Loading...
Publication
CIBERSEGURANÇA EM REDES DE AUTOMAÇÃO INDUSTRIAL
| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 6.67 MB | Adobe PDF |
Authors
Advisor(s)
Abstract(s)
Os Sistemas de Controlo Industrial são uma vasta gama de sistemas que monitorizam
e medem parâmetros, controlam e automatizam processos na maior parte
das indústrias e setores. Muitos destes sistemas foram projetados numa época em
que as ameaças à cibersegurança eram inexistentes, porque a única forma de atacar
um sistema destes era fazê-lo com acesso físico aos equipamentos. Desde a algumas
décadas as industrias de média e grande dimensão começam a sentir necessidade de
renovar e/ou automatizar processos, quer pelo aumento de produtividade inerente
quer pela redução de custos a médio prazo. Com o desenvolvimento exponencial
da tecnologia e a sua facilidade de implementação a um custo apetecível, a automatização
industrial chegou a todos os ramos da industria de forma acelerada. A
implementação de tecnologias de automação que permitem não só o desenvolvimento
de redes de tecnologia operacional (TO) mas também a sua integração com redes de
tecnologias de informação(TI) e a disponibilização de todo o tipo de informação referente
aos processos e equipamentos à escala global, trazem-nos desaĄos signiĄcativos
em termos de cibersegurança. Atualmente e em grande parte das empresas as redes
de automação industrial estão interligadas com as redes de TI e com a Internet.
Esta estrutura deriva do crescimento desordenado por necessidade e em que a
implementação é feita por pessoal com conhecimento técnico inadequado, resultando
em sistemas inseguros e cujo comprometimento pode paralisar as linhas de produção
e/ou resultar em danos irreversiveis nos equipamentos. As redes de automação
industrial são implementadas do ponto de vista da produtividade e simplicidade de
operação para os utilizadores. A complementaridade e integração com as redes de
TI são efetuadas sob a permissa do funcionamento facilitado em organizações sem
departamentos de TI. A implementação inicial tem que ser projetada com uma base
de segurança que tem de suportar as operações, a recolha, disponibilização e análise
de dados. Este projeto tem como objetivo o desenvolvimento de uma solução de
segurança em redes de automação industrial de baixo custo, que permita a qualquer
empresa independentemente da sua capacidade Ąnanceira implementar uma solução
que proteja os seus ativos e processos de negócio e que garanta a conĄdencialidade,
integridade e disponibilidade dos sistemas. Ao longo do projeto vão ser exploradas as
vulnerabilidades dos equipamentos e da arquitetura da solução, essa visão permitirá
aplicar as correções e melhorias necessárias, o que nos levará a uma solução de implementação segura.
Como resultados deste projeto chegámos a uma arquitetura de segurança para
ambientes de automação industrial que pode ser aplicada não só ao caso de uso
concreto abordado no projeto mas também aplicável à generalidade das soluções
de automação desenvolvidas pela empresa. A utilização de novas ferramentas de
identiĄcação e monitorização bem como de soluções de monitorização continua é
essecial para a proteção dos sistemas. A sensibilização em cibersegurança de todos os
recursos humanos com interveniência nos processos é fundamental para a garantia de
uma primeira e muito importante linha de proteção. O valor acrescentado entregue
a cada projeto é uma mais valia para o cliente e uma garantia de qualidade do
trabalho da organização que se traduzirá num elevar do nível de conĄança por parte
de clientes e por sua vez dos clientes dos clientes.
Industrial Control Systems are a wide range of systems that monitorize and measure parameters, control and automate processes in most industries and sectors. Many of these systems were designed at a time when cybersecurity threats were non-existent, because the only way to attack such a system was to do so with physical access to the equipment. For a few decades, medium and large industries have began to feel the need to renew and/or automate processes, either to increase inherent productivity or to reduce costs in the medium term. With the exponential development of technology, and its ease of implementation at an attractive cost, industrial automation has reached all branches of industry quickly. The implementation of automation technologies that allow, not only, the development of operational technology (OT) networks, but also, their integration with information technology (IT) networks and the provision of all types of information regarding processes and equipment on a global scale, brings us signiĄcant challenges in terms of cybersecurity. Currently, in most companies, industrial automation networks are interconnected with IT networks and the Internet. This structure derives from disorderly growth, due to necessity and in which implementation is carried out by personnel with inadequate technical knowledge, resulting in unsafe systems and whose compromise can paralyze production lines and/or result in irreversible damage to the equipment. Industrial automation networks are implemented from the point of view of productivity and simplicity of operation for users. Complementarity and integration with IT networks are carried out, under the assent of facilited operation in organizations without IT departments. The initial implementation must be designed with a security foundation that must support operations, collection, provision and analysis of data. This project aims to develop a low-cost security solution for industrial automation networks, which allows any company, regardless of its Ąnancial capacity, to implement a solution that protects its assets and business processes and that guarantees conĄdentiality, integrity and systems availability. Throughout the project, vulnerabilities in the equipment and solution architecture will be explored, this vision will allow the necessary corrections and improvements to be applied, which will lead us to a secure implementation solution. As a result of this project, we arrived at a security architecture for industrial automation environments that can be applied not only to the concrete use case addressed in the project but also applicable to the majority of automation solutions developed by the company. The use of new identiĄcation and monitoring tools as well, as continuous monitoring solutions is essential for protecting the systems. Cybersecurity awareness among all human resources involved in the processes is essential to guarantee a Ąrst and very important line of protection. The added value delivered to each project is an added value for the client and a guarantee of the quality of the organizationŠs work, which will translate into an increase in the level of trust on the part of clients and, in turn, the clientsŠ clients.
Industrial Control Systems are a wide range of systems that monitorize and measure parameters, control and automate processes in most industries and sectors. Many of these systems were designed at a time when cybersecurity threats were non-existent, because the only way to attack such a system was to do so with physical access to the equipment. For a few decades, medium and large industries have began to feel the need to renew and/or automate processes, either to increase inherent productivity or to reduce costs in the medium term. With the exponential development of technology, and its ease of implementation at an attractive cost, industrial automation has reached all branches of industry quickly. The implementation of automation technologies that allow, not only, the development of operational technology (OT) networks, but also, their integration with information technology (IT) networks and the provision of all types of information regarding processes and equipment on a global scale, brings us signiĄcant challenges in terms of cybersecurity. Currently, in most companies, industrial automation networks are interconnected with IT networks and the Internet. This structure derives from disorderly growth, due to necessity and in which implementation is carried out by personnel with inadequate technical knowledge, resulting in unsafe systems and whose compromise can paralyze production lines and/or result in irreversible damage to the equipment. Industrial automation networks are implemented from the point of view of productivity and simplicity of operation for users. Complementarity and integration with IT networks are carried out, under the assent of facilited operation in organizations without IT departments. The initial implementation must be designed with a security foundation that must support operations, collection, provision and analysis of data. This project aims to develop a low-cost security solution for industrial automation networks, which allows any company, regardless of its Ąnancial capacity, to implement a solution that protects its assets and business processes and that guarantees conĄdentiality, integrity and systems availability. Throughout the project, vulnerabilities in the equipment and solution architecture will be explored, this vision will allow the necessary corrections and improvements to be applied, which will lead us to a secure implementation solution. As a result of this project, we arrived at a security architecture for industrial automation environments that can be applied not only to the concrete use case addressed in the project but also applicable to the majority of automation solutions developed by the company. The use of new identiĄcation and monitoring tools as well, as continuous monitoring solutions is essential for protecting the systems. Cybersecurity awareness among all human resources involved in the processes is essential to guarantee a Ąrst and very important line of protection. The added value delivered to each project is an added value for the client and a guarantee of the quality of the organizationŠs work, which will translate into an increase in the level of trust on the part of clients and, in turn, the clientsŠ clients.
Description
Keywords
Cibersegurança Informática Forense Automação industrial Sistemas de controlo industrial Empresas