Managing Cybersecurity Risk In Smart Valve & Pumping Technology

Key points

Listen to this article

For decades, pumps and valves have been the main stay of many industrial processes, be it moving and controlling fluids, gasses or slurry. Technology may have advanced, but the core function of this basic but critical hardware has remained the same.

Recently we have seen “smart” technology and the Internet of Things (IoT) permeate pumping systems with pumps that can be connected to smartphones and valves controlled remotely using mobile phone networks to provide continuous positional feedback.

Failure or poor performance of these often critical components can disrupt or degrade plants impacting production schedules and outputs. In some cases, safety critical systems will rely on valves closing or opening in a safe failure mode within a pre-determined time. Pumping systems can provide crucial cooling or firefighting services, the failure of which can lead to catastrophic loss.

Performance of such safety critical systems would normally be addressed from a functional safety point of view as part of a HAZOP study or a functional or safety case assessment during the planning and design phases of plants or systems.

But as more and more of these systems rely on “smart” computerised control (via industrial control systems), they are impacted by cybersecurity threats that could undermine the safety and reliability of these control systems, pumps and valves.

Such cyber-attacks could cause physical damage due to rapid device cycling or degradation in system performance. In extreme cases, safety critical systems could be undermined causing harm to people and environmental damage that may in turn result in regulatory fines or prosecutions.

Are your smart pumps and valves may at risk?

At a first glance, smart pumps and valves may not appear to be at risk, but by virtue of their use they are often difficult to secure. Securing a pump that is physically remote and may utilise a mobile network (GSM, 3G or 4G) or VHF link to connect to a corporate industrial network can be a challenge.

The simple act of blocking this radio connection could disrupt a process. Physical access to insecure USB ports on control systems or access to engineering control workstations via a remote, hacked connection can be enough to switch off or compromise a plant.

Smart valve or pump technology could be used as a pivot point during a larger-scale attack, where a poorly secured smart pump could act as an entry point into other systems more interesting to an attacker.

With these valves and pumps being placed on the edge of networks (often physically isolated) and often not going through the same, rigorous security tests as traditional enterprise systems, it is possible to use them as the gateway or foothold into the network.

By compromising a potentially insecure, unmonitored edge computer device, like a smart valve or pump, attackers could gain access to systems and data that they otherwise would not have had access to.

If these devices are connected to a network, whether via mobile router, wireless or wired local area network (LAN) that, in turn, connects to a larger network, they become likely targets within the organisation for the initial attack.

What hackers could do

Hackers are already taking an interest in pumping technology and how this could be subverted. In one case, a researcher demonstrated that it was possible to by partially closing a valve, thus inducing cavitation and systemic vibration. Such a degraded system performance would likely cause physical damage if left unresolved.

Another infamous example is the Stuxnet attack on Iranian nuclear facilities, which was made public in 2010 and included an attack on motor control systems in the uranium centrifuge.

Pneumatic control valve in a steam heating system

So, how should these smart valve and pump control systems be secured?

Equipment manufacturers should include cybersecurity risk management as part of their product design and manufacturing processes. Remote monitoring (for, example, predictive maintenance) needs to be undertaken in a way so that cybersecurity risk isn’t increased.

Operators should undertake a business led cybersecurity risk assessment of their plant and operational systems. There are a number of accepted methods and frameworks, but consider the National Institute for Standards and Technology (NIST) cybersecurity framework or the IEC 62443 set of standards as a good starting point.

Plant operators should look at how smart pumping systems and valves can be monitored on a regular basis for cybersecurity issues. Non-invasive monitoring of industrial networks is now a possibility and there are a number of solutions available in support of this.

Educate staff to understand cybersecurity risk and have in place a well-rehearsed cybersecurity incident response and recovery plan. In this way, when an event or incident occurs you can manage it quickly and effectively.

Work with experienced cybersecurity experts that understand the world of industrial processing and can help take you on a journey through your cybersecurity risk.

The good news is that by taking some basic cybersecurity measures a lot of the risk to smart valve and pumping systems can be addressed, allowing more time to focus on other aspects of running a profitable business.