Fahimtar Wurin da Za a Iya Kai Hari a Sabbin PLC da DCS
Masu kula da manhajar sarrafa injina (programmable logic controllers) da tsarin sarrafa rababbe (distributed control systems) su ne jijiyoyin tsarin sarrafa masana’antu ta atomatik. Saboda suna bambanta da uwar garken IT na kamfanoni, waɗannan na’urori suna fifita daidaitaccen lokaci da samuwa koyaushe fiye da siffofin tsaro. Sakamakon haka, yawancin masu kula da injina ba su da kariyoyi na asali kamar sadarwa da aka ɓoye, duba sahihancin bayanai, ko ikon sarrafa izini bisa rawa (role‑based access control). Idan aka haɗa hanyoyin sadarwar samarwa da IT na kamfani ko dandamalin girgije (cloud), fadin wurin da za a iya kai hari yana ƙaruwa ƙwarai. Koda tashar Ethernet guda ɗaya da ba ta da kariya a kan PLC na iya fallasa dukan layin samarwa ga kutse daga nesa.
Bincike Mai Zurfi: Raunanan Ladabi na Sadarwa da Injiniyoyi Dole Su Sani
An ƙera ladabobin masana’antu ne shekaru da dama da suka wuce don sauƙi da sauri. Tsaro ba shi ne manufar ƙira ba. Fahimtar waɗannan raunanan fasaha yana taimaka wa injiniyoyi su zaɓi hanyoyin kariya na maye gurbi da suka dace.
Modbus TCP: Babu Gane Mai Amfani (Authentication), Babu ɓoyewa (Encryption)
Modbus TCP yana amfani da lambobin aiki 01‑06 don ayyukan karantawa da rubutawa. Kowace na’ura da za ta iya kaiwa tashar jiragen ruwa 502 na iya aika umarnin rubutu iri‑iri yadda ta ga dama. Babu tsarin zaman zama (session), babu shaidar mai amfani, kuma babu duba sahihancin saƙo. Mai hari da ya sami damar shiga hanyar sadarwa na iya kashe mota, buɗe bawul, ko canza “setpoint” ba tare da barin bayanan shaidar shiga (authentication logs) ba. Kariya kawai ita ce killace cibiyar sadarwa a matakin “network‑layer” ko amfani da ƙofofin aikace‑aikace (application‑layer gateways) da ke tace lambobin aiki.
Profinet da EtherNet/IP: Masu Rauni ga Hare‑haren Saka Bayanai (Injection Attacks)
Waɗannan ladabobin sadarwa na ainihin‑lokaci suna dogaro ne da musayar bayanai na zagayawa. Ba sa tantance sahihancin asalin bayanan IO. Na’ura mai cutarwa da ta yi kamar ita ce mai kula da IO na iya saka bayanan na’urori masu auna sigina na ƙarya. Haka kuma, mai hari na iya kwaikwayon saƙon tsaro (“safety telegram”) ya haifar da gaggawar tsayawa. Idan babu rabuwar cibiyar sadarwa ko binciken fakiti mai zurfi, irin waɗannan hare‑haren ba a gano su.
OPC Classic: Yana Dogaro da Gibin Tsaron DCOM
Yawancin tsofaffin tsarin DCS suna amfani da OPC DA (Data Access) wanda ke dogaro da Microsoft DCOM. DCOM na da dogon tarihin raunanan tsaro na “remote code execution”. Bugu da ƙari, OPC Classic baya tallafa wa ɓoye saƙonni (encryption) a zahiri. Mai hari da ya sami damar kutse cikin uwar garken OPC zai iya karanta ko rubuta kowane “process tag”. Matsa zuwa OPC UA tare da tsaro a kunne shi ne hanya mafi dacewa.
Jagorar Ƙarfafa Tsaro na Fasaha: Mataki‑zuwa‑Mataki ga Injiniyoyin Filin
Matakan da ke ƙasa suna ɗauka cewa kana da damar kai tsaye ta jiki ko kuma ta nesa cikin tsaro zuwa ga mai kula (controller). Ka tabbata kana yin waɗannan canje-canjen ne a lokacin da aka tsara na aikin gyara kuma ka tabbatar da aikin na’urar bayan ka gama.
Mataki na 1: Yi Binciken Tsaron Farko (Security Baseline Audit)
Haɗa da kowane PLC ta amfani da manhajar injiniya. Rubuta waɗannan bayanan: sigar firmware, yarjejeniyoyin da aka kunna (HTTP, FTP, SNMP, Telnet), buɗaɗɗun tashoshin TCP/UDP, asusun masu amfani da aka saita, da ranar da aka ƙarshe a canja kalmar sirri. Yi amfani da takardar lissafi (spreadsheet) don bin diddigin abubuwan da suka kauce daga ƙa'idar tsaron ka. Ga masu kula na Siemens S7, duba matakin izinin shiga da aka saita a cikin kaddarorin kayan aiki (hardware properties). Ga masu kula na Rockwell, duba saitunan kariyar controller a cikin Studio 5000.
Mataki na 2: Ƙarfafa Saitin Mai Kula (Controller Configuration Hardening)
Kashe dukkan tsarukan yarjejeniya (protocol stacks) da ba a amfani da su. A kan yawancin PLC, kashe uwar garken yanar gizo (web server), FTP, SNMP, da duk wata tashar kiyayewa ta mallakar kamfani. Ga tashoshin Ethernet, kashe daidaitawar kai tsaye na sabis da ba a amfani da su. Canja tsohon adireshin rack/slot idan yarjejeniyar na ba da damar kirgawa (enumeration). A kan Rockwell Logix controllers, saita tashoshi da ba a amfani da su zuwa yanayin "Disable" sannan ka kunna "System Protection" tare da maɓalli na musamman.
Mataki na 3: Aiwatar da Ƙa'idojin Izin Shiga Masu Ƙarfi
Ƙirƙiri asusun mai amfani dabam-dabam ga kowane injiniya. Guji amfani da asusun tsoho na "admin" ko "engineer". Ga tsarin da ke goyon bayan izini bisa rawa (role-based access), ayyana aƙalla rawuna uku: mai aiki (operator – karantawa kawai), mai fasaha (technician – karantawa da umarnin hannu), da injiniya (engineer – cikakken izinin shirin). Saita ƙa'idojin rikitarwar kalmar sirri: aƙalla haruffa 12, manyan haruffa, ƙananan haruffa, lambobi, da alamomi. Canja kalmomin sirri na kamfani (factory defaults) kafin a haɗa PLC ɗin da kowace hanyar sadarwa.
Mataki na 4: Aiwatar da Kariya a Matakin Hanyar Sadarwa (Network-Level Protections)
Sanya kowane PLC a bayan firewall na masana'antu da ke binciken abun ciki na yarjejeniya (protocol content). Ƙirƙiri ƙa'idojin firewall da za su ba da izini ne kawai ga takamaiman adireshin IP na tushen zirga-zirga kowane iri. Misali, ba da izinin zirga-zirga daga HMI zuwa PLC a kan tashar yarjejeniya 44818 (EtherNet/IP) amma ka toshe zirga-zirgar manhajar shirye-shirye (programming software) (tasha 2222) sai daga ɗaya tak ma'aikatar injiniya ta musamman. Yi amfani da VLANs don ware PLCs na tsaro daga PLCs na daidaitaccen sarrafawa. Aiwatar da tantancewar tashar 802.1X a kan tashoshin switch don hana haɗa na'urar ba ta izini.
Mataki na 5: Kafa Tsarin Sabunta Firmware Mai Tsaro
Kada ka taɓa sabunta firmware kai tsaye daga gidan yanar gizon mai ƙera ta hanyar intanet. Sauke fayil ɗin firmware binary a kan kwamfuta amintacciya wadda ba ta kan layi (offline). Tabbatar da sahihancin sa hannun dijital na fayil ɗin. Gwada sabuntawar a kan mai kula (controller) makamancin ɗaya a cikin muhallin dakin gwaje-gwaje na aƙalla awanni 40 na aikin kwaikwayo. Rubuta tsari na koma-baya (rollback procedure) idan sabuntawar ta gaza. Aiwatar da sabuntawa ne kawai a lokacin da aka tsara dakatar da aiki, kada a yi a cikin tsari da ke gudana.
Mataki na 6: Saita Yin Rajista (Logging) da Gargadi
Kunna tura syslog idan PLC ɗin na goyon bayansa. Ga masu kula da ba su da rubuta bayanai (logging) na asali, yi amfani da network tap don sa ido kan zirga-zirgar hanyar sadarwa kuma ka samar da gargaɗi ga abubuwan da aka ƙayyade: sauke shirin (program download), sauya yanayi daga run zuwa program, tilasta IO (forced IO), ko yawan ƙoƙarin shiga da suka gaza. Tura log zuwa cibiyar SIEM ta tsaro na OT tare da ƙa'idodin alaƙa na musamman ga OT. Saita matakan tsanani na gargaɗi ta yadda canji a shirin da aka yi a wajen lokutan aiki zai haifar da bincike nan da nan.
Jagorar Fasaha Mai Zurfi: Hanyoyin Shirye-shiryen PLC Masu Tsaro
Tsaro ya kamata ya shiga cikin lissafi kansa. Waɗannan dabarun shirye‑shiryen suna ƙara kariya mai zurfi (defense-in-depth) a cikin na’urar sarrafawa.
- Aiwasar da tantance checksum: A ƙididdige cyclic redundancy check na manyan ɓangarorin lissafi masu muhimmanci a lokacin farawa. A adana ƙimar da aka tabbatar tana da kyau a cikin retentive memory. Idan checksum ya bambanta, a kunna yanayin tsaro (safe state) kuma a faɗakar da masu sarrafawa.
- Yi amfani da agogon lura (watchdog timers) don rashin sadarwa: Ga kowace sadarwa ta IO na nesa ko HMI, a saita agogon watchdog. Idan saƙon madauwari da ake tsammani bai iso cikin lokacin da aka kayyade ba, a mayar da fitarwa zuwa matsayi na tsaro da aka riga aka ayyana. Wannan yana hana tsohon bayanai ko ƙirƙira (spoofed data) haifar da motsi mai haɗari.
- Duba dukkan bayanan da HMI ke turo wa cikin PLC: Kada a taɓa yarda cewa HMI na aika ƙimomi masu inganci. A cikin lissafin PLC, a bincika cewa saitunan analog (analog setpoints) suna cikin iyakar mafi ƙaranci da mafi girma masu aminci. Don umarni na rarrabe (discrete commands), a tabbatar cewa tsarin jere (sequence) ya dace. A ƙi duk wani umarni da ya wuce ƙima ko ya fita daga tsarin jere.
- Raba lissafin tsaro daga lissafin al’ada: Yi amfani da PLC na tsaro na musamman ko IO da aka tantance don tsaro (safety-rated IO) don gaggawar tsayawa da ayyukan kariya. Ya kamata PLC na al’ada ba su sami damar rubuta (write access) zuwa fitarwar tsaro (safety outputs). Wannan rarrabuwar na tabbatar da cewa ko da an lalata PLC na al’ada gaba ɗaya, ba zai iya kauce wa ayyukan tsaro ba.
Lamari na Fasaha na Gaskiya: Watan Kera Motoci Ya Tsare PLC 320
Wani babban wurin kera injin motoci (automotive powertrain facility) da ke da PLC 320 (Siemens S7-1200 da S7-1500) ya fuskanci maimaitattun ƙoƙarin samun dama ba tare da izini ba daga kwamfutocin kwangila (contractor laptops) da aka lalata da malware. Ƙungiyar injiniyoyin shuka ta aiwatar da shirin tsaro mai tsari tare da waɗannan matakan fasaha.
- An yi ƙididdigar kayan aiki (inventory) aka gano PLC 47 da har yanzu ke amfani da tsofaffin kalmomin sirri na default.
- An canza duk tsofaffin bayanan shiga (default credentials) kuma an saita tsufar kalmar sirri (password aging) zuwa kwanaki 90.
- An kashe web server da FTP a kan dukkan controllers ta hanyar TIA Portal batch operation.
- An aiwatar da rarraba (segmentation) na cibiyar sadarwa: an raba yankunan OT guda biyar ta firewall ɗin Siemens Scalance.
- An ƙirƙiri ƙa’idojin firewall masu tsauri: a ba da izini ga zirga‑zirgar Profinet IO kaɗai (ports 34962-34964) tsakanin PLC da nesa IO; a ba da izini ga sadarwar S7 kaɗai (port 102) daga takamaiman HMI da SCADA; a toshe duk sauran zirga‑zirga.
- An sabunta firmware a kan duk PLC 320 daga sigar 2.6 zuwa 3.0 bayan gwajin dakin gwaje‑gwaje.
- An kunna fowadin syslog zuwa cibiyar SIEM tare da faɗakarwa (alerts) ga abubuwan sauke shirye‑shirye (program download events).
Sakamakon aunawa bayan kwana 90: Yawan ƙoƙarin shiga ba tare da izini ba ya ragu daga 487 zuwa 39 a wata (raguwa 92%). Lokutan tsaikon samarwa da hare-haren yanar gizo (cyber) ke haifarwa sun ragu daga lamura 6 zuwa 0. Lokacin gano sauke shirye‑shirye masu ban mamaki ya ragu daga awanni 14 zuwa mintuna 12. Jimillar kuɗin aikin ya kasance $180,000, wanda ya hana yiwuwar harin ransomware da zai iya jawo asarar kimanin $4.2 miliyan a kowane makon da ake tsaida aikin.
Lamari na Fasaha: Wurin Tsabtace Ruwa Ya Rage Harin Modbus Injection
Wani cibiyar kula da ruwan sha ta birni tana sarrafa PLCs 85 ta amfani da Modbus TCP a kan hanyar sadarwa madaidaiciya (flat network). Ma’aikata sun lura da motsawar bawul da kunna famfo lokaci-lokaci ba tare da umarni daga HMI ba. Bincike ya gano wata na’ura da ba a yarda da ita ba a kan hanyar sadarwa tana saka Function Code 05 (rubuta coil guda ɗaya) da Function Code 16 (rubuta rajista da yawa).
Ƙungiyar injiniyoyi ta aiwatar da waɗannan matakan kariya na fasaha:
- An shigar da firewall na masana’antu (Tofino) a yanayin transparent tsakanin babban switch da subnet na PLC.
- An ƙirƙiri jerin fari (whitelist) na mu’amalar Modbus da aka yarda da su: buƙatun karatu kawai (Function Codes 01,02,03,04) daga adiresoshin IP na HMI da SCADA.
- An ba da damar buƙatun rubutu (Function Codes 05,06,15,16) ne kawai daga adireshin IP na ɗaya tilo na na’urar aikin injiniya, kuma kawai a cikin lokutan gyara da aka ƙayyade ta amfani da time-based ACL.
- An kunna duban kunshin bayanai (deep packet inspection) don tabbatar da cewa adiresoshin rajista sun tsaya cikin iyakokin da aka saita.
Sakamako: A cikin watan farko, firewall ta hana ayyukan Modbus function codes na kwaɗayi 1,200. Umarnin rubutu da ba a yarda da su ba zuwa PLCs na famfo masu mahimmanci sun tsaya gaba ɗaya. Ma’aikata suka sake samun cikakken tabbaci kan sahihancin ikon sarrafawa. Maganin ya kashe $25,000, ya kauce wa yiwuwar tara ta muhalli da katsewar sabis.
Jagorar Injiniya Kan Tsarin Tsaro na Samun Dama Daga Nesa
Tallafin nesa ga PLCs abu ne da ake bukata don aiki amma yana da haɗarin fasaha. Bi wannan tsarin saitin daidai.
- Ɗora na’urar OT VPN concentrator ta musamman: Yi amfani da na’urar firewall da ke goyon bayan IPsec ko OpenVPN. Sanya ta a DMZ tsakanin IT da OT. Kada a yi amfani da VPN na kamfanin IT don samun damar OT.
- Saita MFA ga kowane mai amfani: Tilasta amfani da ko dai takardar shaida (certificate) ko na’urar token na ƙarfe tare da kalmar sirri. Haɗa shi da kundin adireshin LDAP na musamman na OT.
- Aiwatar da ƙuntatawa bisa lokaci da tushen haɗi: Ba da damar samun damar nesa ne kawai a lokutan da aka amince da su a gaba da kuma daga takamaiman adireshin IP na jama’a na ofishin mai kaya.
- Yi amfani da jump host tare da rikodin zama: Tilasta masu amfani na nesa su fara haɗawa da kwamfutar Windows da aka kulle sosai a cikin yankin OT. Duk kayan aikin shirye-shiryen PLC su kasance suna gudana ne kawai a kan wannan jump host ɗin. A yi rikodin cikakken bidiyo da log na maɓallan da aka danna.
- Tilasta bayanan shiga na lokaci ɗaya kawai: Ƙirƙiri kalmomin sirri na VPN na musamman ga kowane zama. Soke su ta atomatik bayan sa’o’i 8. Juya (rotating) bayanan shiga na admin na gida a kan jump host bayan kowane ziyarar mai kaya (vendor).
Binciken Matsalolin da Aka Fi Cinsa a Aiwatar da Tsaron PLC
Masu injiniya sau da yawa suna fuskantar matsaloli na musamman yayin aiwatar da matakan tsaro. Ga wasu hanyoyin fasaha na magance su.
-
Matsala: Bayan canza kalmar sirri ta tsoho, kayan aikin injiniya ba zai iya shiga kan layi ba.
Magani: Share bayanan shiga da aka adana a rajistar na’urar aikin injiniya ko mai sarrafa bayanan shaidar shiga (credential manager). Wasu dandamali (misali Rockwell) suna bukatar a kashe kuma a kunna wutar PLC domin sabon kalmar sirri ya fara aiki a duk zaman amfani. -
Matsala: Firewall yana toshe sahihin zirga-zirgar IO bayan an raba cibiyar sadarwa.
Magani: Yi amfani da “port mirroring” don kama zirga-zirgar bayanai yayin gudanawar samarwa. Nazari ɗaukar fakitocin (packet capture) don gano dukkan nau’ikan asali/manufa (source/destination) da tashoshin yarukan sadarwa (protocol ports) da ake buƙata. Ƙirƙiri dokokin izini bisa irin zirga-zirgar da aka gani, sannan ka koma yanayin toshewa. -
Matsala: Sabunta firmware ta gaza kuma PLC ta shiga yanayin tsayawa (stop mode).
Magani: Kafin kowace sabunta firmware, tabbatar cewa sabon sigar firmware ɗin tana tallafawa irin wannan sigar kayan aikin jiki ɗaya kacal. Yi amfani da kayan farfaɗo na mai ƙera (misali, Siemens SIMATIC Field PG) don komawa sigar firmware ta baya. Ka tabbata ka riƙa da madadin asalin fayil ɗin firmware a kan na’urar USB da ba ta haɗe da cibiyar sadarwa ba.
Tambayoyi da aka fi yawan yi daga injiniyoyin filin aiki
Ta yaya zan tabbatar ko an yi wa PLC kutse ko an canja ta ba bisa ka’ida ba?
Kwatanta lambar shirin da ke aiki a yanzu da madadin ajiyar da aka tabbatar da ingancinsa da aka ajiye a waje daga cibiyar sadarwa. Yi amfani da kayan aikin kwatantawa a cikin software na injiniya (misali, "Compare Online/Offline" a TIA Portal ko "Compare Logic" a Studio 5000). Duba kwanan wata da lokacin zazzagewar shirin na ƙarshe. Duba kundin tarihin (log) na cikin PLC idan yana akwai. Don aikace-aikacen da suka matuƙar muhimmanci, aiwatar da binciken “checksum” a lokacin aiki a cikin lambar shirin.
Wace hanya ce mafi aminci don gwada dokokin firewall ba tare da katse aikin samarwa ba?
Sanya “firewall” a yanayin “transparent bridge mode” tare da yin rikodin bayanai kawai a mako na farko. Adana duk zirga-zirgar da za a toshe. Duba bayanan log don gano abubuwan da aka ɗauka kuskure (false positives). Sannan ka koma yanayin toshewa yayin taga na ayyukan gyara (maintenance window). Yi amfani da firewall guda biyu a yanayin “failover” domin a iya kauce wa ɗaya idan aka yi kuskuren toshe hanyar sadarwa mai matuƙar muhimmanci.
Zan iya amfani da na’urar gano raunin tsaro ta IT na yau da kullum a kan hanyoyin sadarwar PLC?
A’a. Masu duba cibiyar sadarwa iri na “active scanners” da ke aika fakitoci marasa daidaito ko ƙoƙarin shiga da kalmomin sirri na tsoho na iya sa tsofaffin PLCs su fadi. Yi amfani da kayan sa ido na OT na hanyar “passive” waɗanda ke nazarin zirga-zirgar da take akwai ba tare da ƙirƙirar tambayoyi (probes) ba. Idan sai an yi amfani da “active scanning”, yi amfani da kayan aikin mai ƙera (misali, Rockwell Safety Assurance Tool ko Siemens Sinema Remote Connect) da ke fahimtar iyakokin yarukan sadarwar masana’antu.
Shawarwari na ƙarshe na fasaha ga injiniyoyin sarrafawa
Tsaro ga PLCs da DCS ba zaɓi ba ne a cikin zamani na tsarin sarrafa masana'antu. Fara da sel ɗin samarwa guda ɗaya a matsayin gwaji. Aiwejantar da ƙarfafa kalmomin sirri, kulle tashoshin (ports), da raba cibiyar sadarwa zuwa sassa. Auna raguwar abubuwan da ba a saba gani ba. Ƙara shimfiɗa shi a hankali zuwa dukkan wurin samarwa. Rubuta kowane sauyin da aka yi wa saituna a takardun asalin tsaro da ake sarrafa sigoginsu ta tsarin sigar. Ɗora wa kowane injin sarrafawa (controller) alhakin kulawa ga wani injiniya takamaimai. Kula da tsaro a matsayin fannin injiniya mai ci gaba kullum, ba kawai aikin cika ka’ida sau ɗaya kawai ba. Masana’antun da ke haɗa waɗannan dabarun fasaha suna rage haɗarin hare-haren yanar-gizo da kuma tsayawar aiki ba tare da shiri ba.
