Digital Bond OPC Hardening Guide

If you are using Nessus to audit a control system network, Digital Bond has recently released a set of guidelines (part 1, 2 and 3) for securing OPC servers. These guidelines include three Nessus configuration audit policies (for use with Direct Feed subscriptions) to test OPC servers running under Windows XP Pro, Windows 2000 and Windows 2003. The guidelines and audit files are available to Digital Bond content subscribers.

OPC stands for "Object-linking and embedding for Process Control". This is a set of Microsoft technologies which leverages OLE, DCOM and COM for use in automation and controls. The need for OPC arose because each time a new control system was introduced it likely had a proprietary method to interact with it. Having a common communication standard within OPC simplifies control system design. This makes it easier to write management and monitoring applications which are independent of the actual hardware deployed at the dam, on the pump, on the oven, at the generator and so on.

However, securing these technologies is not a simple process. Doing things such as adding firewall rules or attempting to have services or processes not run with administrator credentials can easily break "out of the box" OPC deployments. The content produced by Digital Bond can help any organization that wishes to harden their Windows control systems by letting them understand how OPC works and where it can be hardened.

To use these OPC policies, you should not only be subscribed to the Digital Bond content, but also be either a Nessus Direct Feed or Security Center customer.

Previously, Digital Bond and Tenable have collaborated to produce SCADA vulnerability checks for Nessus Direct Feed and Security Center users. I also had the chance to interview Digital Bond's CEO, Dale Petersen, in a podcast. Tenable also offers a 30 minute webinar on SCADA network monitoring with Tenable solutions.