Secure Networking for Critical Infrastructure. Ilan Barda March 2014

Transcription

1 Secure Networking for Critical Infrastructure Ilan Barda March 2014

2 RADiFlow as part of the RAD Group The Access Company Secure Ruggedized Communication Solutions Wireless Mobile Backhaul Group Distributor in Israel Sub-6GHz Wireless Backhaul 2012 Sales = $1.2 Billion Main applications: Telecom - Fixed & Mobile Utilities & Transportation Government & Enterprise About 4,000 Employees Integrated Application Delivery Network Test Solutions CWDM and DWDM Solutions Hi-end Adapters for Servers - 2-

3 Smart Utilities Applications Utilities deploy Distributed Automation applications over a large-scale network of Ruggedized Ethernet switches Such networks are exposed to cyber security attacks - 3-

4 Protecting Distributed SCADA from Insider Attacks Attack vector Control-Center malware Field-site breach Man-in-the-Middle Remote maintenance Security Measure Service-aware firewall Distributed firewalls Encryption Secure remote access Control Center HMI Engineering Station Controller1 Controller2 Dev1.1 Dev1.2 Facility1 Dev2.1 Dev2.2 Facility2

5 Firewall use-case RTU software update The technician laptop infects the Engineering station in the control center The Engineering station downloads new software to the field RTUs DNP3 distributed firewall programmed to allow only access to parameters address ranges during normal operation Stuxnet scenario can be prevented using distributed service-aware firewall Eng. Station Control Center S.S. RTU Technician Sub-Station IEC61850 IEDs Facility RTU - 5-

6 VPN over public network Connecting private sub-networks over a public network Remote site connection using Hub & Spoke GRE tunnels IP Sec used to encrypt the GRE tunnels Certificates used to authenticate remote parties L2 or L3 VPN modes available IPSec tunnel Primary SIM ACTIVE INTERNET NAT router Cell site ISP #1 IPSec tunnel OFF Secondary SIM Cell site ISP #2-6-

7 Integrated security in a Ruggedized switch Service Management Operational Simplicity Secure Access Service Validation Defense-in-depth solution Multi- Service Resilient Network Ruggedized System Solid infrastructure - 7-

8 3180 Secure Utility Gateway 8/16xETH 10/100BaseT 4xRS-232 Dual-SIM 2G/3G Cellular modem 2+2 Discrete I/O ETH switching & IP routing SCADA security tool-set SCADA Gateway - 8-

9 Focus applications Power T&D (Smart-Grid, Sub-station automation) Smart-City, Safety and Security Intelligent Transportation (Railways, Highways) Drilling and Pipelines (Water, Oil & Gas)

10 Growing Install-base - 10-

11 Case Study Consolidated Smart-Grid network Mix of fiber and cellular backhauling Regulation for Separate VPNs for AMI and DA Implementation highlights Service-aware VPN functionality SCADA firewall Fiber or cellular uplinks Service-aware QoS for cellular network Serial interfaces with protocol gateway Zero-touch provisioning for mass deployment - 11-

12 Large scale transportation control network Large-scale transportation control applications require Ethernet rings for access to backbone Mixture of Ethernet, Serial & Discrete devices PoE support for CCTV cameras IEEE15888v2 support for radio clock synchronization QoS and SCADA firewall for secure and reliable access to the critical automation services Message boards RS-232/485 Traffic control QoS Security cameras PoE Tetra base stations 1588 clock sync Remote site Ring 1 Ring 1 Ring 6 Ring 6 Central site 1588 clock - 12-

13 Summary Modern critical infrastructure deployments use Ethernet Intra-network security is mandatory RADiFlow Service-aware Industrial Ethernet solution Unique distributed service-aware firewall by the network Integrated defense-in-depth tool-set Optimize CapEx and OpEx For more details: