Remote Access Laptops
You always learn from your students, and today is no exception.
Problem: SCADA Administrators need rare, but emergency, remote access to the trusted SCADA network to solve problems that affect operation. Ideally, the laptop PC they use for this remote access would be dedicated to the SCADA network. It would never be used to access the Internet, access the enterprise, send or receive e-mail, or do anything that could corrupt the security of the system. Unfortunately, SCADA Administrators need to do all those things, often remotely. So you face the choice of carrying two laptops or issuing an exception to your policy.
Student Solution: SCADA Administrators carry one laptop with two hard drives. When the Admin needs to access the trusted SCADA network, he pops in the SCADA drive. When he needs to access anything else, he pops in the other hard drive. So simple, so easy, not much additional weight. Very smart.
Author: Dale Peterson
Posted: March 30th, 2005 under Remote Access.
Comments: 2
Comments
Comment from Anonymous
Time: April 20, 2005, 4:39 am
This may work well, but wherever possible preventing the connection or restricting the connection through the use of filtering and/or customised management consoles is a much better solution.
I have been using 802.1x authentication for switches which are used for laptop or remote connections to further prevent unauthorised access. This coupled with user specific routing, port restrictions, IP, and application filtering provides external contractors access to what they need but greatly reduces the overall risk.
I generally do not use 802.1x on backbone devices, RTU’s, PLC’s, etc. but closely monitoring strategically placed IDS/Syslog/ARP/NetFlow collectors usually identifies the problem support staff and network points.
Traffic profiling is also great (capacity management, network health, fault finding), but I am still reluctant to recommend automated triggers from these systems as they can also be used to disrupt the environment operation. The same can be said with any IDS, etc.
I have found that the key with the prevention, detection and monitoring is to only place these devices/services where they are needed and reduce poling times so as not to disrupt the SCADA network operation.
Thanks
Dwek
Comment from MDA
Time: July 3, 2008, 9:55 am
Would’nt it be just as safe to partition the exisiting laptop harddrive into two and have an separate OS on each?
Write a comment