Industry Services Continuous protection to reduce risk and maintain production availability Managed Security Service Answers for industry.
Managing your industrial cyber security risk requires world-leading automation expertise Siemens Managed Security Service uses a comprehensive approach focused on securing ICS, including SCADA, DCS, PLC, HMI, drives, and motion control. The specific requirements for security of an Industrial Control System (ICS) differ significantly from the enterprise requirements of corporate IT In a production environment, availability is a key security goal. To ensure uninterrupted production and maximized uptime requires comprehensive protection for people, equipment, and intellectual property (IP). Further, the consequences of successful attacks and infections can be serious and damaging. Health, safety, environmental impact, business sustainability, and other factors are all constantly at risk. A comprehensive security approach to protect your ICS Selecting the right mix of security measures and products is a complex task that requires highly skilled personnel. Add to this, the struggle of keeping up with ever-changing security threats and new regulations. Siemens Managed Security Service helps meet the challenges of protecting your industrial environment so that you can stay focused on your business ensuring reliable, consistent production. Get the peace of mind that comes with our Managed Security Service Meet all of your industrial security needs through a single reliable service provider Siemens the global leader in automation technology and ICS. We will apply our expertise holistically across your entire operational environment, providing a comprehensive solution that is customized to your specific needs. Our Managed Security Service follows a formal process which will include assessment of your current security; identification and implementation of recommended security improvement measures; and continuous monitoring of your ICS operation. America s service partner for industry With more than 1,200 dedicated U.S. service engineers, technicians, and professionals across the country, we can support you where you need us, when you need us, 24/7 We have an uncompromising commitment to safety, environmental, and regulatory compliance at all levels of our business We take ownership of your problems, are committed to the success of your operations, and go out of our way to deliver the best solutions We are a reliable partner and earn trust through our actions Your success is our success 2
With Siemens Managed Security Service your operation will benefit from: Continuous protection through our Cyber Security Operation Center Reduced risk of production loss and equipment damage Ensured predictable and transparent budgeting for cyber security Leverage Siemens industrial cyber security talent and expertise Protection for equipment across the entire operational lifecycle Proactive defense based on global threat intelligence 3
A phased approach to long-term protection for your ICS ICS assets have long lifecycles, up to 20 years. Our Managed Security Service applies a formal three-step approach to address specific aspects of industrial security regardless of whether you are operating a legacy control system with upgraded connectivity or a recently installed ICS. Following implementation of the recommended security measures, we will provide the ongoing service to protect your ICS environment across its lifecycle, allowing you to stay focused on your business. Global threat monitoring Incident detection and notification Design and deploy adjustments to changing threat landscape Step 1: Assess We begin by evaluating the current security posture of your ICS. Potential sources of vulnerabilities are identified through technical evaluation and analysis, forming the basis for recommended security actions. Based on risk analysis conducted by Siemens, you will be able to make informed decisions on the direction of your security architecture. Step 2: Implement Siemens partners with you to systematically put in place all identified measures to mitigate risk in your ICS. Based on the recommendations from Step 1, we deliver comprehensive employee training and certification, deploy new technology, enhance security processes, and establish new security guidelines for the ICS operation. Step 3: Operate & Manage We provide ongoing services for managing and maintaining your security posture against current and potential cyber threats. Our Cyber Security Operation Center continuously monitors global threat activity and translates gained intelligence into the real-time actions necessary to maintainyour ICS security and keep your production running. Architecture assessment Threat modeling Analysis of vulnerabilities and their impact Employee training Process improvement Implement security technology 4
A security architecture tailored to fit your operation Cyber security threats are rapidly evolving and effective defense must provide continuous and comprehensive protection. Siemens Managed Security Service employs a defense-in-depth strategy and focuses on securing the three levels of your operational environment: people, processes, and technology. Risk and Vulnerability Assessment Siemens will help you identify and weigh the impact of potential security breaches in your ICS environment. Using rigorous methodology, we will collect and analyze information concerning your people, processes, technologies, and current security architecture. The assessment will result in an actionable report prioritizing the mitigations and a strategic roadmap for implementation. Training and Competence Management Siemens will increase the awareness and knowledge of the production employees operating and securing your ICS environment. Operator training focuses on industrial security topics, including avoiding unintentional breaches and detecting possible attacks on the ICS. Advanced training for security staff addresses the details of the implemented security measures. We will regularly review your personnel s knowledge level and provide additional training to keep their skill levels up to date. Process Optimization and Compliance Management Working with you, we will design and implement process improvements to optimize your operational environment s security posture, applying industry standards and best practices. Also, Siemens will help you ensure compliance with existing and emerging government regulations. Your overall ICS security program will include documentation of policies, procedures, guidelines and administrative controls. As part of our long-term Managed Security Service, we will periodically re-assess your processes and make the necessary adjustments. Deployment of Security Technologies Successfully protecting your ICS environment requires a defense-in-depth approach which covers all aspects of potential intrusion and unauthorized access. This includes creation of network segmentation and hardening your assets. Further, Siemens will deploy both hardware and software security technologies to protect your assets against the risks and vulnerabilities discovered in the initial assessment. These technologies, along with other technical compensating controls, will provide behavior-based analysis and anomaly detection for network and host-based critical assets. Finally, proactive security measures based on situational awareness models that utilize threat intelligence will be deployed. Regardless of who manufactured your equipment, our service can protect your entire production. 5
Your industrial cyber security needs will be met by a single provider Siemens Partnering with Siemens, an industrial automation leader, to address your ICS cyber security needs will allow you to stay focused on your business, while ensuring predictable and transparent costs for protecting your industrial environment. People Continuous monitoring of security and system status Proactive threat notification based on real-time global intelligence Implementation of security updates to address changing threat landscape MANAGED SECURITY SERVICE P r o c e s s e s T e ch n ol og y Security incident response and resolution guidance Onsite re-assessment of security posture, personnel training and process enhancement Core aspects of the Managed Security Service Continuous protection through monitoring and analysis of security and system status, thereby reducing risk of production loss, equipment damage, and industrial espionage Proactive threat notification based on real-time global intelligence from our Cyber Security Operation Center to protect your reputation and brand image Implementation of security updates to address the rapidly changing threat landscape in order to protect equipment across the entire operational lifecycle of your heterogeneous ICS environment Leverage Siemens industrial cyber security talent and expertise to provide security incident response, resolution, guidance, and execution Onsite re-assessment of security posture; personnel training and enhancement of the security program, thereby complying with current and upcoming industry regulations; as well as reducing the risks of health, safety, and environmental incidents 6
Siemens Cyber Security Operation Center delivers continuous cyber security protection Our analysts proactively monitor vulnerability and cyber threat activity globally, to deliver real-time communication alerts and advisories. When global threat intelligence indicates an elevated risk, the Siemens Cyber Security Operation Center defines and delivers the appropriate proactive defensive measures. If an incident is detected in your ICS environment, Siemens will coordinate the incident response consisting of investigation, forensic analysis, and remediation. Depending on the nature of the incident, remediation will be either automated or performed by a security engineer at your facility. 7
Security information Siemens provides products and solutions with industrial security functions that support the secure operation of plants, solutions, machines, equipment and/or networks. They are important components in a holistic industrial security concept. With this in mind, Siemens products and solutions undergo continuous development. Siemens recommends strongly that you regularly check for product updates. For the secure operation of Siemens products and solutions, it is necessary to take suitable preventive action (e.g., cell protection concept) and integrate each component into a holistic, state-of-the-art industrial security concept. Third-party products that may be in use should also be considered. For more information about industrial security, visit http://www.siemens.com/industrialsecurity. To stay informed about product updates as they occur, sign up for a product-specific newsletter. For more information, visit http://support.automation.siemens.com. Siemens Industry, Inc. 3333 Old Milton Parkway Alpharetta, GA 30005 1-800-333-7421 info.us@siemens.com Order No. CSISS-MSS1-0214 2014 Siemens Industry, Inc. This brochure contains only general descriptions or performance features, which do not always apply in the manner described in concrete application situations or may change as the products undergo further development. Performance features are valid only if they are formally agreed upon when the contract is closed. Siemens is a registered trademark of Siemens AG. Product names mentioned may be trademarks or registered trademarks of their respective companies. Specifications are subject to change without notice.