The Road to Industry 4.0. Secure Industrial Visibility

Transcription

1 The Road to Industry 4.0 Secure Industrial Visibility

2 2 The Road to Industry Current situation Industrial digitization is a global trend. It gives insights to production, it reduces pro duction costs by optimizing machine performance, and furthermore it allows for optimization of the next machine generation based on machine usage and behavior. With the increasing connec tivity of machines, the risk of industrial espionage and cyber attacks that target the production environment is growing rapidly. Attacks are highly sophisticated and often start with simple social engineering or USB flash drives that are brought into the production environment for machine updates that contain hidden malware. INNOVATE Industrial machines cannot be protected by antivirus software as an update might have an impact on the machine software. Moreover, the operating system of an industrial machine is often outdated or simply not patched. This is because the lifetime of a machine is much longer than that of an OS. Existing machines are not designed to be connected to the internet and do not follow any security-by-design rules. Lastly, machine builders und users often have only limited IT know-how. SERVICE TRANSFORMATION FROM REACTIVE TO PROACTIVE SERVICE MATURITY Main use cases diagnostics and monitoring Speed up problem resolution. They allow collection and analysis of diagnostic data for effective problem resolution and efficient operator assistance. System updates Keep your system up to date (firmware, software) with new software as well as adoptions and updates. System (re) configuration is supported. maintenance Enhances preventive maintenance planning, e.g. with periodical screening of the system with condition checks to plan preventive action. Supports future-oriented business models for condition-triggered or predictive maintenance. Performance reports Help to improve processing efficiency via reports on system utilization. Performance management Ensures optimal system operations by analyzing relevant machine data and provides expert consulting for optimal system adjustment and usage. THE ROAD TO INDUSTRY 4.0 Active machine protection s your production environment with top-level IT security that is always up to date. Ideally every single machine is protected via micro segmentation. lifecycle (very long) and security lifecycle (very short) are decoupled. Trusted identification All your connected machinery is equipped with its own unique hardware-based ID (smartcard controller). Supports machinespecific quality assurance, monitoring, etc., and further use cases such as product ID management. MANAGE CONNECT Level 1 Unconnected Fight fires Limited product feedback High cost of service Slow reaction time Level 2 Connected access as allowed Fragmented information Reactive response to issues Level 3 Serviceable access as needed Some proactive monitoring Service cost avoidance Level 4 Intelligent Monitor and report on services View and analyze product data Electronic software delivery Level 5 Optimized Enterprise integration Configuration and warranty management Pay-per-use models/billing integration Predictive maintenance Web applications Level 6+ Differentiated New revenuegenerating capabilities Cloud-delivered customer applications Replenishment management ly control products Compliance and audit reporting Mobile integration Cloud-to-cloud-tomobile mash-ups Optimized Construction Optimization Data Analytics SECURE INDUSTRIAL VISIBILITY System Updates Diagnostics ion Performance Reports Effective Maintenance Performance Management Trusted Identification SMART FACTORY Smart Smart User/Policy Management

3 4 The Road to Industry Secure remote management and protection for industrial machinery Manufacturers need to secure the interaction between machines, production control systems, and people on a global scale across machines, shop floors, and entire production sites. The main challenges are access and access rights management as well as the protection of the company s core assets such as intellectual property and product-specific or process-specific know-how. Based on the unique identity of every single machine and component, only authorized entities can gain control to exchange data or enter commands. G+D offers high-level pro tection and secure remote machine management in combination with cloud services and transparent policy management. The G+D solution supports industry IT with high-end security as well as future-proven machine service and maintenance for existing and upcoming machinery. The solution already meets the high security requirements for remote management in industrial environments (BSI CS-108) of the German Federal Office for Information Technology (BSI). INDUSTRY CUSTOMER GIESECKE & DEVRIENT MACHINE MANUFACTURER Solution components (cyber-physical system) Security Portal is protected with strong two-factor authentication. It is the entry point to all remote services that are hosted on the Secure Cloud. It is also the entry point for your own staff, your customers, and all your business partners. The access is restrictive and person-based. Policy Management enables fine granular rights management for access control. It offers absolute flexibility in access policy configuration, e.g. for individual machines, machine groups, or entire machine parks. It is fully controlled by the customer (on-site access only). Integration into existing enterprise IT is also possible. Secure Cloud is a high-security data center (G+D, Munich, high-security area). It implements various security measures like firewalls, IDS (Intrusion Detection System), SIEM (Security Information Event Management), etc. It delivers the solution as a service and strong two-factor authentication. facilitates answers to support requests in close to real time. It enables problem analysis and often resolution without a service engineer being on site. System monitoring supports conditiontriggered or predictive maintenance. The customer has full control over any remote access activities. offers the latest security solutions and network security. It is designed for industrial systems and environments. It provides security without side effects and without impacting machines, systems, or production processes. It allows for micro segmentation or full stealth (100% transparent) mode. It is IPv6 compliant and permits IPv4 to IPv6 translation. It also supports protocol translation (e.g. FTP to SFTP). Crypto Module supports with highly secure hardware-based crypto functions (signature, encryption, decryption, key generation, etc.). It supports application uploads, updates, etc. All state-of-the-art crypto algorithms are supported (DES, 3DES, AES, ECC 521, RSA 2K (4K), etc.). It comes with an up-to-date Java Card 3.04-based smartcard operating system. The module is certified according FIPS level 3. Anomaly Detection allows local, machine- and data-specific anomaly detection in addition to. It monitors network behavior based on a self-learning system. It includes compliance and policy verification as well as botnet and hidden command detection. It is fully controlled by the customer and allows for additional server-based detection (e.g. on site level). Service Hotline provides 24/7 administration and application support. It helps users with all questions regarding authentication, Online Portal, Secure Cloud, Applications, etc. It is also the 1st level of security service and the support line. Advanced Security Service provides advanced security lifecycle management. It is the 2nd/3rd level of security service and supports the user in all security-related topics. It is responsible for penetration tests for components and complete solutions. It provides frequent security reports and covers vulnerability management. It also provides validity checks for all certificates used. The security update enrollment process is also covered. Integration Service provides the customer with system integration and support with regard to connectivity, tool integration, data collection, and automated interaction (software updates, enrollment processes, machine controls, enterprise integration...). Policy Management Anomaly Detection Highly secure access Fine granular policy management Fully customer controlled Without side effects Highly secure connectivity Invisible to the internet TLS tunnel Micro segmentation or stealth mode Secure Cloud Advanced Security Service Administration Hotline Security Portal Integration Service Security as a service Highly secure data center Layered security architecture Authentication services Encrypted data (internet) Encrypted data (industry internal) Industrial remote management according BSI CS 108 Technical Service Hotline Management & Support Service Technician Service portal Manufacturer-independent partner portal Authenticated service staff Access to authorized machines Anytime anywhere paradigm

4 6 The Road to Industry Solution benefits Innovative remote service and protection Minimize your TCO (total cost of ownership) by decoupling machine and IT lifecycles. There is no need for any major investment in security expertise. Legacy systems are supported. Reduced service time and costs (e.g. travel expenses). Faster reaction times due to real-time reports. Increase protection with up-to-date and future-oriented cyber protection. The solution also helps prevent data leakage. Manage multiple sites with a cloud-based platform that makes it easy to apply policies consistently regardless of location. Multiple service partner management (multi-tenancy) is supported. Gain visibility and control of usage with detailed insight across all your customers, locations, and installations. Generate auditable logs. your remote and roaming staff by making it easy for them to work safely outside your network no matter where they are (browser based, no VPN client). Enable new business models (usage based, outsourcing of production ). Enable new services for quality assurance. Usually remote service for industrial machines is still done via VPN connection as is the case for office PCs. This supports no granular access control and allows for no host compliance checks, for instance. Further, it requires specific VPN client SW and administration, which has an impact on the machine. The IP address is usually visible to the internet, and therefore prone to web-based DDOS attacks, for example. The G+D solution sets up a secure tunnel between two end points. It supports transparent and fine granular access control and host compliance checks (e.g. whether the virus scanner is up to date, etc.) without any impact on the machine. It only requires a standard internet browser on the client side. Furthermore, the IP address of the connected machine is invisible to the internet. connections via internet are only possible from inside to outside. This industry-grade solution always comes with the very latest security regardless of how old the connected machine is. With this solution the machine gets its own secure ID, which can be used for various purposes. The solution is ready for integration in enterprise systems such as SAP. The solution supports the collection of data via one-way connection, while different data sets can be provided to different parties depending on policies. This data will also be analyzed to improve the next generation of machines. This solution also serves as a basis for considerable improvements to machine availability since it significantly reduces service time and increases throughput. The machine user manages the policies, which gives this person full control of all activities performed on the machine. The solution also enables secure remote access (one-way communication) to the machine OS or device appli cation. It supports interaction (two-way communication) between a back-end system and an application (e.g. if the machine reports an alarm, the back-end system specifies how to respond ). is the road to Industry 4.0! Solution elaboration In 2011 G+D started elaborating remote services for its own banknote processing machines, which are used all over the world, mainly in central banks. Today this is offered as a global service for more than 50 customers. This solution is independent of vendor and machine manufacturer, and is therefore suitable for use with all kinds of machine types and valuable IoT devices that connect to the internet. FUTURE DIGITAL AWARD for Best Technology/Platform

5 G+D Mobile Security: Your trusted partner for identity management It s a long way to becoming a trusted identity service provider. Don t go it alone. G+D Mobile Security is part of the G+D Group with more than 11,000 employees worldwide. Our staff of 5,800 experts in over 50 sales offices is glad to advise and support you with years of experience and comprehensive solutions that let you meet the challenges of a connected production environment and capitalize on its opportunities. Visit our website: Giesecke+Devrient Mobile Security GmbH Prinzregentenstrasse Munich GERMANY Phone: mobilesecurity@gi-de.com Subscribe to smart! Our online magazine. Giesecke+Devrient Mobile Security GmbH, 2017 Subject to change without notice. Follow us on: Stockholm Helsinki San Jose Mexico City Twinsburg Montreal Toronto Dulles Atlanta Bogotá Moscow London Warsaw Neustadt Prague Paris Nitra Milan Munich Rome Madrid Istanbul Peking Barcelona Seoul Tokyo Casablanca Huangshi Shanghai Cairo Dubai New Delhi Nanchang Mumbai Chennai Hong Kong Manila Bangkok Singapore Jakarta Rio de Janeiro São Paulo Buenos Aires Johannesburg Melbourne Sydney