IT in Manufacturing

Secure boundaries enhance industrial cybersecurity

September 2021 IT in Manufacturing

The rise of interconnected OT and IT systems is often attributed to how business models have evolved with the purpose of enhancing operational efficiency. For example, scada networks deployed along oil pipelines now collect oil output data that is essential to billing and pricing systems. This increase in data collection allows companies to predict, with higher levels of accuracy, not only levels of oil production and output, but also expected revenue. However, it should be noted that the downside of such systems is the likelihood of introducing cybersecurity threats to OT systems.

What is compounding this complex issue is that ransomware attacks are increasing in their severity, according to the general manager of IDC Taiwan. With more and more security incidents occurring in OT systems, business owners and regulators are keen to seek solutions that enhance industrial cybersecurity and allow businesses to keep functioning normally.

What is the security boundary concept?

When enhancing cybersecurity, it is important to understand how industrial systems are exchanging data and how they connect to IT-level systems. In the ideal scenario, when traffic crosses different systems there should be boundaries in place between each system to ensure the traffic has good cyber-hygiene, even if it is authenticated and authorised. However, it is challenging and often unrealistic to build boundaries between every system, as it involves significant expenditure and often has a detrimental effect on the efficiency of network communications. For these reasons it is highly recommended to divide OT systems into different digital zones and build up the boundaries to find the right balance between expenditure and acceptable levels of risk.

The defence-in-depth approach, which is recommended by the IEC 62443 cybersecurity standard committee, is widely used across industries and has a good track record of helping build up multiple layers of protection to fulfil operational requirements. In Figure 1 below, the critical assets and operations are shown as the most important. Since they perform vital roles for the business, it is wise to take additional security precautions such as adding more layers of protection, to secure them even further.

Network segmentation: how to build security boundaries

Physical layer segmentation

This is known as air gapping, where two networks are physically isolated. When the operations and security of one system needs to be independently maintained, an air gap is a potential solution. However, as mentioned earlier, it is increasingly difficult to arrange networks this way due to business and operational requirements.

Data link/network (Layer 2/Layer 3) segmentation

As industrial control systems may have been built decades ago, one of the key challenges is to leverage existing infrastructure. One approach that is frequently deployed is to segregate traffic between different network segments using a VLAN, which is one of the functions of managed Ethernet switches. An alternative is to deploy firewalls to protect industrial applications and data, especially when you need to deal with traffic on Layer 2 and Layer 3 networks.

Layer 4-7 network segmentation

Further segmentation can be applied through deep packet inspection (DPI). DPI offers granular control over network traffic and helps filter industrial protocols based on the requirements of the application. When you have multiple devices on the same network, they can all communicate with each other. However, there are certain scenarios, when, for example, Controller A should only communicate with Robotic Arm B at a specific time. DPI technology can thus help engineers to define which controllers can perform read/write commands, or even the direction of traffic.

Secure remote access

According to cybersecurity experts, remote desktop protocols are sometimes exploited to spread malware or conduct unauthorised activity. As remote connections have become more prevalent, it is unsurprising that building security boundaries between two field sites is being talked about more frequently. It is highly recommended to build VPN tunnels and ensure that access control mechanisms are properly maintained.

As business owners are no longer able to enjoy the benefits and security of completely air-gapped networks, it is imperative to enhance security boundaries through different approaches, including network segmentation and secure remote access. Moxa’s newly launched EDR-G9010 series – an all-in-one firewall/VPN/switch/router – enhances cybersecurity while allowing business owners to leverage existing network infrastructure through future-proof investment.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Gain more visibility into your power substation operations
RJ Connect Electrical Power & Protection
The key dilemma is that many RTUs, HMIs, Ethernet switches and intelligent electronic devices (IEDs) installed in substations are from different vendors.

Security certified IIoT edge gateway
Omron Electronics IT in Manufacturing
The DIN-mountable device can be installed in machine control panels to provide remote access for on-demand, real-time servicing of industrial equipment.

EPLAN relegates device data DIY to history
EPLAN Software & Services IT in Manufacturing
With the new Data Portal Request Process, customers can order individual device data in Data Standard quality using a credit system.

Recovering from industrial data disasters
Absolute Perspectives IT in Manufacturing
Aside from bringing production to a sudden halt, there are often safety and environmental implications when shutting down a plant.

EtherCAT conformance tool updated
IT in Manufacturing
The CTT now allows read and write access to the PHY registers, which is convenient and rarely supported by other tools.

Turning pollution into gold
RJ Connect Editor's Choice
Streamline Innovations’ Valkyrie redox process leverages the convergence of IT and OT technology to create a sustainable, economical solution.

Carmakers look to AI/ML to achieve sustainable manufacturing
IT in Manufacturing
ML supports component quality inspections using camera data to check assembly processes and sequences in terms of complexity, speed and accuracy.

The most common cyber threats in the industrial environment
Rockwell Automation IT in Manufacturing
Rockwell Automation’s cybersecurity portfolio strategic growth leader delves into this topic in a recent blog post.

Deploying IT into the factory floor environment
Omniflex Remote Monitoring Specialists IT in Manufacturing
The ongoing debate on whether OT and IT should be integrated has never been more intense. Closing the gap between the two has many benefits, not least of which are efficiency and profitability managed in near real time.

PACTware further refines user interface
VEGA Controls SA IT in Manufacturing
Optimising a user interface for multiple sensor equipment manufacturers is possible in such a way that industrial users can use it similarly to everyday smart devices.