The Smart Firewall was developed in response to the increased frequency
and sophistication of cyber security risks to industrial networks. It is used
to protect the DeltaV network from potential security issues and to help ensure
reliable and resilient industrial operations. The firewall controls traffic
going into the DeltaV network, in particular HTTP, OPC, and remote desktop
traffic. It also controls traffic coming out of the DeltaV network such as HTTP
and OPC.
- Web UI
- The firewall has a built-in web-based user interface (web UI) that
can be accessed from any workstation on the DeltaV network. The web UI is used
to configure the firewall, create the communications protection rules, and
control user access. The web UI logs information about network traffic allowing
you to monitor the traffic passing through the firewall. The web UI has
extensive online help that will guide you through all configuration and
troubleshooting procedures.
- Easy configuration of communication rules
- A main feature of the firewall is a predefined drop-down list of
DeltaV applications that can be used to easily configure the communication
rules. Simply select the description of the communications you wish to
establish between the DeltaV workstation and the computer on the external
network, provide the computer names, and the firewall automatically creates the
communications rule to permit the communications through the firewall. All
other communication attempts, except those explicitly permitted, are blocked by
the firewall.
- Intrusion Prevention/Detection System
- The firewall contains an Intrusion Prevention/Detection System
(IPS/IDS) that filters traffic based on inspecting the payload of the packets.
The IPS/IDS can be loaded with intrusion signatures that are used to compare
the packet content with known security threats. The intrusion protection
signatures isolate particular types of traffic and stop it from passing through
the firewall. New intrusion signatures are issued regularly to keep ahead of
the latest security vulnerabilities, ensuring that the DeltaV network is
continuously protected. Maintaining the intrusion protection and preventing
attacks at the system perimeter can substantially reduce the frequency and cost
of vulnerability patching activities on the network devices.
- Adding a firewall to the Network Device Command Center (NDCC)
- When you add a firewall using the NDCC, the firewall is given a
network address and creates a corresponding control module so that firewall
hardware conditions can be interpreted as DeltaV alarms. Adding the firewall to
the NDCC also provides access to firewall diagnostics.
- Smart Firewall features include:
- The DeltaV-integrated
NDCC application that is the user interface for adding a firewall and viewing
diagnostic information.
- Control function block
module classes that hold the DeltaV configuration for Emerson Smart Firewalls.
Firewall modules (one for each firewall) are instantiated from these classes
and run in ProfessionalPLUS or Application Stations. The modules detect active
Hardware Alarm Conditions (HAC) based on real-time information read from Smart
Firewalls and potentially cause hardware alarms.
- Support for
PlantWeb-style hardware alarms driven by alert conditions detected in Emerson
Smart Firewalls.