Process control methods and apparatus for intrusion detection, protection and network hardening

A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the digital data network comprising:

• (a) network media that supports communications between digital data devices,
• (b) an intrusion system that is coupled to the network media,
• (c) the intrusion system blocking traffic on the network media matching one or more signatures specific to a control network (“control signatures”),
• wherein one or more of the control signatures are indicative of traffic that would change, to an out-of range value, a setpoint for one or more control devices in communications coupling with the network media, and wherein the intrusion system blocks traffic matching those one or more control signatures.

A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the digital data network comprising:

• (a) network media that supports digital data communications,
• (b) an intrusion system that is coupled to the network media and that monitors traffic thereon utilizing signature-based detection in order to identify traffic that is potentially adverse to the control system control or devices therefor in communications coupling with the network media,
• (c) the intrusion system utilizing one or more signatures specific to a control network (“control signatures”) and blocking traffic on the network media matching at least a selected control signature,
• (d) wherein the control signatures are indicative of the following:
• traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media;
• an attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;
• an attempt to login with any of a standard user name and standard password, via any of an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;
• an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;
• traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;
• traffic other than from MAC addresses within a selected range;
• an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of
• a password “gnomes”;
• a username “fox” and a password “gnomes”;
• an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of
• a username “hstorian”, wherein that username is a misspelled formative of “historian”;
• a username “Administrator” with password “password”;
• a username “bpm”;
• a username “pam”;
• an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and wherein the intrusion system blocks traffic matching at least the selected control signature.

A method of operating a digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the method comprising:

• (a) transmitting digital data traffic on digital data network,
• (b) monitoring that traffic with an intrusion system that is coupled to the network,
• (c) blocking, with the intrusion system, traffic on the network media matching one or more control signatures specific to a control network (“control signatures”),
• wherein one or of the control signatures are indicative of traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media, and wherein the blocking step includes blocking traffic matching those one or more control signatures.

A digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the digital data network comprising:

• (a) network media that is coupled to control devices to support digital data communications therewith,
• (b) an intrusion system that monitors traffic on the network media utilizing signature-based detection in order to identify traffic that is potentially adverse to the control devices or control system,
• (c) the intrusion system utilizing one or more signatures specific to a control network (“control signatures”) and blocking traffic on the network media matching at least a selected control signature,
• (d) wherein the control signatures are indicative of the following:
• traffic that would change, to an out-of-range value, a setpoint for one or more control devices in communications coupling with the network media;
• an
• attempted root login with an incorrect password, via a telnet protocol, to a digital data device in communications coupling with the network media;
• an attempt to login with any of a standard user name and standard password, via any of
• an FTP and a telnet protocol, to a digital data device in communications coupling with the network media;
• an attempt to login, via execution of a remote executive (rexec) command, to a digital data device in communications coupling with the network media;
• traffic originating from any of an unknown media access control (MAC) address and unknown internet protocol (IP) address;
• traffic other than from MAC addresses within a selected range;
• an attempt to login, via a telnet protocol, to a digital data device forming part of an I/A Series control system with any of
• a password “gnomes”;
• a username “fox” and a password “gnomes”;
• an attempt to login, via a telnet protocol, to a digital data processor in communications coupling with the network media with any of
• a username “hstorian”, wherein that username is a misspelled formative of “historian”;
• a username “Administrator” with password “password”;
• a username “bpm”;
• a username “pam”;
• an attempt to access, via any of an ftp and tftp protocol, a password file on a digital data device in communications coupling with the network media, and
• wherein the blocking step includes blocking traffic matching at least the selected control signature.

A method of hardening a digital data network for use with any of a process control system, a computer-based manufacturing/production control system, an environmental control system, and/or an industrial control system (collectively, “control systems”), the method comprising:

• (a) selectively deactivating any of an operating system service and other service on one or more digital data processors on the digital data network;
• (b) backing up the one or more digital data processors to preserve at least current system status;
• (c) testing, following deactivation, to determine whether such deactivation affects normal and/or expected operation of any of the control system, the digital data network and the one or more digital data processors;
• (d) responding to testing revealing that the deactivation resulted in any of abnormal and unexpected operation by re-activating the deactivated service, and repeating steps (a)-(c) with other services;
• (e) following deactivation of services believed non-essential to said normal and/or expected operation, testing any of said digital data network and said one or more digital data processors for any of hacking, intrusion and mischievous action (collectively, “penetration”);
• (f) responding to testing revealing that such penetration occurs by repeating steps (a)-(d) with additional services.