Defence-in-Depth: Before unleashing the Internet of Things, secure it

Jan. 19, 2016 – Factories are poised to capture more value from the Internet of Things (IoT) than any other setting in the next 10 years.

That’s the finding of a recent McKinsey Global Institute report, The Internet of Things: Mapping the Value Beyond the Hype, which seeks to identify where and how IoT will have the biggest economic impacts in 2025. The report estimates that factories stand to benefit the most from IoT, creating between $1.2 trillion and $3.7 trillion of value per year by 2025.

The true IoT value at stake, however, will be dependent on the course that industry charts.

For instance, only manufacturers and industrial operators that adopt the Internet Protocol (IP) — the world’s defining network technology — can expect to fully leverage the growing number of IP-enabled devices, such as tablets, video cameras and RFID readers that were designed for other industries because the vendors are making them IP aware. Additionally, only an IP-centric unified network architecture provides the foundation on which all IoT devices and machines can seamlessly communicate without the need for additional hardware, such as gateways, converters, routers or proprietary switching.

At the same time, manufacturers and industrial operators will only seek to capture IoT’s value if they know they can do so securely. Currently, 43 per cent of large manufacturers list security as a barrier to Internet-connected machines, according to a recent IndustryWeek survey. A 2014 IHS Technology survey of manufacturers, OEMs and industry experts also found that security was named the number two concern, behind signal reliability, among those using wireless technology.

Such concerns have merit given the tens of thousands of new malware attacks that are let loose across the Internet everyday and the multi-billion-dollar counterfeit industry that has launched profit-robbing knock-offs of everything from pharmaceuticals to fighter jets.

Fortunately, best practices exist to help manufacturers and industrial operators deploy IoT both securely and reliably. And it all begins with a security approach known as defence-in-depth.

Security best practice: layered protection
A defence-in-depth approach uses layered security to establish multiple lines of defence. Even if an attack breaches one defence, it still faces an array of others. This approach requires six main components:

1. Physical security
Greater connectivity across your operations means more entry points onto the network. As a result, physical security should be integral to your security plan. Ports should be secured using lock-in/block-out devices to prevent unauthorized device connections and disconnections that could lead to virus uploads and data theft. Network hardware also must be securely contained, such as storing switches in lockable enclosures rather than in control panels. You can also extend the benefits of your information-enabled environments into physical security. For example, high-definition cameras can record events with greater detail, or even automate the security-monitoring process to free up security personnel. Access-control technology can also be extended from building doors down to the cabinets, closets and control panels.

2. Network security
A number of security measures will help strengthen your network and general infrastructure. Deploy firewalls with intrusion detection and prevention systems (IDS/IPS) within and around your industrial network, and ensure general networking equipment such as switches and routers are configured with their security features enabled. Split different areas of the plant into their own separate VLANs based on functionality or location to create domains of trust for security access. A demilitarized zone (DMZ) should be established to create security guards between the manufacturing and enterprise zones. This allows users to share data and services while ensuring traffic does not directly travel between the two zones.

3. Computer hardening
Software vulnerabilities are the top means of entry for intruders into automation systems. Help prevent this through computer-hardening measures such as antivirus software, application whitelisting and host intrusion-detection systems, and by removing any unused applications, protocols and services. Following some software-patching best practices can also help reduce risk. These practices include disabling automatic software-updating services, subscribing to vendors’ patch-qualification services for patch compatibility, obtaining patches only directly from vendors, pretesting patches on non-operational systems, and scheduling patch installs while also planning for contingencies.

4. Application security
Integrate security mechanisms into individual manufacturing or industrial control-system applications. This can include using a role-based access control system to restrict access to critical process functions or requiring operators to enter login information before accessing an application.

5. Device and computer hardening
Adjust the default configuration of an embedded device to make it more secure in areas such as change management and restrictive access. The default security settings for devices such as programmable automation controllers, switches, routers and firewalls will vary based on device class and type, affecting how much time and effort is required to harden different devices. Trusted compute modules can be installed to further safeguard the integrity of the hardware platform.

6. Policies
Form a multidiscipline team that includes operations, IT, engineering and safety personnel. This team will be responsible for identifying vulnerabilities and developing a security policy to mitigate those vulnerabilities. More than determining which security technologies are needed and how they should be implemented, your policy should also shape the processes and procedures that drive good security practices into workers’ everyday behaviours and interactions.

Nancy Cam-Winget is a distinguished engineer at Cisco. She is also a contributor on the issue of information security and other topics for Industrial IP Advantage, an educational community created to help manufacturers and industrial operators capitalize on the value of connected, information-enabled operations through the use of standard, unmodified IP and Ethernet technologies (www.industrial-ip.org).

This article was originally published in the January/February 2016 issue of Manufacturing AUTOMATION.