Securely Connect, Network, Access, and Visualize Your Data 1
Who is Skkynet? Skkynet is the Parent company of; - Cogent Real-Time Systems Established in 1994 Focus on Industrial Automation software Cogent DataHub, WebView - Nic Corporation (Osaka, Japan) Established to focus on the embedded market Develop for M2M, M2C software for embedded devices 2/16/2015 2
Skkynet Secure Cloud Service TM Secure end-to-end platform to connect virtually any industrial or embedded data source, visualize the data, and monitor or control your process or system from almost anywhere. - No programming necessary - Secured by Design No open inbound firewall ports = No internet attack surface No VPNs required Allows for full bi-directional communications and supervisory control 2/16/2015 3
Evolution of Industrial Networks - VPN Plant 1 Plant 2 Plant 3 VPN Plant 4 VPN s assume a trusted device VPN provides a virtualized and private (isolated) network space. The secure tunnels are a mechanism to achieve an appropriately protected path into that space, but the space per-se is not secured. It is a feature that the established VPN space is fully transparent to all protocol and traffic above the link layer. 2/16/2015 4
Evolution of Industrial Networks - VPN Plant 1 Plant 2 Plant 3 VPN Plant 4 Once a user has access to a VPN, they have access to all connected devices on that VPN. Attack surfaces are multiplied by the number of connected devices Security rests with physical possession of a device Some trusted in the hands of employees or under security Some remote where no employee is controlling the device, such as data acquisition device 2/16/2015 5
The Challenges of Industrial Networks (IOIT) Internet of Industrial Things - No central management things and networks are owned and operated by people or companies who are not acquainted - There is a Strong security requirement Jan 2014 Hackers gain 'full control' of critical SCADA systems Over 60,000 exposed control systems found online Jan 2014 - Your Fridge is Full of SPAM: Proof of An IoT-driven Attack Over 750,000 messages came from IOT May 2014 - DHS Confirms U.S. Public Utility s Control System Was Hacked Two separate incidents July 2014 - Dragonfly hackers target 1000 Western energy firms, industrial control systems Dec 2014 - Computer intrusion inflicts massive damage on German steel factory - Unreliable, relatively slow network (Internet) - No agreement on hardware communication protocols - Traditional server/client (master/slave) communication not appropriate (e.g., OPC) - Data aggregation and protocol conversion is key
Extending Industrial Networks Better Solution is Required Isolates all the connecting devices and plants - Never expose an attack surface on either the connecting device or the plant Standards based Preserve existing capital expenditures Moves real-time data at high volumes and high speeds across any network - Simple to configure and use - Deployable on commodity hardware and consumer devices Non-disruptive to existing plants or systems 2/16/2015 7
With Skkynet s Secure Cloud Server Plant 1 Plant 2 Plant 3 Secure Cloud Service TM Plant 4 SCS assumes all devises are untrusted Devices are never granted permission to join the enterprise network, only data passes Firewalls remain closed = NO attack surface If ONE device is compromised, other network devices remain secure 2/16/2015 8
Reversing the Master Slave Relationship Remote Systems Industrial Systems Web Clients Embedded Systems Office Systems MES Initial connection to the cloud server is outbound from the device or the Cogent DataHub Once established, a request is made from the device/system for a websocket connection 2/16/2015 9
Reversing the Master Slave Relationship Remote Systems Industrial Systems Web Clients Embedded Systems Office Systems MES Inbound connection - If the device or system is configured to allow an inbound connection, A websocket connection is established through the same connection path. - Data flows freely through closed firewall ports! - No VPN is required - Both data and connection path are encrypted and secure End to end from the device to the SCADA system - Device/system is never granted access to the SCADA network, only data passes; isolating each connection or remote system from cyber attack 2/16/2015 10
Working with a Mobile Gateway Industrial System Modbus TCP I/O 4/20mA HMI OPC ODBC TCP DDE MES 2/16/2015 CONFIDENTIAL 11
Solution Architecture W ind Tower Application SCADA Node Siemens SCADA Modbus TCP Secure Cloud Service TM Cogent DataHub Tunneller /Modbus No Open Inbound Firewall ports All traffic runs through closed firewalls - securely All data is encrypted SCADA Nodes are securely isolated as connections are not granted network access; only data flows. Allows Analytics to be separated from the remote systems, yet allows for Bi-directional communications and automatic set-point controls Non-disruptive to existing system; No hardware to install No changes to the existing firewall or security settings No VPN to configure Full Featured HMI with user security provisioning Scalable from 1 to 1,000 s of nodes WebSockets over TCP using SSL/TLS WebSockets over TCP using SSL/TLS Analytics Optimization Cogent DataHub Tunneller WebSockets over TCP using SSL/TLS
Technical Differentiation think differently Data Rates and Latency - Real-time data is pushed to the cloud, then pushed to the users. - Publish/Subscribe data delivery - In memory real-time database. Reversing Client/Server Relationship to Keep Firewalls Closed - This allows the in-plant system and remote devices to stream data to the cloud service without exposing itself to the Internet. Data-Centric Infrastructure - Data stays in its simplest form. - The raw data flows from the source, through the cloud, to the user, and gets converted to other formats (such as HTML, XML, SQL, etc.) at the last instant. Redundancy - Independent, hot-standby, redundant cloud systems. LAN-to-LAN via the Cloud - The system maintains a complete copy of the data set on the source LAN, and sends it across to the user LAN, continuously updating it in real time for live replication of the data on both LANs. 13
Opportunities are limitless Highly secure anywhere SCADA access and networking - Any number of facilities can be consolidated Fast time to market - Minimal customer IT involvement - No Programming required SCS is a plug-and-play end-to-end solution - Protects customers existing infrastructure Investment No need to invest in any new PLC s, OPC servers or SCADA systems Plugs into the network to extend real-time access and networking to the cloud No investment in security, VPNs or proxy servers Sticky - No competing services in the market = low cost of entry, high cost of exit Once registered on the service, only option is an in-house solution or custom solution Typical in-house system would be $5,000-$8,000 per location, SCS saves a min of $3,000 per location. - Pricing model matches well with air-time pricing Pricing model is based on data traffic over the service, similar to data plans, but much lower. Customize your services - Easily bundled into a package for customer marketing Mobile gateway + SCS+ carrier data plan - Create add-on services Big data storage, data analytics, consulting services 2/16/2015 CONFIDENTIAL 14
Conclusion Skkynet delivers real-time data services in any form to any machine, virtually anywhere - Secure - Real-time performance - Patented real-time data transport and display technology - Any data source including legacy systems We are in a new connected world We re used to having our computers networked, we re not used to having everything networked Security can no longer be an add-on, it needs to be secured by design 2/16/2015 15