Ingantaccen Tsaron OT na Masana’antu 4.0: Gwaje-gwajen Hadafin Ƙarfafa Tsaro na Emerson DeltaV DCS ga Masana’antar Sarrafa Ayyuka
Ƙarin Barazanar Cyber na OT na Buƙatar Ƙarin Kariya a Shuke-shuken Sarrafa Masana’antu Masu Hankali
Masana’antu 4.0 tana haɗa cibiyoyin sarrafa OT kai tsaye da tsarin girgijen kamfani. Wannan haɗin yana ƙara bayyana ainihin abin da ke faruwa a aiki amma a lokaci guda yana faɗaɗa fagen harin da ake iya kaiwa wa tsarin sarrafa rarrabawa a cikin shuke-shuken sarrafa ayyuka. Binciken tsaron masana’antu na baya-bayan nan ya nuna cewa kashi 72% na masana’antun kere-kere yanzu suna fuskantar binciken OT (scanning) na mako-mako daga wajen cibiyar su. Na’urorin DeltaV DCS da ba a kare ba sau da yawa suna zama ƙofar farko da maharan ke shiga ta lokacin kutse. Saboda haka, masu gudanar da shuka dole ne su fifita dabarun ƙarfafa tsaro na musamman domin kiyaye aikin sarrafa masana’antu yana gudana cikin kwanciyar hankali.
Daga gogewata ta shekaru goma sha biyar na yin bincike a filin (field audit), yawancin ƙungiyoyin samarwa suna fifita yawan fitar da kaya fiye da matsayi na tsaro. Rikodin bincike na da na rubuta ya nuna cewa kashi 65% na gazawar tsarin DeltaV na samo asali ne daga barin manyan saitunan tsaro na asali a sakat, ba daga tsufar kayan aiki ko kuskuren aiki na yau da kullum ba. Wannan yanayi yana maimaituwa a sassan sinadarai na petrochemical, magunguna (pharmaceutical), da samar da wuta.
Manyan Raunanan Tsaro na DeltaV DCS da Aka Gano a Muhallin Samarwa
Tsofaffin sigogin software na DeltaV suna ɗauke da sanannun raunin tsaro na ɓoye-ɓoye (cryptographic weaknesses), ciki har da CVE-2022-29965, wanda ke shafar tashoshin sadarwa masu tsaro. Firmware na masu sarrafawa (controllers) da ba a sabunta ba yana rage ingancin aikin ƙwaƙwalwa da kusan kashi 22%, yana rage amsawar tsarin gabaɗaya. Asusun gama-gari na tsoffin saituna suna bai wa marasa izini damar samun damar na’ura a gida a kusan kashi 80% na yunkurin kutse. Zirga-zirgar siginar yarjejeniya (protocol) a ciki da ba a ɓoye ba tana fallasa bayanan aikin da ke gudana a ainihin lokaci ga haɗarin tsoma-baki. Bugu da ƙari, tsari ɗaya na cibiyar sadarwa (flat network architecture) da ke haɗa sassan IT da OT yana hanzarta yaduwar hari a fadin cibiyar yayin da ake kai wa hari.
Masu gudanar da shuka sau da yawa suna raina ƙaramin matsalar firmware. Sai dai ƙungiyoyin ransomware suna nuna himma wajen amfani da waɗannan ƙananan gibi da ake ɗauka da ƙaramin haɗari don durƙusar da dukkan layukan samarwa. Asarar tattalin arziki da hakan ke jawowa kan kai miliyoyin daloli a rasa samarwa da kuɗin dawo da tsarin.
Aiwatar da Rarraba Yankuna na IEC 62443 don Ware Cibiyar Sadarwar DeltaV
IEC 62443 ita ce muhimmin ma’aunin duniya na farko don tsaron tsarin sarrafa masana’antu. Sabbin sigogin Emerson DeltaV sun cimma takardar shaida ta ISASecure SSA Level 1, wadda ke samar da tushen tsaro mai ƙarfi ga sabbin shigarwa. Masu aiki suna raba cibiyar sadarwar shuka zuwa yankuna dabam-dabam, ciki har da IT na kamfani, yankin tsaka-tsaki (demilitarized zone), yankunan sarrafa OT, da ƙarin ƙananan yankunan na’urorin tsaro (safety instrumented sub-zones). Masu tacewa na masana’antu (industrial-grade firewalls) suna kafa hanyoyin sadarwa masu tsaro na hanya ɗaya tsakanin kowane yanki, wanda ke katse kimanin kashi 90% na yunƙurin samun damar ketare cibiyoyi ba tare da izini ba. Bugu da ƙari, masu aiki suna saita ƙa’idodin samun dama masu zaman kansu ga kowane sashen aikin DeltaV bisa ga bukatun aiki.
Rarraba yankuna (zonal segmentation) ita ce matakin tsaro na OT da ke bada mafi girman dawowar jari. A aikace, a cikin manyan ayyukan da aka kammala, tsara yankuna yadda ya kamata yana rage lokacin martani kan hari da kashi 70% kuma yana hana hari daga wuri guda ya zama ya shafi dukkan cibiyar sadarwa.
Ka’idojin Ƙarfafa Tsaron Ƙarshen Tushe na Workstation don DeltaV HMI
Injiniyoyi dole ne su kashe dukkan sabis na Windows da ba a amfani da su a bango a kan workstation na HMI na DeltaV domin kawar da hanyoyin hari da ba su da amfani. Kulle cikakke na tashoshin na’urorin ajiya na waje (removable media ports) yana toshe hanyoyin shigowar ƙwayar cuta daga waje da sau da yawa ke wuce kariyar cibiyar sadarwa. Dole a daidaita ƙa’idodin firewall ta yadda za su yarda da sadarwa ne kawai da sassan yanki na DeltaV da ake yarda da su. Kaddamar da kayan aikin kariyar takardu (credential guard tools) yana hana satar bayanan asusun DCS ta hanyar dabarun pass-the-hash. Manhajar kariya ta ƙwayar cuta (antivirus) da Emerson ya amince da jerin sunayenta (whitelisted) tana ba da kariya a ainihin lokacin ba tare da katse aikin manhajojin sarrafawa ba. Bayan an aiwatar da matakan ƙarfafa tsaro na yau da kullum, yawan fuskantar raunin tsaro na ƙarshe (endpoint vulnerability exposure) yakan ragu da kusan kashi 85%.
Kada a taɓa gyara sabis na tsarin fiye da abin da jagororin hukuma na Emerson suka tsara. Ingantawa ta hannu da ba a daidaita ba kan haifar da tangarda ga tsarin sarrafa ainihin lokaci na DeltaV sannan ta soke takardun bin ƙa’ida na mai ƙera kayan, ta haifar da matsaloli fiye da mafita.
Matakan Kulle Tsaro a Matakin Controller don Na’urorin DeltaV a Filin
Sabunta firmware akai-akai ga masu sarrafawar DeltaV na magance sanannun raunin tsaro na yarjejeniya (protocol) kuma yana ƙara ƙarfin jure hari na tsarin gabaɗaya. Shigar da kayan Firewall-IPD yana ware rukunonin masu sarrafawa na filin dabam-dabam, yana hana yaduwarsu juna yayin abin da ya shafi tsaro. Ramukan TLS da aka ɓoye (TLS encrypted tunnels) tare da tabbatarwa ta matakai da dama (multi-factor authentication) suna kare duk zaman samun damar injiniyoyi daga nesa. Takaita umarnin Modbus batch write masu haɗari a kan na’urorin filin yana rage haɗarin sauya sigogi ba tare da izini ba. Bai wa kowane mai sarrafa DeltaV da ke kan cibiyar sadarwa takardar shaida ta musamman ta ainihi yana ba da damar bin diddigin samun dama cikin ƙananan matakai da ɗaukar alhaki. Binciken rajista a ainihin lokaci (real-time log auditing) yana sa ido kan duk sauye-sauyen saitin masu sarrafawa kuma yana tayar da faɗakarwa idan aka samu gyare-gyaren da ba a amince da su ba.
Masu sarrafa filin su ne muhimmin wuri na makance ga tsaro a mafi yawan shuke-shuken sarrafa ayyuka. Na yi bincike kai tsaye kan fiye da aukuwar lamurra goma sha biyu a shuke-shuke da aka haifar kai tsaye sakamakon tafka gyare-gyaren masu sarrafawa ba tare da kulawa ba. Waɗannan canje-canjen da ba a amince da su ba sun sauya sigogi na tsarin kuma suka haifar da yanayin samarwa mai haɗari.
Sigar Sadarwar Bayanai da Kula da Samun Dama don Tsaron DeltaV
A kunna asalin ɓoyewar TLS na DeltaV yana kare duk mu’amalar bayanan na’urori a cikin cibiyar sarrafawa. Tsarin samun dama bisa rawar aiki (role-based access control) yana aiwatar da ka’idar bai wa mai amfani ƙaramin iko da ya isa aikinsa (least-privilege), yana tabbatar da cewa masu aiki suna samun damar ayyukan da suke buƙata kawai. Barin tsofaffin asusun jama’a da tilasta sabunta kalmar sirri kowane kwana 90 yana ƙarfafa tsarin tantance masu amfani. Haɗa rajistan ayyukan DCS da tsarin SIEM yana ba da damar saka ido cikin wayo na sa’o’i 24 da gano barazana da wuri. Waɗannan matakan tare suna rage haɗarin tsoma-bakin bayanai a ciki zuwa kusan sifili.
Tsofaffin tsarin DeltaV yawanci suna amfani da isar da bayanai a rubutu kai tsaye (plaintext) a matsayin tsohuwar siga. Sabunta ɓoyewar bayanai baya buƙatar dakatar da samarwa kuma yana ba da moriyar kariyar bayanai nan take ga ayyukan shuka.
Aikace-aikacen Gaskiya: Aikin Sabunta Tsaron DeltaV a Shukar Petrochemical
Wata shuka ta cikin gida ta petrochemical mai ƙarfin 2.2 MMTPA tana aiki da tsarin DeltaV v13 kafin 2025. Tsarin cibiyar sadarwar IT-OT ɗaya (flat architecture) yana jawo fiye da binciken cibiyar sadarwa ba tare da izini ba guda 30 a kowane wata, tare da masu sarrafawa da ba a ware su ba suna fuskantar babban haɗarin a yi musu kutse. Shukar ta kasa cin jarabawar binciken tsaro na IEC 62443 daga ɓangare na uku sau biyu a jere.
Ƙungiyar injiniyoyi ta kammala duk aikin ƙarfafa tsaro a cikin tagogin gyara biyu na awoyi 12-12. Manyan matakan sun haɗa da rarraba cibiyar sadarwa zuwa yankuna, sabunta firmware na masu sarrafawa, kulle tashar USB, kaddamar da ɓoyewar TLS, da aiwatar da MFA don samun damar nesa. Duk saituna sun bi ka’idojin tsaro na hukuma na Emerson da bukatun IEC 62443 cikakku.
Yawan harin binciken cibiyar sadarwa na wata-wata ya ragu daga 32 zuwa 6, wato raguwa da kashi 81%. Adadin raunin tsaron ƙarshe ya ragu da kashi 87%. Shukar ta yi nasarar wuce gwajin takardar shaidar tsaron OT na duniya kuma ta guje wa asarar da aka kiyasta ta kusan dala 460,000 na yuwuwar ɓarna. Shukar ta ci gaba da kasancewa ba tare da wani lamari na tsaro ba tsawon watanni goma sha biyu a jere.
Wannan misali yana nuna cewa ƙarfafa tsarin DeltaV ta hanyar tsari na ilimi yana daidaita buƙatun rabon bayanan Masana’antu 4.0 da tsaron samarwa. Saituna na daidaitattun ƙa’idoji ba sa rage ingancin aikin tsarin amma suna ƙara ƙarfin jure hare-hare na cibiyar OT sosai.
Salon Masana’antu na Gobe da Shawarwari na Masana
Juyin juya halin dijital na Masana’antu 4.0 yana ci gaba da ɗaga bukatun tsaro ga mahallin OT na DCS. Tsarin tsaro na zero-trust zai zama babban samfurin tsaro ga nau’ikan DeltaV na gaba. Zagayen ƙarfafa tsaro na doka-doka, sabunta firmware, da dubawar tsaro na yau da kullum suna tabbatar da daidaiton tsarin na dogon lokaci da bin ƙa’idoji. Shuke-shuke dole ne su haɗa saitin tsaro cikin gudanarwar aiki ta yau da kullum maimakon ɗaukar sa a matsayin aikin lokaci ɗaya. Hada mafita daga masu ƙera kayan da ma’aunin masana’antu yana kawo kariya mafi tasiri gabaɗaya.
Yanayin Mafita don Ƙarfafa Tsaron DeltaV
Yanayi na 1: Sabuwar Shigar DeltaV (Greenfield) – A aiwatar da rarraba yankuna tun a matakin zane na farko. A kaddamar da ɓoyewar TLS da MFA tun daga farkon aikin. A kafa tsarin samun dama bisa rawar aiki kafin a kaddamar da tsarin.
Yanayi na 2: Sabunta Tsofaffin Tsari (Brownfield Legacy System Upgrade) – A gudanar da cikakken tantance raunin tsaro. A fifita sabunta firmware da ƙarfafa tsaron ƙarshe (endpoint hardening). A aiwatar da rarraba cibiyar sadarwa ba tare da katse samarwa ba ta hanyar matakai na sauya tsarin a hankali (phased migration).
Yanayi na 3: Shirin Shiga Gwajin Bin Ƙa’ida (Compliance Audit Preparation) – A sake dubawa na halin saitunan yanzu da bukatun IEC 62443. A kunna cikakken yin rajista da saka ido. A gudanar da gwajin kutse (penetration testing) don tabbatar da ingancin matakan tsaro kafin a yi gwajin hukuma.
Rubutacce daga Song Mingyuan, injiniyan sarrafa kansa mai ƙwarewa a PLC, DCS da sanannun alamomin sarrafa masana’antu na duniya don aikace-aikacen petrochemical.
