ARC Forum Orlando 2015 Building a Secure Industrial Internet of Things

Transcription

1 ARC Forum Orlando 2015 Building a Secure Industrial Internet of Things Sid Snitkin Vice-President & GM Enterprise Advisory Services ARC Advisory Group [email protected]

2 Session Overview ARC Presentation of the Issues What s the Industrial Internet of Things? What are the Implications for ICS? What are the Implications for ICS Cyber Security? What s Needed to Secure Industry s Future? Cyber Security Expert Panel Discussion 2

3 What is the Industrial Internet of Things Remote Asset Management/Support Perspective XYZ Company XYZ Company XYZ Company XYZ Company Maintenance Engineering Purchasing Corporate Machine Mfr. Service Provider Enterprise New IoT Analytics and Applications Private Cloud Business Systems Private Cloud Share Asset Data with 3 rd Parties Secure Connection Monitor in-service Products Secure Network XYZ Company Smart Machine IoT Smart Module Local IoT Compute and Communicate module Physical asset with sensors, actuators Plant Operations Emerging Option: Connect Big Assets Using New Technologies 3

4 What is the Industrial Internet of Things Broad Connected Enterprise Perspective Most Industrial IoT Building Blocks are Already in Place 4

5 What is the Industrial Internet of Things The Enabling Technologies Smart, Autonomous Devices Smart Sensors Sending Asset Health/Performance to Remote Sites Intelligent Assets with Embedded Control & Communications Mobility & Ubiquitous Connectivity Use of Wireless Technologies and Mobile Devices Within Plants External Access to Plant Systems and Data Cloud Computing Use of the Cloud for Storing/Sharing of Operational Data Use of Cloud-Applications for Control & Process Improvements Cost and Performance Benefits Will Force Organizations to Exploit All of These Technology Developments! 5

6 What s the Implications for ICS? Today s ICS Landscape 6

7 What s the Implications for ICS? Tomorrow s ICS Landscape Oil & Gas Example Suppliers & Service Providers Enterprise Systems Smart Consumer Devices Cloud Applications Cloud Services Ubiquitous Connectivity Remote Smart Assets Mobile Devices Remote Operations Plants, Factories In-Plant Smart Assets 7

8 IIoT Implications for ICS Cybersecurity? A More Challenging Security Environment Technology Developments Smart Autonomous Devices Mobility and Ubiquitous Connectivity Cloud Computing New Control System Architectures More Integration with External Systems More Dynamic, Distributed Architectures More Reliance on External Services New ICS Cyber Security Challenges Exponential Increase in Attack Surface Increased Likelihood of Attacks Loss of Direct Control of Security Risk 8

9 What s the Implications for ICS Cybersecurity? New Challenges Require New Strategies Mission Scope People Processes Technology Today s Industrial Cyber Security Includes Protect Plants & Infrastructure AIC Systems Private Networks Internal ICS Groups ICS Supplier Service Groups Manage Security at Perimeter Secure Networks Secure Zones Authorize People Manage Software Vulnerabilities Endpoint Security Wrappers Network Firewalls Future Industrial Cyber Security Requires Protect Plants, Infra., External Resources AIC and CIA Systems, IIoT & Mobile Devices, Cloud Private & Public Networks Internal ICS & IT Groups ICS & IIoT Supplier Service Groups Public Networking Services Partners Cloud App & Data Services Partners Manage Security at Device Secure Networks and Messages Secure Zones, Devices, Messages, Data Authorize People & Devices Manage Software & Device Vulnerabilities Secure-by-Design Endpoint Devices Network and Device Firewalls The Future Requires Changes in Every Strategy Element! 9

10 What s the Implications for ICS Cybersecurity? An Expanded Cyber Security Landscape Systems Today s Scope Industrial Control Systems Enterprise Systems OT Cloud & Ubiquitous Connectivity IT Intelligent Assets Mobile Devices Devices 10

11 What s the Implications for ICS Cybersecurity? From ICS to Integrated Industrial Cyber Security ICS Cyber Security 11

12 Issues for the Panel Discussion What s your view of IIoT and its impact on industrial cyber security? What s needed for Secure-by-Design Devices? Who decides/verifies this? How should this status be sustained? What s needed for secure IIoT communications (from the device through the networks)? Who should be responsible for this? How do we ensure that security is being addressed and sustained? Are suppliers doing enough to address these emerging cyber security challenges? If not, what do they need to do differently? 12

13 Thank You. For more information, contact the author at or visit our web pages at 13