Industrial Firewalls Endpoint Security

Size: px

Start display at page:

Download "Industrial Firewalls Endpoint Security"

Julianna O’Connor’
8 years ago
Views:

1 Industrial Firewalls Endpoint Security

2 Is there a need for a new type of industrial firewall? Industries have a huge park of different management and control systems to monitor their production. These monitoring & production control systems are known under the term: SCADA Supervisory Control and Data Acquisition Over the last 10 years SCADA systems have been integrated into Process Control Networks to optimize production.

3 Is there a need for a new type of industrial firewall? Because it is very efficient and versatile more and more SCADA systems are based on TCP/IP as transport protocol. Althought a lot of efforts have been made to keep these TCP/IP networks separate from the Internet, bridges and gateways do exist Cyberweapons like Stuxnet have proven: Production networks are penetrable and vulnerable from the Internet!!!

4 The SCADA security challenge SCADA systems were built with very little respect or none to IT security. In order to reach the goal of optimizing the production and reducing downtime the focus was put on real time data delivery and efficient management. Most SCADA systems show a lot of vulnerabilities or unprotected ports. Due to the increased use of TCP/IP networks for centralized managment SCADA devices became exposed to a new class of security threats they have not been designed for.

5 New security threats to SCADA systems Port scanning Sending false commands Man in the middle attacks Password breaking Viruses/Cyberweapons Motivations: Espionage, Sabotage, Hacking, Cyberwar

6 SCADA security rule number 1: ACCESS prevention STRICT ACCESS controls to any endpoint in the production network. A SCADA firewall acts as solid gate keeper to prevent unauthorized access A SCADA firewall prohibits dangerous attacks by limiting the potential attack vectors to a minimum. The endpoint security device must encrypt all communication between the control-room and the machine its protecting with a VPN -Tunnel

7 SCADA security rule number 2 Secure any endpoint A classical firewall protects a network of users against threats from the Internet In the industry any machine needs to be protected to assure that production is not interrupted The source of the threat is not always outside on the Internet, it can also be an internal threat, coming from the company network

8 SCADA security rule number 3 create multiple barrieres Layer 1 Access Restriction A lot of attacks can be prohibited by shielding the Industrial control units from receiving any packets from unapproved sources. Simple remedies like MAC Address Filtering allows only communications with approved sources. 4 Layer 4 - Malformed Packet Rejection To send malformed Packages is an advanced hacking trick to break in to a machine. 4I Edge devices have an option to only allow normal TCP or UDP traffic to pass through to the end devices. 6 2 Layer 2 - Service/Port Restriction By restricting each defined connection to only the specific TCP or UDP port, the other ports on the TCP/IP stacks are blocked. This provides another layer of defense for viruses, Trojans, worms, and exploits. 5 Layer 5 - Intrusion Detection Alerts 4i Edge devices have the ability to report any kind of rule violation back to any security monitoring systems. 3 6 Layer 3 - Denial of Service Protection 4I systems can detect any unusual increase of traffic. Abnormal bandwidth will be sensed and can be set to be blocked. Layer 6 - SCADA Protocol Filtering We are providing Modbus TCP protocol filtering for 4i Edge on request. 4i Edge: Multi layer security VPN endpoints

9 Industrial security devices must have specialized features Must provide various access controls tools Needs to support a wide range of industry standard VPN protocols to assure compatibility with existing VPN concentrators Must provide multi layered defence and detect threats that are coming from the network. ( Firewall + Stateful Inspection + IDS System) Should understand SCADA protocols (like modbus*) to detect unauthorized commands and identify their source Should have a remote management options for update and reconfiguration * on request = Endian 4i Series

10 The Endian 4i Productline Endian 4i is a complete multilayered security system for the industry VPN Endpoint security devices VPN-Concentrator and Access-Server Classical UTM appliances for the gateway protection A complete management solution for all distributed devices and VPNs

11 The Endian 4i Industrial Protection Concept Endian UTMs appliances as gateway and perimeter security Endian 4i edge device to protect any single endpoint Endian Access Server as VPN concentrator and secure switchboard connects from any Internet enabled device into your SCADA device. The Endian Network allows you to monitor and manage all Endian applinaces from one place Endian drop in: Any 4i device can work as standalone and blends into existing infrastructure.

12 Endian 4i industrial protection create multiple barriers restrict access protect enpoints detect intrusion separate zones encrypt communication connect securely = unlimited nummer of VPNs = complete protection = software maitenance included

13 The Endian edge devices 4i Edge 200 An extremely powerful and scalable officesolution ideal for remote locations with more than one VPN Highlights: Metal body, fanless Low Power (< 5W) Recommended for: Infrastructure Healthcare Communications 4i Edge 300 The perfect industrial security solution suited for using in remote locations that are not temperature sensitive. Highlights: DIN Rail, fanless 24VDC Power Recommended for: Machine Building Manufacturing Infrastructur 4i Edge 500 Our most powerful and ruggedized industrial solution which works in extreme temperature environments. Highlights: -40 to 70 C Temperature DIN Rail, fanless 12/24/48VDC Power Recommended for: Machine Building/Manufacturing Infrastructure/Communications Healthcare

14 The Solid Gate Keeper Endian UTM appliance Internet Gateway Stateful Inspection Firewall Intrusion Prevention VPN Gateway Contenfilter Anti Virus Anti Spam Mail Security Surf Protection Routing /Bridging QoS, Traffic Shaping Application Level Gateway

15 The Secure Matchmaker Endian 4i Access Server Remote Access: Supports all relevant protocols for VPN Network communication (OpenVPN, IPsec). Intuitive Web Interface: A single interface to manage the remote access of Engineers, Partners or Customers. Rule and Role based Management: Allowing the network manager to control finegrained access rights to machines and applications. Mobile Connectivity: Provides access from the next generation of mobile devices like iphone, ipad, Android. Scalability: Offering access for up to thousands of devices, the 4i Access Server scales with your needs. Support for load balancing and failover systems ensures extremely high availability.

16 The Endian 4i Solution Endpoint Protection: 4i Edge VPN Management: Endian Access Server Gateway Protection: Endian UTM Endian 4i... Complete multilayered SCADA security. Device Management Endian Network 4i BYODprotection

17 Endian 4i built for the future of the industry Future proof...over 1 Mil Downloads of Endian firewalls ensure that Endian 4i is ready for latest security threats comming from the Internet. Easy to deploy...with easy drop in and 4i software update through Endian Network, deploying hundrests of VPN endpoints turns out to be lightning fast. Easy to manage....thanks to 4i's easy to unterstand web interface, quick VPN setup wizard and fast disaster recovery, managing IT security has become a lot easier.

18 A complete solution to SCADA security

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with