Cloud-based data acquisition system, or secure private network? You CAN have your Cloud and eat it too.

Transcription

1 Cloud-based data acquisition system, or secure private network? You CAN have your Cloud and eat it too. Jon Tandy Elecsys Corporation

2 The Cloud It s Everywhere We live in a Cloud-connected world, with everything from cell phones to coffee makers being connected to the Cloud. Data delivery system = pizza delivery system

3 The Cloud It s Everywhere We live in a Cloud-connected world, with everything from It s Here! cell phones to coffee makers being connected to the Cloud. Data delivery system = pizza delivery system

4 Benefits of Cloud Solutions Everyone seems to want everything connected to the Internet of Things or Industrial Internet of Things (IIoT). Although in some cases this may be more hype than reality, Cloud solutions can provide meaningful value to consumers, manufacturers, and service providers.

5 Benefits of Cloud Solutions The IoT and IIoT promise compelling benefits to the way we work and live, and will change the way companies do business in the 21 st century. Microsoft Azure Many PaaS and SaaS providers offer full-featured and rapid application development platforms.

6 Benefits of Cloud Solutions Some of the benefits of Cloud solutions include: Rapid application development Mature applications and tools Integration of data new business logic, better visibility of company processes

7 Benefits of Cloud Solutions Better informed decision-making Cost savings Increased efficiency Greater productivity, human and business Regulatory compliance and more

8 Challenges More volume and types of data Legacy protocols, diverse communication requirements. Network bandwidth, communication costs, and latency concerns.

9 Challenges Configure, update, program, and manage remote devices. Security Corporate network Cloud platform Devices Data or control capabilities on the remote devices.

10 Example from Oil & Gas Pipelines Transformation from isolated data silos to integrated network infrastructure: Traditional SCADA maintained real-time control and monitoring of operational data. Many isolated pieces of equipment weren t monitored in real-time or at all.

11 Example from Oil & Gas Pipelines SCADA Host

12 Example from Oil & Gas Pipelines Over time, departments within the enterprise recognized needs for data acquisition & analysis. Billing Measurement Maintenance ERP CRM Chart recorder replacement, calibration of sensors, responsive gas quality calculations, etc., etc.

13 Example from Oil & Gas Pipelines They came to the operations department to ask for more data. Often, SCADA said... Sorry, we have a pipeline to operate. Go get your own data. Other business units had to establish their own dedicated poll-response networks to the same sites and devices, communication networks, etc.

14 Example from Oil & Gas Pipelines Analytics ERP SCADA Host Historian Measurement Billing

15 Publish/Subscribe Architecture SCADA used poll-response method to acquire data device reports to one host request. Architectural problem one to one relationship between a device ( thing ) and a host ( app ). Enter the MQTT protocol.

16 Publish/Subscribe Architecture MQTT was invented for oil and gas pipelines... Breaks the 1-to-1 link between device and host. Accommodates a more flexible architecture. Device can publish data so that multiple host systems ( subscribers ) can easily access. Doesn t burden the real-time operations (SCADA) with other enterprise-related data.

17 Publish/Subscribe Architecture MQTT was IoT before IoT was cool! MQTT is now one of the leading protocols for Cloud/IoT/IIoT solutions uses publish/subscribe model, connects multiple devices to multiple applications.

18 Publish/Subscribe Architecture Subscriber Application Subscriber Application Subscriber Application Subscriber Application MQTT Server Publisher Publisher Publisher

19 Publish/Subscribe Architecture MQTT = Message Queue Telemetry Transport Extremely lightweight protocol, designed for low-bandwidth systems Can be used with small, low-power embedded computers. Used by Facebook Messenger for push messaging, ideal for report-by-exception. Can be combined with TLS or VPN encryption, access control lists, etc.

20 Publish/Subscribe Architecture MQTT = Message Queue Telemetry Transport Designed for low latency systems, assured or unassured messaging, efficient delivery. Open standard, built into many different enterprise middleware and Cloud solutions. Highly flexible data payload and architecture.

21 Securing the Cloud But what about security? Can Cloud-based solutions be considered truly secure and reliable for critical systems?

22 Securing the Cloud At the 2014 API Cybersecurity Conference, a panel of three oil and gas industry executives was asked whether their companies were investigating Cloud/IoT solutions. Not in my lifetime. Concern over security is evident.

23 Securing the Cloud Companies who manage critical infrastructure of the country (pipelines, telecommunications, electrical grid, etc.) are responsible for the safety and security of not only their operations, but the livelihood of the nation. To them, Cloud = the Wild West of the public Internet = spam, viruses, & Chinese hackers Or is it?

24 Securing the Cloud Operational Technology (OT) has relied on familiarity of private networks to ensure security and reliability unrealistic with current reality, fails to obtain benefit from Cloud-based solutions. OT can benefit from IT technologies, enable Cloud opportunities without compromising reliability and integrity of critical operations.

25 What is a private network? In the past, SCADA systems relied on dial-up and leased phone lines and privately managed radio networks for communication to field device. Security was assumed (?) based on inaccessibility. Now, dial-up and leased lines are going away, and private radio systems are often too difficult to manage with reduced staff of skilled technicians.

26 What is a private network? Now SCADA is increasingly turning to cellular modems through public carriers (AT&T, Verizon, Sprint), along with satellite in remote locations. Are these private networks? Are they secure, given that they use the same cell towers, satellite dishes, and back-end networks as commercial data traffic?

27 What is a private network? The carriers ensure safety of communication networks, through Dedicated router channels Encrypted MPLS and/or VPN connections End devices may also use encrypted protocols to ensure data integrity over the air

28 What is a private network? Host Application Public Internet Private MPLS VPN TLS encrypted tunnel Cellular Data Network

29 What is a private network? AT&T 5000 employees to monitor network for security incidents and threats (other carriers too). MPLS/VPN connections provide robust security to isolate critical systems from threats existing on the public side of the carriers networks. (But eternal vigilance is the price of security!)

30 What about the Cloud? Compare to Cloud-based solution same IT principles. Secure authentication/encryption from field device to Cloud Secure MPLS/VPN from Virtual Private Cloud to the corporate enterprise. All the benefits of a private network can be combined with the powerful features of Cloud-hosted solutions!

31 What about the Cloud? Host Application Host Application Private MPLS VPN Private MPLS VPN AWS US West Virtual Private Cloud AWS US East Virtual Private Cloud TLS encrypted tunnel TLS encrypted tunnel

32 What about the Cloud? Cloud solution providers (Amazon Web Services, etc.) also employ 1000 s to maintain their infrastructure and to protect the security of their networks. Compare this with the relatively limited IT staffing resources of even the large oil & gas or electric utility companies.

33 Toward a Better Solution Example: A liquids pipeline company wants to migrate old poll-response SCADA system to an MQTT multi-client architecture. First, add edge gateways to interface with legacy field equipment through redundant satellite and cellular modems. Gateways give pass-through access, so existing SCADA polling remains unchanged (100 s of sites, 12-second critical updates).

34 Toward a Better Solution Primary SCADA Host Secondary SCADA Host Legacy passthrough polling

35 Toward a Better Solution Next, implement Cloud-based MQTT server running in redundant Virtual Private Cloud instances. New SCADA is MQTT subscriber to field data (eliminating polling). Access Control Lists restrict remote connections. AWS instances set up or shut down rapidly (15 min.) for deploying test environment in parallel with current polling system.

36 Toward a Better Solution Primary SCADA Host Secondary SCADA Host AWS US West Virtual Private Cloud MQTT MQTT AWS US East Virtual Private Cloud Legacy passthrough polling

37 Toward a Better Solution Security from the Cloud to SCADA is assured through dedicated and secure MPLS/VPN circuits. Device security is assured by using MQTT through TLS-encrypted tunnels, and firewall on the gateway devices. Due to redundancy and high-availability AWS servers, system ran with 100% availability. Pass-through can be phased out.

38 Toward a Better Solution Primary SCADA Host Secondary SCADA Host MPLS VPNs TLS tunnels No more passthrough polling!

39 Toward a Better Solution Gateway device can be entirely blocked from in-bound connection, due to the clientoriginated nature of MQTT. Use permanent or on-demand VPN connection to Cloud for maintenance or realtime diagnostics...no compromise of device-level security.

40 Toward a Better Solution Primary SCADA Host Secondary SCADA Host All connections outbound firewall can prevent any unwanted incoming ports.

41 Toward a Better Solution Primary SCADA Host Secondary SCADA Host Maintenance console/ Programming terminal Host redundancy VPN VPN connection established by remote

42 And many more... Other Industry Examples Tank truck loading stations PLCs, flow computers, monitored at remote sites. ISO/RTO (electrical grid operators) managing solar, wind, battery storage, small generation resources, demand response, micro-grid, etc.

43 Summary Cloud/IoT solutions are ubiquitous and inevitable. Many valuable benefits: Rapid deployment of powerful applications Cost savings, efficiency, analytics Data archival and retrieval Robust and redundant networks architectures Ease burden on company IT resources

44 Challenges Summary Diverse data, protocol, and network requirements Latency, bandwidth, isolated data silos Tight coupling between device & host application Entrenched mindset of private SCADA

45 Summary OT tends to dismiss Cloud benefits in favor of perceived security of traditional networks. However, this perception is challenged in light of the fact that their companies are already turning to IT solutions (VPN, etc.) to utilize public carrier networks.

46 Summary MQTT protocol provides flexible architecture, next generation data acquisition, using low bandwidth publish/subscribe technology. Data gateways can acquire and publish field data for both real-time (SCADA) and other enterprise applications. Device security using authenticated/encrypted VPN and/or tunnels, access control lists, etc.

47 Summary Enterprise reliability and network integrity is secured using MPLS/VPN connections from high availability Cloud servers. Doesn t require large investment in hardware, software, and network management. The benefits of Cloud solutions can be achieved, without sacrificing the security of private networks, by combining IT with OT solutions. You can have your Cloud and eat it too!

48 Questions? Thank you for attending the presentation! Please feel free to visit our booth to discuss further.