The Need to Be Innovative and Agile Bridging the IT/OT Divide Using Software-defined Solutions
IT & OT Think & Behave Differently IT View We run the network OT is the wild, wild west OT doesn t understand the security risks they can cause We need to put it into the plan I must keep on top of the latest tech to operate and protect our services My language is routers, switches, VLANS, TCP/IP, etc. OT View We run the company IT doesn t respond to our needs IT doesn t get that customers won t be served if we can t respond I need it now I work on equipment that has 10, 20, 50 year life expectancies My language is SCADA, PLCs, Modbus, LonWorks, etc. 2
Here s the Challenge Network complexity has gotten out of control. 3
Here s the Challenge Networks are under constant attack. 4
Here s the Challenge Networks are highly prone to human errors. 5
Here s the Challenge And networks are horribly expensive to operate. 6
Data Breaches Are Commonplace Data breaches are occurring with greater frequency Target, Home Depot, JPMorgan Chase, Sear, etc. Alarming Gap in Critical Infrastructure Security Cyber attacks on physical infrastructure such as water, gas, power, transportation, and manufacturing is growing too Espionage breaches growing faster than financial events Verizon Data Breach Investigations Report - 2014 70% of critical infrastructure organizations reported at least one breach in the past 12 months Unisys Research July 2014 7
Industrial Networks Can Be Easy to Hack What is secure today is unsecure tomorrow. http://www.shodanhq.com http://www.metasploit.com 8
WW III Likely to Happen Over the Internet Russia accused of installing a cyber weapon on a U.S. firm s servers that stores military secrets. Oct 28, 2014
It Gets Even Worse Legacy applications need to be integrated. And 100B new IoT devices to be connected. 10
A Software-defined World Can Bridge IT/OT Divide 11
Software-defined Anything Software-defined datacenters Software-defined servers Software-defined storage Software-defined security Software-defined networks
Software-defined Defined In a software defined world, Infrastructure is abstracted from the underlying HW, generally through virtualization or overlays, while underlying resources are pooled, and everything is Managed via software single pane of glass 13
Why Software-defined Networking? Infinitely more flexible Independently improve software and hardware Leverage low-cost, commercial-off-the-shelf hardware Consolidate multiple, independent devices into software Simpler, more efficient, lower cost Capable of micro-segmentation 14
Business Needs Remote connectivity to gain visibility and improve efficiency Secure the industrial infrastructure Segregate accessibility from external & internal threats Improve business continuity, e.g. disaster recovery Gain access to devices for Big Data analytics 15
A Typical IT Network Architecture Vendor Support WAN Remote user Vendor Support Perimeter Network E-Comm Web Services IDS RAS Modem Modem HMI SCADA BMS 16
Agility & Innovation Via Software-defined Software-defined Networks & Software Overlay Networks. 17
Software-defined Network Application Layer Business Application Business Application Datacenter Centricity Control Layer API SDN Software Controller API Network Services API Control-Data Plane I/F Infrastructure Layer Network Device Network Device Network Device Network Device Network Device 18
Virtual Network Network Within a Network Application Layer Business Application Business Application Virtualized Overlay Network Software Layer Abstracted Network API API Network Services API Infrastructure Layer Network Device Network Device Network Device Network Device Network Device 19
Virtual Network Software-defined WAN Virtual network fully abstracted from physical network Software-based creates Networks within a network Micro segmentation of the network Isolate ICS network from IT Network Integrate legacy applications and devices Co-exist within IT security policies Adaptable to public, private and hybrid clouds 20
SDN/WAN & Overlays Simpler to provision & manager Cheaper to operate Lower cost bandwidth Faster performance Dynamic and automated configuration More Secure Augment vs. rip & replace 21
A Typical IT Network Architecture Vendor Support WAN Remote user Vendor Support Perimeter Network E-Comm Web Services IDS RAS Modem Modem HMI SCADA BMS 22
IT/OT Example Home Office demonstration 01.distrix.net Distrix Office 129.168.1.190 UDP 24444 UDP 24444 LoadBalanceSF LoadBalanceNY PLC 10.202.0.52 Distrix Lab Demo RS232 Distrix PhysSec Demo M0 23 M1
Extending the IT Network Home Office demonstration 01.distrix.net Distrix Office 129.168.1.190 UDP 24444 UDP 24444 LoadBalanceSF LoadBalanceNY PLC 10.202.0.52 Distrix Lab Demo RS232 Distrix PhysSec Demo M0 M1
Creating a Software Overlay Home Office demonstration 01.distrix.net Distrix Office 129.168.1.190 UDP 24444 UDP 24444 LoadBalanceSF LoadBalanceNY PLC 10.202.0.52 Distrix Lab Demo RS232 Distrix PhysSec Demo M0 M1
Forming Node-to-Node Trusted Network Home Office demonstration 01.distrix.net Distrix Office 129.168.1.190 UDP 24444 UDP 24444 LoadBalanceSF LoadBalanceNY PLC 10.202.0.52 Distrix Lab Demo RS232 Distrix PhysSec Demo M0 M1
Forming a Tunnel on Top of the Overlay Home Office demonstration 01.distrix.net Distrix Office 129.168.1.190 UDP 24444 UDP 24444 LoadBalanceSF LoadBalanceNY PLC 10.202.0.52 Distrix Lab Demo RS232 Distrix PhysSec Demo M0 M1
Demonstration Architecture Home Office Distrix Office 129.168.1.190 demonstration 01.distrix.net LoadBalanceNY UDP 24444 UDP 24444 LoadBalanceSF PLC 10.202.0.52 Distrix Lab Demo RS232 Distrix PhysSec Demo Demo Laptop M0 M1 28
A Simple Demo 29 Proprietary Information
2014 Distrix Inc. All rights reserved