Automation Asset Management: A Proven Best Practice 

 An effective automation asset management strategy must be comprehensive and include distributed control systems, PLCs, historians, field instrument databases, advanced applications and other automation-related systems and databases. To maintain the integrity of the integrated automation infrastructure and to sustain robust interoperability, an effective automation asset management strategy must include the following essential components for all such assets. 
 

Automation Asset Inventory Management 

The first step in managing any asset involves capturing and automatically maintaining a comprehensive and accurate inventory of its components. Automation systems require the same level of asset inventory management for the components that make up the entire automation infrastructure. The scope of automation asset inventory includes capturing the make, model, version, revision and other relevant information about each of the following components: 

• Hardware 

• Operating systems 

• Applications 

• Patches 

• Networks, routers and switches 

• Spare capacity and availability 

• Interface connections 

• Other related information 

 
Automatic Documentation and Integrated Visualization  

Most automation systems and applications have a limited documentation capability, and they generally do not provide an effective and simple visualization of their complex configuration. Furthermore, automation suppliers do not concern themselves with the documentation of the third-party systems they interface. To that end, an effective automation asset management strategy requires automatic documentation and the ability to provide simple visualizations of complex relationships - not only internal to each system, but also among different automation asset types. 
 

Management of Change 

Changes to the automation system can have significant adverse consequences if not managed properly. Management of change (MOC) is a well-known and generally accepted practice when it comes to physical assets. Regulatory authorities in many countries require major industrial companies to voluntarily conform to strict MOC processes when it comes to implementing change on a physical asset, such as replacing a pump, or a pressure relief valve. 
 
Because of their complexity and the need for frequent and substantial configuration changes, automation systems require a new class of intelligent MOC application that provides a robust workflow process and enables the automatic capture and reconciliation of all changes to a system. 
 
An effective MOC process for automation systems should be layered and specific, encompassing the following: 

• Workflow processes definition - allowing different work processes for different types of changes. 

• Checklists – ensures the correct information is being checked and recorded at each stage in the workflow process. 

• Transitions – sees that the process is routed to the correct person for review at the correct time within the work process. 

• Information push – confirms that when a person is reviewing the request for change they have the correct information. 

• Reconcile – ties the actual change back to the MOC process that it was approved in: 

• The ability to automatically and/or manually reconcile the change back to the work process should be available. 

• Identification of change – ensures that no unauthorized and or undocumented changes go undetected and enables all changes to be reconciled: 

  • Types of change (additions, deletions or modifications) 
  • Types of systems (both proprietary and open systems) 
  • Physical changes (hardware and/or infrastructure) 
  • Soft changes (logic, configuration or software) 

 
Configuration Integrity Management 

Modern automation systems are extremely flexible, allowing engineers to configure them the way they want. That flexibility brings with it a level of complexity that introduces configuration errors even for the most experienced engineer. The good news is that most control systems have a configuration that establishes what the proper configuration should look like. Configuration errors are also introduced when interconnections between different automation assets are established, deleted or modified. 
 
 Automation configuration issues range from alarms that are inadvertently disabled to external interfaces or internal connections that are unintentionally broken. In one instance at a chemical plant, changes to the alarm configuration of a tag that was used in a shutdown logic interlock led to an unplanned shutdown costing the company over $250,000 in lost production. 
  
To address the issue of configuration integrity, automation managers and engineers should investigate applications that automatically identify and report configuration integrity issues. The resolution of configuration integrity issues must be a high priority for plant personnel to avoid process disturbances and unplanned shutdowns. 
 

OT/ICS Cybersecurity  

The proliferation of the internet, the increased requirement for interoperability amongst disparate systems and the visibility of information in the industrial sector have led to a growing concern about external threats, as well as internal vulnerabilities associated with automation assets. Developing a comprehensive OT/ICS cybersecurity strategy requires robust work process and automated tools to facilitate strict management of the configuration of automation assets.  
 
In addition to physical and perimeter security, measures must be taken to create and update, in real-time, an inventory of automation assets. Whitelisting and baseline definitions must be developed and used to audit each system, to ensure that only approved operating software versions, applications and patches are deployed. External ports such as USB drives must be disabled and placed under frequent surveillance to protect against inadvertent and unauthorized access. User passwords must be managed rigorously and changed frequently. The privileged access of departing employees must be revoked as soon as possible. 

To read more from Hexagon’s OT/ICS Cybersecurity subject matter experts, see additional blogs here or if you would like to learn more about PAS Cyber Integrity click here. 

Read more in this series:

• Introduction (Part 1 of 4)
• Management of Change (Part 2 of 4)
• Configuration Management (Part 3 of 4)