Veilige industriële netwerk oplossingen in de praktijk. Jaap Westeneng Endress+Hauser

Size: px

Start display at page:

Download "Veilige industriële netwerk oplossingen in de praktijk. Jaap Westeneng Endress+Hauser"

Lilian Washington
5 years ago
Views:

1 Veilige industriële netwerk oplossingen in de praktijk Jaap Westeneng Endress+Hauser

2 Veilige industriële netwerk oplossingen in de praktijk De industrie wordt met de opkomst van industriële netwerken en IoT meer en meer uitgedaagd om door en over de verschillende domein lagen heen transparant informatie te ontsluiten om zodoende invulling te geven aan de toenemende vraag naar BIG DATA en connectiviteit. In de praktijk kan de invulling en realisatie van transparantie en connectiviteit complex worden als verschillende infrastructuren, industriële communicatie componenten en protocollen naast elkaar worden gebruikt en met elkaar verbonden worden. Jaap Westeneng, Product Manager Asset Management, Endress+Hauser

3 BIG MINING is like gold mining

4 It is team work

5 pays off well London Good Delivery Bar weights around 12.5 kilo (400 troy ounces) 1 gram = 40,00 London Good Delivery Bar = ,00 1 troy ounce = 31,1035 gram

6 and needs to be secured

7 some DATA is really hard to get

8 The Challenge #1 From process control domain smart device (e.g. HART) can t be managed and maintained centrally because OT components doesn t provide a smart pass-through channel (e.g. FDT/DTM). Process Control (OT) Enterprise (IT) 4-20mA Fieldbus Ind. Eth. Ind. Eth. OWS Ind. Eth. HART PROFIBUS DP PROFINET TCP/UDP Sensor Remote IO Gateway Control CMMS Maintenance (IT) AIH AOH DCM

9 The Challenge #2 If all OT components will become smart there will be a proliferation of unstructured data publishers! Process Control (OT) Enterprise (IT) Fieldbus Fieldbus Control Ind. Eth. Ind. Eth. OWS Ind. Eth. Sensor PROFIBUS PA Gateway PROFIBUS DP TCP/UDP TCP/UDP CMMS Maintenance (OT) Gateway DCM

10 The Challenge #3 Direct secure connection between OT and cloud applications are technically feasible but not allowed by corporate policies (e.g. no Internet connection in OT) Process Control (OT) DMZ Enterprise (IT) Cloud OWS CMMS AIM Maintenance (OT) DCM

11 From phone to smart phone

From switch to managed (smart) switch Embedded

Firmware updates Virtual Local Area Network

12 From switch to managed (smart) switch Embedded OPC UA server Switch Event logging Digital communication protocols (IGMP, SNMP, DHCP, SMTP, HTTP, Telnet, Syslog, SNMP, LLDP, ) Firmware updates Virtual Local Area Network (VLAN) Embedded webserver Network Address Translation (NAT)

13 From gateway to smart gateway Embedded OPC UA server Communication protocol gateway Event logging Communication protocol transparency Firmware updates Mail notification Embedded webserver Device diagnostics

14 From device to smart device 4-20 ma Embedded OPC UA server Process value Embedded device verification Monitoring + Optimization Digital communication protocols (HART, Modbus, PROFIBUS, PROFINET, EtherNet/IP, ) AI TOT DI DO Embedded Device Driver Multiple digital process variables Embedded webserver Device diagnostics

15 IIoT Vision The promise of connecting everything within an industrial environment to get complete visibility into its operations and allow the best real-time decisions to be made with or without human intervention will transform how we manufacture for years to come. The premise for this next industrial evolution is the Industrial Internet of Things (IIoT). IIoT Benefits

16 The Premise (IT + - OT) = IOT Industrial Internet of Things The concept of connecting all hardware and software components within an industrial environment for complete visibility into operations at any time of day and from any location.

Critical capabilities for enabling IIoT Platform Connectivity This includes all necessary hardware and software to network

quickly and efficiently managing devices, moving data, and triggering events.

are most needed at the edge, within the plant, at the enterprise, or outside the firewall Big Data Analytics Includes the

data for enabling unprecedented insights Application Development Includes the needed tools for quickly and easily creating

17 Critical capabilities for enabling IIoT Platform Connectivity This includes all necessary hardware and software to network within the plant and the enterprise, standards for integrating machines, clouds, applications and the technology for quickly and efficiently managing devices, moving data, and triggering events. Cloud Includes all of the various clouds across an enterprise to implement computing and storage capabilities wherever they are most needed at the edge, within the plant, at the enterprise, or outside the firewall Big Data Analytics Includes the use of a broad set of statistical and optimization tools to cleanse, monitor, and analyze both structured and unstructured data for enabling unprecedented insights Application Development Includes the needed tools for quickly and easily creating new mash up software applications that leverage all other areas of the IIoT platform as well as quickly and easily moving existing legacy applications on top of the platform as well.

ISA/IEC-62443/ISA-99 Based Industrial Control System (ICS) Cyber security 7 Steps to Industrial Control System Security Assess existing systems Document policies and procedures Train personnel and

18 ISA/IEC-62443/ISA-99 Based Industrial Control System (ICS) Cyber security 7 Steps to Industrial Control System Security Assess existing systems Document policies and procedures Train personnel and contractors Segment the control system network Control access to the system Harden the components of the system Monitor and maintain system security Source

ISA/IEC-62443/ISA-99 Based Industrial Control System (ICS) Cyber security The ANSI/ISA-99 standards provide the base documents for the ISO/IEC standards in Industrial Control Security, known as

19 ISA/IEC-62443/ISA-99 Based Industrial Control System (ICS) Cyber security The ANSI/ISA-99 standards provide the base documents for the ISO/IEC standards in Industrial Control Security, known as IEC Over the next few years, these standards are expected to become the core standards for Industrial Control Security worldwide. Source

20 ISA/IEC-62443/ISA-99 Based Industrial Control System (ICS) Cyber security Zone is defined as a grouping of logical or physical assets that share common security requirements based on factors such as criticality and consequence. Conduit is a path for the flow of information between two zones. It can provide the security functions that allow different zones to communicate securely. Any transfer of electronic data between zones must have a conduit. Supervisory Zone J 1 Basic Control Zone C 1

21 Newton's Third Law Open Secure Newton, Sir Isaac ( )

Is this the picture you have in mind for the

22 Is this the picture you have in mind for the Automation structure? Enterprise Resource Planning Manufacturing Execution Level Basic Automation Field level Proven and widely accepted structure. Highly available and mature systems. Supports sustainable operations with long life cycles.

23 OT IT OT & IT ISA-99 based Industrial Control System (Perdue model) Cloud Apps Information Enterprise Network Technology (IT) Boundary Router Zone B 1 Level 5 A business network consisting of hardware and software that allows for the storing, retrieving, and sending information for human consumption. Enterprise Zone E 1 Level 4 ERP CMMS De Militarized Zone (DMZ) DMZ Zone D 1 Operational Process Control Technology Process Information (OT) Network (PCN) An automation Network network (PIN) Zone M consisting of hardware and software that 1 is responsible for Historian DCM Patching Analysis monitoring and/or controlling industrial devices, processes, and events in the enterprise. Zone Conduit Plant Network Manufacturing Level 3 Supervisory Zone J 1 Zone J 2 Level 2 Level 1.5 Basic Control Zone C 1 Zone C 2 Level 1 Safety EWS Zone S 1 OWS Zone O1 Zone O mA HART Level 2.5 Level 0.5 Zone W 4-20mA Industrial Fieldbus Wireless 1 Process HART Zone Ethernet P 1 HART Level 0

OT OT Device Configuration Management (DCM)

(Smart Wireless) Operational Process Control

An automation Network network (PIN) consisting of

monitoring and/or controlling industrial devices,

Plant Network Manufacturing Level 3 Supervisory

24 OT OT Device Configuration Management (DCM) [Challenge #1] Maintenance Pass-through (Smart switch) Bypass (Smart Fieldbus Gateway) Pass-through (Remote IO + AIH + AOH) Bypass (Smart Wireless) Operational Process Control Technology Process Information (OT) Network (PCN) An automation Network network (PIN) consisting of hardware and software that is responsible for DCM monitoring and/or controlling industrial devices, processes, and events in the enterprise. Plant Network Manufacturing Level 3 Supervisory Level 2 Bypass (Multiplexer + Smart Gateway) Basic Control Level 1 Safety Process Level 0

25 Definition Edge The part of the network that bridges the gap between Information Technology and Operation Technology, where the rich resources available in the cloud are not directly available.

Within IT, the platform must be able to transform the data it collects and push it into the cloud via IIoT standards.

26 IoT Edge Solution In order to seamlessly integrate industrial data into IIoT, a new communications platform is required. Within OT, the platform must understand the various network topologies and data protocols that will be encountered. Within IT, the platform must be able to transform the data it collects and push it into the cloud via IIoT standards. With the lack of computer networking infrastructure in OT, this platform must be embeddable and run within a standalone appliance or an edge-based device where IT and OT converge.

consisting of hardware and software that is responsible for monitoring and/or controlling industrial devices, processes, and events in the

27 OT OT-IT IoT Edge Gateway (M+O) [Challenge #2] Monitoring Optimization IoT Application Monitoring + Optimization IoT App Boundary Router Level 5 Enterprise Level 4 DMZ Operational Process Control Technology Process Information (OT) Network (PCN) An automation Network network (PIN) consisting of hardware and software that is responsible for monitoring and/or controlling industrial devices, processes, and events in the enterprise. Plant Network IoT Edge Manufacturing Level 3 Supervisory Level 2 IIoT Edge Gateway Basic Control Level 1 MQTT CoAP AMQP Safety Process Level 0

per sensor due to open and integrative approaches No risk of availability and safety of installed base Secure Open Enterprise Resource Planning

28 Is current Automation Structure ready for IoT? Additive to existing structures Open for new approaches within Industrie 4.0 Based on existing standards Simple integration of fast changing IT components from field level up to enterprise level Significant improvements of cost per sensor due to open and integrative approaches No risk of availability and safety of installed base Secure Open Enterprise Resource Planning Manufacturing Execution Level Basic Automation Field level Enhancement of existing approaches as a baseline for the efficient and flexible utilization of Industrie 4.0 with the process industry

29 OT NOA IT NOA IoT Edge Gateway (M+O) [Challenge #3] IoT App Boundary Router Level 5 Zone N 2 Enterprise Level 4 DMZ IoT Edge Manufacturing Level 3 Supervisory Level 2 Zone N 1 Basic Control Level 1 Safety Process Level 0

Information Jaap Westeneng Business Development Manager Endress+Hauser B.V. Nikkelstraat 6 1411 AJ Naarden jaap.

30 Information Jaap Westeneng Business Development Manager Endress+Hauser B.V. Nikkelstraat AJ Naarden jaap.westeneng@nl.endress.com T M Plant Asset Management solutions Industrial Communication Technologies

32 Zone B 1 Zone E 1 Zone D 1 Zone M 1 Zone O1 Zone O 2

34 Zone J 1 Zone J 2 Zone C 1 Zone C 2 Zone S 1 Zone Zone P 1 Zone W 1

35 Level 2.5 Level 1.5 Level 0.5 Conduit

39 Router

40 Router

41 Cloud Apps ERP CMMS Historian DCM Patching Analysis EWS OWS 4-20mA HART 4-20mA HART Industrial Ethernet Fieldbus Wireless HART

Future Challenges and Changes in Industrial Cybersecurity. Sid Snitkin VP Cybersecurity Services ARC Advisory Group

Future Challenges and Changes in Industrial Cybersecurity Sid Snitkin VP Cybersecurity Services ARC Advisory Group Srsnitkin@ARCweb.com Agenda Industrial Cybersecurity Today Scope, Assumptions and Strategies