Operational and business networks – why they should be separated
In many companies, automation has grown up alongside office IT. PLCs, operator panels and SCADA servers are connected to the same network as the PCs, the printers and the guest network. It is practical – until something goes wrong.
Why it is a risk
The office network is where most attacks start: an email with a malicious attachment, an infected USB stick or a weakness in a PC that has not been updated. If the operational network hangs off the same network, what starts on an office PC can spread to the control of the plant.
Control systems are also not designed to be updated as often as an office PC. A PLC or an operator panel can stay in service for many years, and is therefore especially vulnerable if it is visible from the rest of the network.
Operational network and business network
The solution is to separate the two: an operational network (OT) for everything that controls and monitors the plant, and a business network (IT) for office, email and internet. Between them sits a firewall that decides exactly what may pass between the networks – and everything else is blocked.
With segmentation (VLAN) you can go even further and separate cameras, access control and guests into their own zones, so that a problem in one place does not spread.
Without losing access to data
A separation does not mean data has to be locked away. Production data, alarms and reports can still be retrieved to the office, to SCADA and to management – just in a controlled way, through the routes the firewall allows. Remote access for service can be set up securely, so that suppliers get in when they need to, and not otherwise.
Where do you start?
- Map what is connected to what. Many people are surprised by how much hangs on the same network.
- Decide which traffic is actually needed between operations and the office.
- Separate the networks with a firewall and segmentation, and set up controlled remote access.
- Document the solution, so that it stays tidy when the plant changes.
IT and automation from the same place
Because Elio supplies PLC, SCADA and IT and networks, we know both sides of the divide. We know what the automation needs in order to work, and how the business network should be protected – and we can do the job without the finger-pointing that comes with two separate suppliers.
Would you like to know how your network is connected today? Read more about IT and networks or get in touch with us.