Securing Manufacturing Control Networks. Alan J. Raveling, CISSP November 2 nd 5 th Pack Expo 2014

Transcription

1 Securing Manufacturing Control Networks Alan J. Raveling, CISSP November 2 nd 5 th Pack Expo 2014

2 As Internet-enabled technologies such as cloud and mobility grow, the need to understand the potential security risks and best practices becomes more necessary. WHY?

3 Agenda Understanding Industrial Firewalls, NAT, IDMZ VLANs I/O Networks Security

4 Defense in Depth

5 Industrial Standards for Manufacturing Networks The nice thing about standards is that you have so many to choose from. ~Andrew Tanenbaum CPwE collaborative effort between Rockwell & Cisco Converged Plantwide Ethernet ISA 99 / IEC NERC-CIP North American Electric Reliability Council Critical Infrastructure Protection NIST 800 series

6 Why multiple standards? Industrial Standards for Manufacturing Networks Different audiences o Government agencies o Public utilities o General manufacturing and industry Different priorities in design philosophy o Confidentiality / Integrity / Availability Different goals o Comprehensive requirements o Guidelines and/or best practices

7 What is in common? Industrial Standards for Manufacturing Networks Good technical common sense Separation of networks Deploy firewalls Separate safety systems Security-focused design considerations Multiple layers of defense

8 Industrial Standards for Manufacturing Networks I ve read and implemented CPwE and/or IEC 62443, now what? Consider industry/regulatory compliance How do corporate policies mesh with plant-side standards and implementation? Re-evaluate environment risk & determine if additional security measures are needed

9 Manufacturing Firewalls Firewalls vs NAT Firewall only predefined network traffic may pass Cisco ASA 5500 series NAT (Network Address Translation) Communications with external networks are conducted with the NAT appliance acting as a go-between Stratix 5700, Rockwell 9300, Rockwell 5900 series Two types of NAT o One to One addresses on network A corresponds to addresses on network B ( maps to , maps to , etc.) o One to Many single address on network A transfers all traffic from network B (traffic from , , etc. is all sent through ) Some firewall devices can perform NAT tasks and vice versa

10 Manufacturing Firewalls Why use firewalls? Prevent bad traffic from reaching devices Provide separation between untrusted networks Control over type of communication allowed between networks and devices VPN access to networks Restrict user access to networks

11 Manufacturing Firewalls Why use NAT? Communication with the rest of the plant for identical line networks Network isolation for legacy devices Multiple devices need to communicate on a network with limited address space

12 Where to use a firewall or NAT Manufacturing Firewalls Firewall locations External connection point to external networks, like the Internet Internally between untrusted networks Inline when need to tightly control communication allowed to a device NAT locations Internally between private networks Internally skid connectivity

13 Manufacturing Firewalls Understanding firewall rules Any:Any is not a good rule Source : where the traffic came from Destination : where the traffic is going to Type : TCP / UDP Port : used to specify the service/application By default firewalls arrive with deny all Multiple rules are chained together to accomplish security goals One misconfigured rule could render all effort useless

14 Manufacturing Firewalls Providing secure access through a firewall Require users to utilize a VPN Can be standalone client or web-based User should have unique username/password Do not route all remote connectivity through firewall Only access to specific networks

15 Manufacturing VLANs VLAN (Virtual Local Area Network) Stratix 5100AP, 5700, 5900, 8000, 8300 Why split networks into VLANs o Create multiple broadcast domains (CIP traffic) o Segregate network communications based on purpose e.g. I/O, general PC communications, PLC, VOIP o Allow for multiple isolated networks without purchasing networking equipment for each

16 Manufacturing VLANs What devices should be in an Industrial DMZ vs Controls Networks? Use Industrial DMZs for o Devices that interact with enterprise & manufacturing networks o Access by untrusted/unknown personnel o Creating a buffer zone between different network segments

17 Manufacturing VLANs Should the Controls Network have direct Internet access? No. Utilize the IDMZ for data that needs to be accessed from outside the facility Utilize the IDMZ to hold data requested by controls network devices Do not utilize a laptop with two connections to reach out to the Internet

18 I/O Networks Why I/O networks should be separated from the Controls LAN? Data is more sensitive to delays Devices may not handle weird network traffic Limit broadcasts messages to a I/O specific VLAN Prevent unnecessary equipment from communicating with I/O

19 I/O Networks How do I access my I/O network if it is isolated? Designated programming/troubleshooting ports on switches VPN connection to I/O network firewall

20 Security Security is not limited to just the network Apply FT Security to I/O, applications, PLCs Encryption on PLCs (ControlLogix) User access controls via Active Directory / FactoryTalk Directory

21 Security Physical Security Disable Ethernet ports on network switches Keep switches in locked cabinets/closets Access control to areas Personnel policy of how/when to connect to the controls network

22 In Summation The need for data to flow to multiple locations has caused plant networks to become increasingly complex Use multiple networks to partition network traffic based on function Utilize managed switches, NAT appliances, firewalls to provide the necessary access, protection, and routing to devices Do not go it alone work with experienced professionals to ensure it is set up correctly and securely

23 That s It! Please feel free to ask questions. Nathan Bullock and I will be available for questions and discussions.