) which we entitled: Stuxnet – not from a bored schoolboy prankster! (21/9/2010). We have endevoured to add links from other sources to this from time to time. This one will also be added to it.

Now Byres Security has issued the latest version of their Stuxnet White Paper and we consider it important enough to add it as a separate blog.

Basically they have massively updated the original paper, published at the start of the Stuxnet event (back in July - see Security threat to the control system world!) to focus on specific mitigations that are recommended for all control systems, regardless of whether Siemens product is used or not.

• A new summary of what Stuxnet is, what its consequences are, and how it is spreading

• A revision of the list of vulnerable systems

• An expanded analysis of the available Detection and Removal tools

• A new Prevention/Mitigation section that covers both patchable and non-patchable systems
  

The paper, which is Version 3.0 of this Stuxnet White Paper has been renamed to: 'Analysis of the Siemens WinCC / PCS7 “Stuxnet” Malware for Industrial Control System Professionals' and may be downloaded from their Tofino Website.

OPC Firewall shipping

Earlier this month we reported on Byres Security's Tofino OPC Enforcer, a rather revolutionary firewall technology. This is now available and shipping. This new module is designed specifically to secure industrial systems using OPC Classic.

OPC Classic (i.e. all OPC variations other than OPC-UA) is the world’s most widely used industrial integration protocol. Unfortunately, it is also famous for being very difficult to secure.

The Tofino OPC Enforcer radically changes the OPC security landscape because:

• It is the first ever industrial firewall for managing OPC traffic. Unlike other firewalls, this product inspects, tracks and secures every connection made by an OPC application, opening only the exact TCP port required for a connection between an OPC client and server.
  
• It is implemented without requiring any changes to the control system. The Tofino hardware is simply installed into the live network and configured using a drag and drop editor to select permitted clients and servers. Once installed, network security is assured, with all OPC traffic managed behind the scenes.

They have also published an OPC Feature Page, which is a hub of information on OPC and security, and includes a link to download a new White Paper titled “Securing Your OPC Classic Control System” written by me and Thomas J. Burke, the President of the OPC Foundation.

Security breakthrough for OPC-based industrial automation

New Tofino® OPC Enforcer technology secures any system using classic OPC, the world’s most widely used industrial integration protocol
Byres Security has released the new Tofino OPC Enforcer firewall, part of the Tofino Industrial Security Solution. This new module locks down any industrial network using the previously hard to secure OPC Classic protocol. Using deep packet inspection firewall technology, the Tofino OPC Enforcer provides superior security over what can be achieved with conventional firewall solutions. The result is improved network reliability, availability and security for any process control or SCADA company using OPC.

Byres Security have published an OPC Feature Page, which is a hub of information on OPC and security, and includes a link to download the new White Paper titled “Securing Your OPC Classic Control System” written by me and Thomas J. Burke, President of the OPC Foundation.

OPC Classic is widely used in control systems as an interoperability solution, interfacing control applications from multiple vendors. Unfortunately, as numerous studies show, the technologies underlying it were designed before network security issues were widely understood. As a result, OPC Classic has been almost impossible to secure until now.

Thomas J. Burke, the president of the OPC Foundation, notes; “The Tofino OPC Enforcer is an important innovation and a great solution for all the systems that currently use OPC Classic – approximately 90% of all industrial networks”.

While the OPC Foundation is working hard to get its new and more secure OPC-UA technology into the market place, it will be years, if not decades, before all legacy OPC DA, HAD and A&E installations are replaced. In the meantime, the Tofino product addresses the security gap by providing a plug-n-protect solution that can be deployed in minutes without changes to existing OPC systems.

The Tofino OPC Enforcer provides two important benefits to control systems users:

1. It provides robust security and stability for any system using OPC DA, HAD or A&E, thus preventing industrial network attacks and accidents. Unlike other firewalls, this product inspects, tracks and secures every connection made by an OPC application, opening only the exact TCP port required for a connection between an OPC client and server.


2. It is implemented without any control system changes. The Tofino hardware is simply installed into the live network and configured using a drag and drop editor to select permitted clients and servers. Once installed, network security is assured, with all OPC traffic managed behind the scenes.

The recent Stuxnet worm attacks against Siemens HMIs and PLC systems has highlighted the need for better security on the plant floor. At the same time, many incidents result from internal network problems.

“Past industrial shutdowns, for example, haven’t been caused by hackers. Instead they were the result of badly configured software causing traffic storms that impacted critical controllers and other systems,” said Eric Byres, security expert and Chief Technical Officer at Byres Security. “The Tofino OPC Enforcer LSM does much more than block hackers and viruses from accessing automation systems. Its dynamic port management techniques prevent many basic network problems from spreading throughout a plant or SCADA system.”

Availability and Requirements
The Tofino OPC Enforcer is available now from Byres Security and from leading automation industrial suppliers MTL Instruments and Belden / Hirschmann. It requires the Tofino Security Appliance, the Tofino Central Management Platform and the Tofino Firewall LSM. The technology will also be available as a stand-alone appliance, the Triconex Tofino Firewall from Invensys Operations Management in Q4 2010.

Customer value enhancement award

Frost & Sullivan recognizes Byres Security
Solution addresses challenge of cyber security and prevents network accidents

Based on its recent analysis of the industrial network security solutions market, Frost & Sullivan recognizes Byres Security Inc. with the 2010 World Customer Value Enhancement Award in Industrial Network Security Solutions.
The industrial network security market has been growing significantly to combat rising malware attacks and industrial network intrusions in the industrial environment. End users are well aware that such security accidents can shut down the plant operations in a few seconds, create environmental and safety risks and significantly damage the company’s reputation, which induces them to protect their network infrastructure. The need for adopting such security solutions is also driven by stringent government regulations and industry standards being imposed upon the diverse end-user verticals to mitigate the risks associated with security incidents, as well as improve overall system reliability and prevention of network-related accidents.

Traditional IT network security infrastructures comprised of firewall appliances, virtual private networks (VPN) and other demilitarized zone (DMZ) approaches have been designed to tackle this problem. However, with the increased integration between the plant floor and enterprise systems, control systems and other related equipment are now exposed to such intrusion threats. Industrial network security system vendors are often faced with varying plant network policy requirements, and the key challenge for them is to develop and deploy a robust, flexible security solution that keeps the network simple, threat-proof, highly scalable and easily managed.

Frost and Sullivan’s detailed investigation indicated that Byres Security’s flagship product, the Tofino™ Industrial Security Solution addresses these industry challenges. The company’s ability to offer a complete industrial network security solution that can be customized not only for various plant network infrastructures but also across diverse end-user vertical requirements has ensured it consistent market growth. Leading control system vendors such as Honeywell, Hirschmann, Invensys and MTL Instruments continue to partner with Byres Security to develop customized industrial network security solutions.

Byres Security’s solutions help end users meet changing government security regulations and industry standards. Working in tandem with the leading control system vendors to develop customized robust security solutions illustrates the company’s commitment to innovate and develop advanced security products and services on an ongoing basis. For instance, Honeywell has introduced the Modbus TCP Firewall product based on the Tofino security technology and Invensys has introduced the Triconex Tofino Firewall to secure OPC Classic communications.

The integration of industrial safety and security policies across different critical end-user verticals has attracted many leading companies such as Exxon-Mobil, Shell and Boeing to implement the Tofino™ Industrial Security Solution, and a similar trend is anticipated among the other end-user verticals as well.

“The industrial network security market is becoming increasingly fragmented, with several players introducing products that give customers visibility into the plant assets interconnectivity, control of the flow of information within the plant enterprise, and the ability to halt inadvertent information leaks to outside of the enterprise,” explains Jebin Thomas Varghese, Senior Research Analyst for Frost & Sullivan. “The challenge for industrial control systems security vendors is to offer a robust and reliable security solution that offers these features while still addressing diverse network infrastructure security requirements.”

The Tofino™ Industrial Security Solution products are rugged, effective security solutions that have been well-received in the security market. These high mean time between failure (MTBF) solutions, specifically designed for industrial control system environments that operate seven days a week with no down time, have gained wide acceptance in the manufacturing space. The fact that the Tofino solutions protect the industrial environment from outside threats as well as accidental internal threats has been proven in the market, as leading control system vendors have been incorporating these solutions in their systems.

“The persistent focus of the organization to make network security simple and to offer a complete security system package has and will continue to aid Byres Security to grow in this market,” adds Varghese.

“Winning the 2010 Customer Value Enhancement Award for Industrial Network Security is an honor and a testament to the approach we have taken with the Tofino Industrial Security Solution. We designed it from the ground up to meet the needs of industry,” remarked Eric Byres, security expert and CTO of Byres Security. “Controls technicians find it simple to configure, it is implemented without plant downtime, all hardware is industrially hardened, and it secures industry specific protocols like Modbus TCP and OPC Classic.”

“This award represents a significant tribute for our company and I want to recognize and thank the partners that helped shape our products and make them available across the markets we serve: MTL Instruments, Honeywell, Hirschmann, Invensys and our Tofino Certified VARs.“ said Joann Byres, CEO of Byres Security. “I also want to recognize our hard working employees without whom this would not be possible. Finally I would like to especially acknowledge Boeing, Exxon-Mobil, Shell and other companies who have adopted and supported our Tofino products”.


The Frost & Sullivan Award for Customer Value Enhancement is presented each year to the company that has demonstrated excellence in implementing strategies that proactively create value for its customers with a focus on improving the return on the investment that customers make in its services or products. This award recognizes the company's inordinate focus on enhancing the value that its customers receive, beyond simply good customer service, leading to improved customer retention and ultimately customer base expansion.

Frost & Sullivan’s Best Practices Awards recognize companies in a variety of regional and global markets for demonstrating outstanding achievement and superior performance in areas such as leadership, technological innovation, customer service, and strategic product development. Industry analysts compare market participants and measure performance through in-depth interviews, analysis, and extensive secondary research in order to identify best practices in the industry.

Honors for the Frost & Sullivan’s World Customer Value Enhancement Award will be presented by the firm as part of its 2010 Excellence in Best Practices Banquet taking place June 8th in Anaheim,(CA US).

Industrial cyber security advances!

-Triconex / Tofino OPC firewall addresses historical security challenges, improves interoperability of critical safety systems-

Invensys Operations Management has teamed with Byres Security Inc. and MTL Instruments to deliver a ground-breaking cyber security solution. The new Triconex® / TofinoTM OPC firewall will harden industrial safety systems against network accidents and attacks. It is the first firewall that protects integrated applications based on OPC Classic, the world's most widely used industrial integration protocol.

To enable greater interoperability of its Triconex safety systems, Invensys pioneered embedding OPC servers within its Tricon™ communications module (TCM). To ensure that these modules were cyber secure, Invensys teamed with Byres Security, which had recently introduced the world's first content inspection firewall for the MODBUS TCP protocol as part of Byres Security's Tofino product line, in order to create a firewall specifically for Triconex systems. The two companies then enlisted the services of MTL Instruments to build the security hardware. The result is the Triconex / Tofino OPC firewall, which is now available for Invensys customers using the Triconex TCM with the embedded OPC solution.

"Processors and manufacturers are continuously threatened by new and increasingly dangerous cyber attacks, which requires greater vigilance and security," said Joe Scalia, portfolio architect, Invensys Operations Management. "The Triconex / Tofino OPC firewall mitigates those risks by managing the traffic to and from the Triconex TCM, providing further assurance that a cyber incursion will not compromise integrated communications between the safety and critical control systems and supervisory HMI or distributed control systems. By tapping into the Invensys Operations Management ecosystem of partners and collaborating with the renowned experts from Byres Security and MTL, we co-innovated to resolve a crucial client challenge and help them achieve safety excellence."

The Triconex / Tofino OPC firewall provides security features developed specifically for Triconex and its embedded OPC Classic server to protect against malicious attacks and other threats to network operations. Users deploy the new firewall in front of the Triconex OPC server, thwarting attacks and traffic storms before they reach the safety and critical control system. It automatically mitigates risks related to previously published DCOM vulnerabilities, while providing packet management and rate limiting to prevent network traffic problems that could have an adverse effect on the stability of the safety system.

For many companies, good network reliability, like that provided by the Triconex / Tofino OPC firewall, is just as important as good security, and with its unique features and capabilities, the Triconex / Tofino OPC firewall can help avoid multi-million dollar accidents and untold environmental damage.

"Past plant shutdowns, for example, haven't been caused by hackers. Instead they were the result of badly configured software causing traffic storms that impacted critical controllers and other systems," said Eric Byres (pic right), security expert and technical officer at Byres Security. "The Triconex / Tofino OPC firewall does much more than block hackers and viruses from accessing the safety system. Its dynamic port management and built-in traffic-rate controls prevent many basic network problems from spreading throughout a plant."

"The next generation of the OPC Foundation interoperability specifications, the OPC Unified Architecture, incorporates similar cyber security protection, based on the excellent work of founding companies like Byres Security, MTL Instruments and Invensys," said Thomas J. Burke, president, OPC Foundation. "Launching the unique Invensys solution is the important milestone in demonstrating that users can secure the interoperability of OPC Classic within other applications without worrying about cyber security. As the use of OPC Unified Architecture expands, we look forward to collaborating with these market leaders to develop additional innovative, readily deployable solutions for the benefit of the entire OPC user community."

"We were pleased to join Invensys in developing a firewall for their industry-leading Triconex safety solutions," Byres said. "Together with MTL, we have delivered a solution that will improve plant safety and security, as well as enable manufacturers to deploy OPC to achieve new levels of interoperability for all of their operations, enabling, for example, tighter integration of safety and asset management systems to share data and help prevent trips."

See also Security beyond Plant Walls (29/7/2009)

More security

New series provides flexible, functional industrial network security

To mark the introduction of a new decade (hopefully not with a bang!) where they hope that industrial network security will be widely adopted, Byres Security are starting off 2010 with the introduction of a new line of Tofino products, the Tofino Argon Product Series.

This is a suite of five rugged Plug-n-Protect™ security appliances with varying connectivity, temperature and power supply capabilities, as well as a selection of firmware modules that customize the functionality of each appliance. The result is a practical and effective cyber security system that is uniquely suitable for protecting industrial facilities with a variety of SCADA, process control and networking systems.

The release of these new products lets companies select the exact mix of security features, fibre/twisted-pair network support and environmental hardening their plants need in a security solution. For example, detailed filtering of Modbus TCP messages over fiber optic cable (by combining the Tofino Argon Modbus Enforcer LSM with the Tofino 220 MM/MM appliance) might be ideal for securing an onsite tank farm, while secure remote maintenance support over a DSL modem would take advantage of the Tofino Argon VPN LSM and the Tofino 220 TX/TX appliance combination.

“The mix and match strategy of the Tofino Argon Product Series is about making control systems simpler and more secure” remarked Eric Byres, a leading global industrial security expert and the Chief Technology Officer of Byres Security Inc. “Complex IT firewalls include convoluted features that you don’t need and don’t use – they are an invitation to configuration errors and ultimately a big security risk. Tofino is designed with the needs of industry in mind, letting you purchase just the features you need to secure your control system.”

The Tofino Argon Product Series is part of the Tofino Industrial Security Solution, which includes Tofino technology that is sold by Belden / Hirschmann, Honeywell and MTL Instruments. All Tofino products are simple to implement and do not require shutdowns to deploy, providing increased safety, network security and performance of control systems.