Virus protection issues in control systems
Thread Content
The recently much-talked-about Stuxnet virus has made me think about antivirus measures for industrial control systems. Let’s discuss how you guys prevent viruses and control the use of removable storage devices on system hosts.
The SuperFactory virus, also known as the Stuxnet worm, was the world’s first destructive virus designed to target industrial control systems; it was able to take advantage of various vulnerabilities in both Windows systems and Siemens SIMATIC WinCC systems to carry out attacks. This virus spreads mainly through removable media and local area networks. The network of a conventional control system is not connected to the external Internet or the factory LAN. If there is a connection, a hard firewall should be installed; such a firewall can filter out data packets that do not conform to the format specified by the control system. Finally, simply avoid inserting used removable media into the host computer
The console is locked, preventing the use of USB
This is a long-term topic that we all need to consider. . . . .
Here, we remove the optical drive, disable the USB ports, lock the switch, lock the operator station chassis, and set system permissions.
The method we use is to employ an FTP server; data is copied using an FTP client, which prevents any interaction with the internal control network
This is indeed a concern for everyone. Could you explain it in more detail? Are there any materials I can refer to?
1. Try to plug in as few external devices such as USB drives as possible to these computer devices. 2. Do not use the public internet when operating these computer devices. 3. Regularly delete unnecessary files generated by the control software. 4. Perform regular antivirus scans on the computers. 5. Apply locks and passwords to manage these devices, and assign dedicated personnel to their maintenance. 6. When installing program servers on the controllers, isolate the download process
This is indeed an issue that requires attention; management measures should be strengthened and USB ports should be disabled. Some DCS manufacturers offer certified antivirus software, which requires payment to acquire
1. Firewall 2. Establishing a comprehensive antivirus system 3. Backup/recovery and disaster recovery systems 4. Network isolation: Isolation at the network boundaries between the control system and the MIS, achieved through dedicated application servers and serial ports (USB). 5. Strengthen peripheral device management.