Considerations for securing BAS networks

Transcription

1 Considerations for securing BAS networks Updated 25-AUG-2003 Securing a computer system and keeping it secured is more than just a technical problem. Before getting bogged down in IT security issues, let s review some basic non-it security precautions. Assess what it is you are securing. How valuable is the information? What is the likelihood that your system will be comprised? Fort Knox requires high security measures because the gold inside is valuable. The security at a local supermarket can be less stringent. Although the goods are valuable, they are less valuable than the gold in Fort Knox. Assessing the likelihood of an attack requires understanding the local population. A college campus is full of kids with computer skills. An attack may occur from the local population even if it is just mischief. A corporation presumably is filled with employees who want the company to do well and only a subset of the corporate population would have the skills necessary to provoke an attack. Realize that the greatest threat of attack almost always comes from the inside. A disgruntled employee may give up security access codes, passwords, or even unsecured information that allows the attacker to gain access. Changing passwords frequently can be very helpful for these kinds of problems. A loyal employee seeking simply to avoid the IT department bureaucracy may connect his corporate PC to a modem in his office and run PCAnywhere to gain access to his files from home. All security comes down to physical access and knowledge. If the attacker has physical access to the control or IT equipment, and the attacker has sufficient knowledge of how to reset the equipment, he can hack any system regardless of the passwords assigned. IP based systems are more vulnerable to attack than almost any other network type simply because more information (knowledge) and experts are available to the attacker. Page - 1

2 COMMON CORPORATE NETWORK SETUP inside Figure 1 Typical IT Infrastructure Firewalls typically have three interfaces. One interface connects to the outside world (usually a service provider's network that allows access to the ), another interface connects to the company's internal business data network, and an interface connects to a company network that is usually called the "" or "demilitarized zone." The network is used for company systems that are exposed in a controlled manner to the outside world. s usually use Ethernet as the physical media and Protocol (IP); however, other media and network types are occasionally encountered. Using rules that are set in the firewall by the company's IT security staff, the firewall precisely controls the communication and traffic flow between the three networks. The rules restrict or permit traffic flow between hosts based on which of the three firewall interfaces they're connected to, the point from whence a request initiates, the source or destination IP address of a request, time of day, the type of communication they're attempting (e.g., TCP vs. UDP), etc. For example, a user's system on the internal network might be allowed to initiate TCP session with any system on the or but no system on the is permitted to initiate a connection with a host on the internal business data network. Firewalls regulate which services are allowed. Telnet, SMTP, HTTP, & FTP traffic may be allowed to pass, but peer-to-peer file sharing traffic (e.g. nutella) may be blocked. Finally, firewalls allow or block traffic based on the source or destination of the request. For example the firewall might allow SMTP traffic to the server, but not to the web server. A request from a server may be allowed to the business data network, but no requests from the external network () are allowed to the business data network. Page - 2

3 ADDING A BUILDING AUTOMATION SYSTEM If the building automation system (BAS) needs to be accessed from the, IT departments will often choose to locate the BAS system on a network behind the corporate firewall. If possible the best practice is to create a separate network for the BAS. In addition to enhancing network security and security for the BAS system, having the BAS system on a separate network interface reduces the coordination needed between IT, the control system managers, and the managers of other systems on the company's primary when scheduling maintenance, availability and down time. Adds, moves and changes within the BAS network can be made without impacting the other users of the primary which usually include the company's web site and customer facing systems. Secondary inside LonMaker Figure 2 Multi- IT Infrastructure In some cases adding a secondary may not be practical -- a firewall with only a single may already be in place, and it may not be possible to schedule the necessary service outages to add a secondary. Adding a second requires adding an additional [fourth] network interface to the firewall and reconfiguring the network. A fourth interface will require some reconfiguration of the other three interfaces which will require some enterprise-wide system down time. Page - 3

4 USING AN ISOLATION ROUTER An alternative to adding another is to isolate the BAS network within the existing using an isolation router. This approach has many of the benefits of a separate implementation inside Isolation Router LonMaker Figure 3 Using an Isolation Router WHY ISOLATION IS IMPORTANT Whether the BAS is isolated using a secondary or an isolation router, isolation provides the following benefits: The BAS network can be separately maintained since it is isolated. This is beneficial since the people that will work on the BAS network will typically not be the IT staff. The isolation allows the BAS network to be disconnected without scheduling a service outage with IT. Any negative effect on the corporate data network caused by the BAS is mitigated by the isolation router. If the BAS is suspected of causing a problem on the corporate data network, the IT staff simply unplugs the BAS at the isolation router. This will prevent outside access to the BAS until the problem is resolved and the isolation router is re-attached, but will not cause the BAS to stop operating. Any negative effect on the BAS network caused by the corporate data network is likewise mitigated. BAS systems may have response time requirements that are more stringent than typical data networks -- a group of radio users or a high traffic web site might cause traffic bursts that would be disruptive to a BAS. The isolation router keeps that traffic off the BAS segment. The isolation router minimizes the use of visible addresses since the BAS may be isolated behind a single address using network address translation (NAT). Page - 4

5 ACCESS Many BAS controllers, including the i.lon 100 Server, have the capability to serve web pages. Through these web pages users may monitor the status of the BAS and adjust system parameters such as set points, schedules, alarm notifications, etc. Without the protection of a firewall, this level of access, if exposed to the, could pose a security problem. It is not uncommon, for example, for the BAS to control the times when doors are automatically locked/unlocked. If a hacker were able to change that schedule from the, the building could potentially be compromised. Placing the BAS on a secondary or behind an isolation router helps to solve the problem because the firewall can precisely control who may gain access to a BAS resource. This is most commonly done using a virtual private network (VPN). A complete discussion of VPNs is beyond the scope of this document, but simply stated a VPN allows for the creation of a secure tunnel between any point on the external network () and any point on a company s internal network. The VPN software authenticates the user and guarantees the security of the connection through the tunnel using various encryption technologies VPN Tunnel Isolation Router LonMaker Figure 4 VPN Access This architecture takes advantage of the corporate firewall and other security resources already in place to support the company s data networking needs and is often the best choice for integrating control and data. Page - 5

6 CONNECTING DIRECTLY TO THE INTERNET WITHOUT THE PROTECTION OF A FIREWALL If the i.lon 100 Server is to be connected directly to the without the protection of a corporate firewall, the following items may enhance security: 1. FTP, SOAP, web server, dial-in, and RNI access may be selectively disabled. (The i.lon 100 Server s security web page allows you to password protect or entirely disable FTP, SOAP access, web server, dial-in, and RNI) 2. The i.lon 100 Server can communicate through a VPN tunnel using simple VPN hardware like the Linksys model BEFVP41 VPN gateways. See 3. Enable MD5 Authentication. When functioning as a remote network interface (RNI), the i.lon 100 Server optionally uses MD5 authentication with a rolling 128 bit key for communication between it and the LNS Server. 4. A security access reset is required to access the security web page. A security access reset requires physical access to the i.lon 100 Server hardware. Obviously limiting physical access (lock & key) to the i.lon 100 Server is a critical part of securing your system. 5. The i.lon 100 Server is an embedded computer with a real-time operating system (OS). It is not susceptible to many of the Windows specific security issues. 6. Regarding concerns about the LONWORKS devices creating a threat to the IP network, it should be understood that LONWORKS devices speak a different protocol. There is no ability to format and send any IP messages on a native (Free Topology, Power Line or TP-1250) LONWORKS channel. Communications over IP involving LONWORKS devices use a well-defined set of messages controlled by the network interface -- not the devices themselves. Page - 6

7 USING STAND ALONE VPN GATEWAYS To increase security of systems connected directly to the, stand alone VPN (virtual private network) solutions can be used to provide secure IPSec connections between an i.lon 100 Server and a remote client (typically a PC). The two VPN routers work together to create a channel or tunnel such that data transmission between the end points is secure. DSL/Cable Modem VPN VPN Local On Site PC On Site i.lon 100 Remote Monitoring Center There are several cost effective VPN router solutions available such as the Linksys EtherFast Cable/DSL VPN Router (Model BEFSX41). Simple VPN routers can be purchased online or at most computer stores and as of this writing sell for $75 - $125 each. Refer to the owner s manual of your particular VPN device for complete setup instructions. Page - 7