Best practices on cellular M2M deployment. Paul Bunnell November 2014

Transcription

1 Best practices on cellular M2M deployment Paul Bunnell November 2014

2 Overview Installation Security Product Trends Wrap up 2

3 Installation Considerations for installing cellular automation equipment: Cellular coverage and data usage needs Required physical connections (power, Ethernet ports, etc.) Environmental - Wide operating temperatures - Shock and vibration ratings - Mounting options Power consumption Safety, certifications and industry approvals - Examples: UL, CE, ATEX, etc. 3

4 Cellular routers & RTUs have many different security features Unless you are a network engineer they can be confusing There are many acronyms and buzzwords There is not a single security feature to cover all potential issues Depending on security levels used, data usage may go up Configuration can be difficult 4

5 Firewalls Protects the network by keeping unwanted users and connections out Typical cellular router & RTU firewall types: - Access Control Lists (ACL) - Stateful Packet Inspection (SPI) 5

6 Firewalls Access Control List (ACL) Access control lists are rules that are set up to either allow or reject data based upon a specific set of IP addresses and/or ports Specific ports can be set to allow different types of data to pass such as: port 502 for Modbus data or port 20,000 for DNP3 data Can also be used to set up user level permissions such as whether or not a user can change the router s configuration or not 6

7 Firewalls Stateful Packet Inspection (SPI) Determines if data is from an new, known or unauthorized location Rules are established to determine data types that are approved or rejected Each data packet is fully inspected against the rule set and if allowed to pass its information is added to the state table If a data packets location information is already in the state table then less inspection is performed on subsequent transmissions 7

8 Other network security features: Network Address Translation (NAT) - Rules which map several remote assets IP addresses to the public outbound IP address of the cellular router - NAT adds security to these remote assets by hiding their IP addresses behind the IP address of the cellular router or RTU - Each remote asset requires specific mapping for operation Port Forwarding (i.e. Port Address Translation or PAT) - Similar to NAT but, translates a port address instead of an IP address 8

9 Virtual Private Network (VPN) Protects the data through robust encryption methods One tunnel can protect multiple servers and data types at the same time (i.e. Modbus, TCP/IP, DNP3, etc.) Typical cellular router & RTU VPN features: - IP Security (IPsec) - OpenVPN (utilizing OpenSSL) 9

10 Virtual Private Networks (VPN) IP Security (IPsec) Used to protect the security of the data passed through a cellular router to remote equipment Encrypts both the header and body of a data packet to ensure that it cannot be viewed or changed by unauthorized users on the network Internet Engineering Task Force (IETF) manages these suite of security protocols used throughout the network industry All major hardware manufacturers of network equipment support IPsec and support interoperability 10

11 Virtual Private Networks (VPN) OpenVPN OpenVPN is open source software that can provide even more robust security and can be easier to configure than IPsec Uses OpenSSL to encrypt data between the cellular router and the internet - OpenSSL is a free to use set of Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols It utilizes shared certificates to ensure data security between cellular routers and the internet - Certificates are generated to verify access to network data OpenVPN Technologies is a privately held company that develops the OpenVPN software 11

12 Private IP addresses Dedicated IP addresses issued by cellular carriers Protects transmitted data by routing through the carrier network versus through public internet Requires special data plan and is carrier specific Requires a carrier certified cellular router or RTU to use this offering May eliminate the need to configure firewalls and VPN servers 12

13 Product Trends Product Trends Cellular routers & RTUs continue to evolve - More built-in discrete and analog inputs/outputs - Single device that can be deployed on CDMA or GSM networks - Dual-carrier failover - Added control functionality either thru C-programming or IEC programming languages 13

14 Wrap Up Wrap Up When installing cellular routers & RTUs it is important consider the cellular network, data requirements and product features There are many different levels of security that can implement to secure your cellular M2M applications which method to use will depend on a number of variables including infrastructure, data sensitivity and available tools As products continue to incorporate added functionality, you may be able to reduce or eliminate other devices 14

15 There are many different measures that can be taken to ensure the security of your cellular M2M deployments. Which one depends on the application and importance of your data versus network usage and carrier options. Questions? For more information 20 Willow Springs Circle York, PA USA +1 (717)

16 Thank You For more information 20 Willow Springs Circle York, PA USA +1 (717)