Jump to content
xisto Community

ankneo

Members
  • Content Count

    9
  • Joined

  • Last visited

Posts posted by ankneo


  1. SCADA is an acronym for Supervisory Control and Data Acquisition. SCADA systems are used to perform data collection and control at the supervisory level. A SCADA system includes input/output signal hardware, controllers, HMI, networks, communication, database and software. It mainly comes in the branch of Instrumentation Engineering. The term SCADA refers to a central system that monitors and controls a complete site or a system spread out over a long distance. The bulk of the site control is performed by a Remote Terminal Unit (RTU) or by a Programmable Logic Controller (PLC). Data acquisition begins at the RTU or PLC level and includes meter readings and equipment statuses that are communicated to SCADA. Data is then compiled and formatted in such a way that a control room operator using the HMI can make supervisory decisions that may be required to adjust/over-ride normal RTU (PLC) controls. SCADA systems implement a distributed database, called tag database, which contains data elements called tags or points. A point represents a single input or output value monitored/controlled by the system. Points can be "hard" or "soft". A hard point is representative of an actual input or output connected to the system, while a soft point represents the result of logic and math operations applied to other hard and soft points. Human machine interface (HMI) A Human-Machine Interface or HMI is the apparatus which presents processed data to a human operator, and through which the human operator controls the process. The SCADA system gathers information from the PLCs and other controllers via some form of network, and combines and formats the information. An HMI may also be linked to a database, to provide trending, diagnostic data, and management information such as scheduled maintenance procedures, logistic information, detailed schematics for a particular sensor or machine, and expert-system troubleshooting guides. SCADA is popular, due to its compatibility and reliability. It is used in small applications, like controlling the temperature of a room, to large applications, such as the control of nuclear power plants. System components There are three components of a SCADA system: 1. Multiple Remote Terminal Units (also known as RTUs or Outstations).2. Master Station and HMI Computer(s).3. Communication infrastructureRemote Terminal Unit (RTU) The RTU connects to physical equipment, and reads status data such as the open/closed status from a switch, reads measurements such as pressure, flow or voltage. By sending signals to equipment the RTU can control equipment, such as opening or closing a switch or setting the speed of a pump. The RTU can read digital status data or analogue measurement data, and send out digital commands or analogue setpoints. An important part of most SCADA implementations are alarms. An alarm is a digital status point that has either the value NORMAL or ALARM. Alarms can be created in such a way that when their requirements are met, they are activated. Master Station The term "Master Station" refers to the servers/software responsible for communicating with the field equipment (RTUs, PLCs, etc), and then to the HMI software running on workstations in the control room, or elsewhere. In smaller SCADA systems, the master station may be composed of a single PC. In larger SCADA systems, the master station may include multiple servers, distributed software applications, and disaster recovery sites. The SCADA system presents the information to the operating personnel in the form of a mimic diagram. The operator can see a schematic representation of the plant being controlled. For example, a picture of a pump connected to a pipe can show the operator that the pump is running and how much fluid it is pumping through the pipe at the moment. The operator can then switch the pump off. The HMI s oftware will show the flow rate of the fluid in the pipe decrease in real time. Communication infrastructure and methods SCADA systems have traditionally used combinations of radio and direct serial or modem connections to meet communication requirements, although Ethernet and IP over SONET is also frequently used at large sites such as railways and power stations. Typical SCADA protocols include Modbus, RP-570 and Conitel. Standard protocols are IEC 60870-5-101 or 104, Profibus and DNP3. These communication protocols are standardized and recognized by all major SCADA vendors.FIELD OF IMPLEMENTATION? I n d u s t r i a l p r o c e s s e s i n c l u d e : m a n u f a c t u r i n g / p r o d u c t i o n / p o w e r generation/fabrication/refining - continuous, batch, repetitive or discrete.? Infrastructure processes may be public or private and include: water treatment and distribution, wastewater collection and wastewater treatment, oil & gas pipelines, electrical power transmission and distribution and large communication systems. ? Facility processes in private or public facilities including: buildings, airports, ships or space stations in order to monitor and control: HVAC, access control, energy consumption management.


  2. Secure Website Login Programming with PHP & MySQLIntroduction
    If you are developing a web-based system whereby a user, or users, are logging in and staying logged in (sessions, cookies), the following ideas are written with you in mind. Making sure your authentication and authorization schemes are secure is going to be part of your task. All of those things fall under the umbrella term: security. Any competent, security conscious person should already know that most intrusions/attacks are undertaken as follows:
    1. Social Engineering (conning)
    2. An inside job, by an employee or trusted person
    What it all means is that nothing is stopping one of your users from choosing an easy password, sharing it with others, or leaving themselves logged in as they step away from the machine. Nor can you completely stop an employee from misusing your internal system. However, it behooves you to implement the most basic security measures in your programming, in this case, website programming. That is why I have written this article.

    Some Basic Rules
    Rule #1 - Nothing is totally secure. Break-ins and compromises are inevitable.
    Rule #2 - Segment your system/software in order to diminish the damage from said compromise.
    Rule #3 - Log as much as you can.
    Rule #4 - Never trust user input.
    :P
    My definition of security
    Slowing down an attacker long enough to capture them, and/or fix the security holes, while at the same time safeguarding a system that is segmented in order to lessen the degree of damage during a successful attack. In other words, make a system that is designed for security, defense and facilitates recovery from attack. (Think like kevlar, not concrete: be flexilble, absorb attack, recover and respond.)


    Basic Security Methods
    The following should be in place in your system, as a minimum.
    1. Usernames and passwords should be 6 characters long, or more. Go for 8 or more characters to be safer.
    2. In the event of login failure, be very uncooperative
    Tell the user "Your login attempt was unsuccessful" not: "Your password was missing the letter x" or "Your username is not in our system". Give very few leads as to why the login failed. They only serve to help intruders.
    3. Handle errors gracefully
    Place the ampersat symbol (@) in front of many of your PHP function calls. If they fail, the ampersat will stop that failure from showing in the browser window. This is very useful when making database calls but your database is down, or the SQL statement returns an error. Such messages would only give feedback to intruders, or look unprofessional to regular users.
    Example: $variable = @function_name($parameter);
    4. Passwords in the user account table of your database must be encrypted (SHA-256 or higher)
    That way if someone were to somehow gain access to the database itself, and view all of the user accounts, they would be able to see usernames, but not plain text passwords. Unless they changed the password, which would alert the user once they realized they couldn't log in, or they tried to crack the encrypted password (possible, but hard) they would have no way of using their newly found information.
    To accomplish this, the "password" field in your SQL datbase should hold an encrypted string. Before you compare the user input password to the one stored in the database, use the PHP encryption functions to encrypt it.
    Example: $encrypted = @hash("sha-256", $password);
    $encrypted = @md5($password);

    5. Create a different area for administrators/webmasters to login at and use
    If your users log in at https://www.salesforce.com/products/platform/overview/, then create a different folder and set of code for the administrators to log in at. Something like https://www.salesforce.com/products/platform/overview/ Now, I do not mean that this is for "power users" or "managers", I really mean you, the main site webmaster, when I say administrators. Put your login code and other PHP code in that separate folder, and name it something odd instead of "admin" or "root". Make it non-obvious.
    6. Log the total number of logins for each user, as well as the data/time of their last login
    Logging the total is just a good indicator, and *may* be useful for security purposes depending on your system. Keeping track of their last login is very useful in the event that someone logged in using their account, without permission. You now know the time it happened, and if you log the date/time of any changes in your database and by whom, you can track what that intruder did while logged in.
    In order to accomplish the above, the user account table in your SQL database should have three extra fields:
    Logincount of type INTEGER
    Lastlogin of type TIMESTAMP (or datetime)
    Thislogin of type TIMESTAMP (or datetime)
    When the user logs in, in PHP, update that user's information in the database by incrementing their login count and by getting the timestamp using PHP's built in date() function. After successful login, first transfer the info stored in 'Thislogin' to the 'Lastlogin' field, and then insert the new date/time into 'Thislogin'.
    7. Strip backslashes, HTML, SQL and PHP tags from any form field data
    If someone maliciously tries to send HTML, SQL or PHP code through a text field entry not meant to expect it, they can disrupt or break your code. An example of an attack this is meant to help stop is the SQL Injection attack. Use the following PHP functions to strip out such text:
    strip_tags(), str_replace() and stripslashes()
    Example: $username = @strip_tags($login);
    Example: $username = @stripslashes($login);
    8. Use $_POST not $_REQUEST
    If your HTML form uses POST to send the data to the login script, then make sure your login script gets the input data using $_POST, and not $_REQUEST. The latter would allow someone to pass data via GET, on the end of the URL string.
    9. In general, limit user access according to their role
    Design your system to give users specific layers, or subsets of access. Not everyone needs to be all powerful, nor all knowing. Using the unix group idea as your starting point. Classify users and give them features based on that. If you have a system with multiple users who have different roles, give them functionality based on those roles. Accountants, and only allow accountants can see financial data, not warehouse inventory or much else. The person at the cash register can enter in a sale, but not delete it. That is a managers job, and needs override permission. Etc....
    Conclusion
    You should now have a somewhat complete picture of what can be done to create a secure, login based site. Most of what I have discussed refers to programming, and your code. I have not discussed the finer points of security, which I briefly mentioned at the introduction and have to do with our most human failings. Outside of the scope of this article are additional security measures such as requiring your users to choose non-obvious passwords, forcing users to change passwords every 30 to 90 days, training them not to give out their password over the phone, and so on.....
    Always keep in mind, security is meant to slow down an attack enough for you to capture the intruder, or fend them off and then correct the security hole. If you think your site is 100% intruder proof, think again.


    Notice from rvalkass:

    Anything you copy needs to be in QUOTE tags. Please read the readme and list of BBCodes. Copied from http://forums.xisto.com/no_longer_exists/

×
×
  • Create New...

Important Information

Terms of Use | Privacy Policy | Guidelines | We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.