Tofino Modbus TCP Enforcer Loadable Security Module certified by Modbus-IDA
Byres Security Inc. and MTL Instruments, a division of Cooper Crouse-Hinds, introduce the Tofino Modbus TCP Enforcer Loadable Security Module (LSM), which performs detailed analysis and filtering of all Modbus TCP messages and is certified by Modbus-IDA. It allows owners of control and SCADA systems to regulate Modbus network traffic to a level of detail that has never before been possible, thereby increasing network security, reliability and performance of critical systems.
“Deep packet” or “content” inspection for Web, e-mail or traffic has been offered in IT firewalls for several years, but nothing has been available for the process control or SCADA world. Modbus traffic could either be allowed or blocked by a standard firewall, but fine-grained control was impossible. Because the smooth flow of Modbus TCP traffic is critical to the average industrial facility, engineers usually opted to let everything pass and take their chances with security. Industry experts have been urgently calling for better control of SCADA protocols.
This spring, a major U.S. government agency warned major energy companies: “A vulnerability has been identified and verified within the firmware upgrade process used in control systems deployed in Critical Infrastructure and Key Resources (CIKR) … development of a mitigation plan is required to protect the installed customer base and the CIKR of the nation. Firmware Vulnerability Mitigation Steps [includes] blocking network firmware upgrades with appropriate firewall rules.”
Two energy companies and a transportation company have tried the Tofino Modbus TCP Enforcer LSM. They have been able to restrict Modbus functions in numerous ways:
- Blocking all firmware upgrades while allowing normal HMI traffic.
- Tailoring appropriate Modbus access permissions to PLCs for different stations, such as read-only for monitoring panels, read/write for HMIs and full programming and diagnostics access for PLC engineering workstations.
- Restricting Modbus access permissions to specific memory locations in a controller.
- Providing enhanced security and protection for any Modbus TCP device, including filtering of invalid traffic that could cause denial of service or system failures.
- Enforcing read-only access to Safety Instrumented Systems for enhanced isolation and safety.