INDUSTRIAL NETWORK RESILIENCE. Davide Crispino Salvatore Brandonisio

Transcription

1 INDUSTRIAL NETWORK RESILIENCE Davide Crispino Salvatore Brandonisio

2 Cyber Attacks: A risk among the most feared At the World Economic Forum 2016: «Cyber Attacks are considered to be one of the highest risks for the economy in terms of IMPACT and PROBABILITY» 2

3 Does this concern the industrial world? 1980s 1990s 2000s Today Fieldbus with proprietary protocols Standard PCs with Windows operating system come into operation as HMIs, SCADA systems, and so on Increasing demand for connectivity to the production network Industrial networks are increasingly based on Ethernet (Profinet, Ethernet IP, etc.), with a homogeneous communication medium from MES to field network

4 What drives someone to attack? ¼ of the attacks to the Industry are for espionage Industrial espionage Protecting your plant is a necessity Fonte: Rapporto Clusit 2014, dati Fastweb

5 Threats are internal or external? (Former)employees, (sub)contractors, service "Attacks" are not always intentional

6 Risks: USB Mass Storages Devices «My network is not connected to the Internet so security is not an issue for me» Employees or external technicians who access the network could introduce malware inside the network via USB memory or through service PCs

7 Risks: Unsupported O.S. The life cycle of a machine or an installation often exceeds 20 years. Operating Systems manufacturers may cease supporting such systems before the end of the machine's life cycle (eg. Windows XP) System security is no longer guaranteed and the risks associated with Security increase a_ eps

8 Risks: No antiviruses Anti-virus programs are not always used by IPCs to protect the production system Antivirus programs can significantly affect the real-time installation properties. Also, once installed, they should be continually updated... but compatibility issues can arise! Virus

9 Risks: Remote access Communication takes place through a secure VPN tunnel and no further Security measures are taken VPN Tunnel Risk LAN Malware present on one of the two networks could travel through the tunnel and infect the second one Plant LAN Service

10 Risks: Service Technician The end-user of the plant has a global network that integrates different machine networks from different vendors Machine A Access Machine B The service technician of a specific plant part could also access all other items on the same network Service technician of the plant End-user LAN

11 It is not a question of whether, but when

12 Industrial IT soluzions «Zones & Conduits» approach: ANSI/IEC Vulnerabilities must be made unavailable without affecting the normal operation of the plants Divide the industrial network in separate "Zones" The zones communicate with each other using only the previously identified "Conduits" All incoming / outgoing traffic from a conduit is protected by firewalls or dedicated systems that guarantee the integrity and confidentiality of communication (eg VPN) This approach is also suggested by ICS-CERT and the ISA99 standard

13 «Zones & Conduits» : an example Remote Service Zone Customer Monitoring System Remote Service DMZ SIEM System Zones Local HMIs Remote HMIs Customer DCS IPS/IDS System CIFS: Internal Check Icons designed by Freepik

14 Phoenix Contact Approach Zones Single Stealth Subnet A Multi Stealth Subnet A Router Mode Ease of integration within existing networks The apparatus can operate in layer 2 No modification to the IP address plan is required The apparatus can operate in layer 3 if the network features require it Blocked traffic can be logged for postintervention analysis DPI supported on Modbus and OPC traffic Subnet A Subnet B

15 Redundancy: Path, Firewall & VPN Automatic switchover management for dual link path models (WAN->3G_1->3G_2) Two distinct mguards can always be connected in redundant mode Redundancy can also be guaranteed for VPN tunnels! The status of the connections is updated continuously so that there is no interruption in the case of switchover Additional licenses to enable redundancy can be purchased separately (Fw Redundancy or Fw+VPN Redundancy)

16 Centralized management mguard Device Manager (MDM) Configure and update all your mguard devices Centralized configurations Centralized firmware update Simple Template Based Configurations Centralized Licensing Works both on Intranet and Internet Push / Pull mode for sending data Supports multi-user Supports different "user rights"

17 CIFS Integrity Checking No software installation is required on the system to be protected At the initial scan, an encrypted database is created that contains the hashs of all the files in the target system Cyclically scans all accessible directories and compares the results obtained with those of the initial scan CIFS IC automatically detects all changes made to files (delete, create, modify) under control Detects 0-day vulnerabilities LAN WAN Rileva ogni cambiamento del File System!!

18 Remote Access via Internet The «Secure Cloud Public» solutions Machine Builder / Service Technician Maximum availability Service - VPN VPN: online Service Gateway (virtual) Plant by the End-User Secure Cloud App Routing & Management VPN: online Machine VPN Machiner Gateway (virtual) Reachable through a real IP address Firewall friendly Ipsec with port selection (es: TCP 443) and Proxy support

19 The complete In-House Solution Technician on travel Remote Plant n.1 VPN tunnel Machine Builder Office mguard Star Center Internet ADSL Router Remote Plant n.2 MachineSelector Web Server (VM) Public IP address or active DynDNS Remote Plant n.3 With the Remote Service plants can be accessed with real IP! Remote Control and Remote Service can work together!

20 ICS Security platform: SilentDefense

21 Features

22 Benefits

23 Industrial Threat Library (ITL) Currently 80 checks, extended at every release Checks divided into three categories Networking: detect device and network misconfigurations Operations: detect problems and threats to the industrial process Security: detect security threats and vulnerabilities

24 We deliver full cyber-resilience SilentDefense provides the ability to identify and quickly recover from threats to business continuity OPERATIONAL PROBLEMS NETWORKING ISSUES CYBER- SECURITY The only solution that protect industrial networks from any threat

25 Please, visit us at our Desk