Discuss the hazards and preventive measures after poisoning in DCS systems

Precautions: Do not connect to public networks, and do not use public storage devices. Harm after poisoning: unpredictable.

Actually, for questions like this, the original poster can search for relevant information on “DCS system management and maintenance protocols” to find satisfactory answers.

I encountered a similar situation before: an operator plugged in an MP3 player at the control station to charge it, and as a result, a **website page kept popping up on the screen, whether there was anything to do or not, which interfered with the operator’s work. Well, that’s about the only harm. Investigate the poisoning incident, identify the personnel on duty at the time, impose fines, and transfer them from their positions. Antivirus, that’s it! A virus infecting a DCS computer is not scary, as such computers do not shut down, and viruses cannot take control of them or delete system files. The scary thing is that the virus causes network congestion; operational signals cannot be sent, and control station signals cannot be received, which leads to delays in operations and consequently quality issues in production. That could result in serious safety accidents. This post was last edited by The wind is gentle on 2009-4-14 16:53]

Common preventive measures include: 1. Locking down the host computer; 2. Replacing the regular keyboard with an operator keyboard; 3. Removing the optical drive and blocking the USB ports

A worm virus infected the operators; it couldn’t be completely eliminated, which led to server restarts. The EXE files were infected, and after antivirus treatment and a restart of the operators, the server’s EXE files were damaged and became unusable. Once, dozens of computers in the entire facility were scanned for viruses at the same time, but the virus still couldn’t be completely removed·~·

1. Strengthen management to ensure that operators are aware of the hazards. One or two machines (that are not control consoles) can be available for operators to use, in order to alleviate the monotony of their work. 2. There are several ways to remove the hardware for sealing, but they should not be overdone. It is not conducive to maintenance work. 3. Strengthen the management of the engineer station. Tasks such as backup require a dedicated camp or USB drive. 4. Install a firewall on the control system. Many control system software programs are incompatible with antivirus software, so installing antivirus software requires guidance from the manufacturer

I myself have objections to this issue; you can refer to the following: The question posed by the original poster is about what to do in case of poisoning, but in reality, a standard DCS system hardly runs any risk of poisoning. Of course, certain conditions must be met: 1. The maintenance and operation staff are professionals who possess basic IT knowledge (and will not connect unsafe devices to the system). 2. It should not be connected to the public internet. 3. All related equipment (computers, drives, etc.) is under strict control

A different view on the opinion above: It’s not that DCS can’t be poisoned, it’s just that the probability is very low. 1. “Maintenance and operation staff are professionals; they certainly have basic IT knowledge (they won’t connect unsafe devices to the system).” This depends on an individual’s integrity – everyone knows that committing crimes results in imprisonment. Yet some people still do it. Operating a system is a monotonous job, especially during night shifts, so it’s possible that they might install some fun apps on the operators’ computers. 2. “Do not connect to the public internet.” But to access the management network, one has to connect to the public internet. There are some viruses that even software and hardware firewalls cannot prevent; otherwise, virus creators would have gone out of business long ago. 3. “All relevant equipment (computers, disks, etc.) is under strict control.” This is a management issue, but mistakes can still occur in management. I’ve seen experts use the operator’s keyboard to switch to a different input method in order to play cards; such experts are everywhere, and it’s difficult to keep them at bay. Hehe, I like to argue; please don’t take it personally, folks upstairs

1. This situation does occur, but DCS engineers can set it so that operators do not have permission to perform operations that are not part of their tasks. 2. I am not in favor of allowing the DCS to connect directly to the management network. The management network can use OPC for data collection, but without the permission to write data or make changes. This is how we did it at CNPC in the past. 3. There should be a system of responsibilities; those who dare to use unsafe media should do so at their own risk. My colleagues and I always use new disks (or disks that have been formatted) when performing maintenance. In fact, this is no longer a matter of capability, but rather of policies and attitudes. Measures in case of contamination: 0. If possible, isolate the affected section of the system and inform the system manufacturer. 1. Back up the entire system. 2. Back up the DCS configuration files. 3. Take protective measures for critical controls. 4. Run antivirus software. 5. If nothing else works, reinstall the system and then import the configuration files

Method: 1 Disable USB ports； 2 Hosts locked ； 3 External systems are prohibited from accessing the DCS system

I have been working in DCS system engineering for nearly 20 years, and I’ve never heard of DCS systems getting ‘infected’! If anything is possible, it is only at the human-machine interface station; however, it will not have any impact on the operation of the DCS system itself. Typically, the operating system of a DCS is a closed system; only its development system needs to be connected to the outside world. Anti-drug measures for this aspect are ensured through management systems and anti-toxin systems!

Due to the frequent use of mobile devices these days, or situations such as downloading and installing drivers when fixing computer problems, it’s easy to fall victim to malware, so everyone should be careful. Measures: 1. Disconnect the infected device from the system and then run antivirus scans; 2. Use devices specifically designed for mobile use; 3. If drivers were downloaded or other networks were connected while fixing a computer problem, be sure to run antivirus scans

From a management perspective, there should be a dedicated person in charge; antivirus software can be installed, and the storage drive must also be dedicated. It also needs to be isolated from the public network.