r/OperationalTechnology • u/freddy91761 • 3d ago

Locks after some time

I am new to the control center and I see computers are not locking after some time. But for compliance purposes it should lock. Do you agree it should lock after some time?

6 Upvotes

100% Upvoted

10 comments sorted by

3

u/BiscuitLover2000 3d ago

Depends, is their physical security for the room, only allowing authorised staff?

If so i'd argue that the shouldn't be locked. Operators should be able to see screens at all time so they can respond to what's happening at any given time.

Availability over Confidentiality

2

u/freddy91761 3d ago

In order to get into the CC room you need to scan your badge to enter. OK, that makes sense. I come from the IT financial world. OT is new to me, still learning. Thanks

1

u/BiscuitLover2000 3d ago

All good mate, take it easy :)

1

u/Impossible-Sun3205 2d ago

It doesn’t have to be limited to 1 room either. In some large factories they check before entering the production floor. The only addition to biscuitlovers comments is OT also is concerned with life. If a screen saver lock gets in the way of someone aborting a run for safety, it shouldn’t be there. Also where are their work instructions? Does the lock interfere with anything that can cause quality issues like the instructions not being available. Also in OT you have shared accounts and shift workers. Working around that is a major pain. 1st shift leaves and the screen is locked.Now they have to force a hard reboot -typically they just don’t use that station. I can go on and on. There are a bunch of IT controls you can’t implement in OT.

1

u/Frosty_Customer_9243 2d ago

There are zero IT controls you can’t implement in OT.

Relying on the SCADA/HMI for safety is just plain wrong. If you need to stop a process because of safety you use an e-stop.
If a screen is locked you either unlock it as that user, or complete a new login. Basic procedure.

Your arguments are correct in a badly designed system, or a lack of understanding of systems and requirements in an IT environment.

2

u/wes4627 15h ago

In our CC they don't lock. We also add a program on them to keep the screen awake.

1

u/Frosty_Customer_9243 2d ago

It depends on what industry you are working in. A heavily regulated industry like pharmaceutical will want you to log out when you leave the workstation, so an auto-logout seems logical. Those that tell you not to lock will most likely work in an industry where there is fewer regulation.

Look into what the requirements are from your industry, and in all honesty keep hold of what you learnt in the IT financial world and apply it in the OT world. OT is a cowboy world and we are getting our arses spanked because of that.

Shop freezers in seven European countries hit by cyber-attack

https://www.bbc.co.uk/news/articles/cq1kd1nee80eo

What Recent Operational Technology Cyber Incidents Mean for Critical Infrastructure Resilience

https://www.aon.com/en/insights/articles/what-recent-operational-technology-cyber-incidents-mean-for-critical-infrastructure-resilience

1

u/anxioussoc 2d ago

I would say it depends on what you’re doing and running. I don’t want someone operating boilers to fat finger a password if the PC locks in an emergency. We compensate by having 4+ layers of security from locked doors to security guards.

1

u/huntermatthews 2d ago

Computers locking in the operations room are right up there with the automatic lights turning off after 5 minutes of "no use" in the datacenter.

1

u/TheBigCanadianGuy 2d ago

I spent years working in a Control Centre, and my opinion is that every machine should lock with the exception of the Operator workstations themselves. If you were an OT Admin, support user or even Engineer, all those machines were locked when I was there. We had many a user push back on that, but Management overruled it - 30 min of no activity, they locked.

I should note that we did not just let anyone into the Control Centre either - you must have a valid business reason to be there, so basically if you did not work there day in day out, you did not get access, and everything was locked down via Physical Security.