IT in Manufacturing

Secure boundaries enhance industrial cybersecurity

September 2021 IT in Manufacturing

The rise of interconnected OT and IT systems is often attributed to how business models have evolved with the purpose of enhancing operational efficiency. For example, scada networks deployed along oil pipelines now collect oil output data that is essential to billing and pricing systems. This increase in data collection allows companies to predict, with higher levels of accuracy, not only levels of oil production and output, but also expected revenue. However, it should be noted that the downside of such systems is the likelihood of introducing cybersecurity threats to OT systems.

What is compounding this complex issue is that ransomware attacks are increasing in their severity, according to the general manager of IDC Taiwan. With more and more security incidents occurring in OT systems, business owners and regulators are keen to seek solutions that enhance industrial cybersecurity and allow businesses to keep functioning normally.

What is the security boundary concept?

When enhancing cybersecurity, it is important to understand how industrial systems are exchanging data and how they connect to IT-level systems. In the ideal scenario, when traffic crosses different systems there should be boundaries in place between each system to ensure the traffic has good cyber-hygiene, even if it is authenticated and authorised. However, it is challenging and often unrealistic to build boundaries between every system, as it involves significant expenditure and often has a detrimental effect on the efficiency of network communications. For these reasons it is highly recommended to divide OT systems into different digital zones and build up the boundaries to find the right balance between expenditure and acceptable levels of risk.

The defence-in-depth approach, which is recommended by the IEC 62443 cybersecurity standard committee, is widely used across industries and has a good track record of helping build up multiple layers of protection to fulfil operational requirements. In Figure 1 below, the critical assets and operations are shown as the most important. Since they perform vital roles for the business, it is wise to take additional security precautions such as adding more layers of protection, to secure them even further.

Network segmentation: how to build security boundaries

Physical layer segmentation

This is known as air gapping, where two networks are physically isolated. When the operations and security of one system needs to be independently maintained, an air gap is a potential solution. However, as mentioned earlier, it is increasingly difficult to arrange networks this way due to business and operational requirements.

Data link/network (Layer 2/Layer 3) segmentation

As industrial control systems may have been built decades ago, one of the key challenges is to leverage existing infrastructure. One approach that is frequently deployed is to segregate traffic between different network segments using a VLAN, which is one of the functions of managed Ethernet switches. An alternative is to deploy firewalls to protect industrial applications and data, especially when you need to deal with traffic on Layer 2 and Layer 3 networks.

Layer 4-7 network segmentation

Further segmentation can be applied through deep packet inspection (DPI). DPI offers granular control over network traffic and helps filter industrial protocols based on the requirements of the application. When you have multiple devices on the same network, they can all communicate with each other. However, there are certain scenarios, when, for example, Controller A should only communicate with Robotic Arm B at a specific time. DPI technology can thus help engineers to define which controllers can perform read/write commands, or even the direction of traffic.

Secure remote access

According to cybersecurity experts, remote desktop protocols are sometimes exploited to spread malware or conduct unauthorised activity. As remote connections have become more prevalent, it is unsurprising that building security boundaries between two field sites is being talked about more frequently. It is highly recommended to build VPN tunnels and ensure that access control mechanisms are properly maintained.

As business owners are no longer able to enjoy the benefits and security of completely air-gapped networks, it is imperative to enhance security boundaries through different approaches, including network segmentation and secure remote access. Moxa’s newly launched EDR-G9010 series – an all-in-one firewall/VPN/switch/router – enhances cybersecurity while allowing business owners to leverage existing network infrastructure through future-proof investment.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

High-speed Ethernet up to 1 km with Gigabit Ethernet extenders
Phoenix Contact IT in Manufacturing
With Power-over-Link and Power-over-Ethernet functions, the entire Gigabit Ethernet extender network and connected PoE devices are supplied with power via the data lines.

Ready for industrial network evolution?
RJ Connect Editor's Choice IT in Manufacturing
To prepare for the future, it is time for industrial networks to evolve, and Moxa is committed to helping them take the leap towards the next generation of networking.

Are engineers equipped with 4IR skills?
Editor's Choice IT in Manufacturing
Technology has evolved exponentially in the last 10 years, much faster than the 10 years before. A gap will undoubtedly develop if technology evolves faster than our skills. Therefore, we must start immediately identifying the gaps and what 4IR skills we need to fill them.

Valmet mobile maintenance app
Valmet Automation IT in Manufacturing
VMM meets industrial cybersecurity standards, follows all best practices and guidelines, and is audited by an accredited service provider.

Business platform to accelerate digital transformation
Siemens South Africa IT in Manufacturing
Siemens has launched an open digital business platform, Siemens Xcelerator, to accelerate digital transformation and value creation for customers of all sizes in industry, buildings, grids and mobility. The business platform makes digital transformation easier, faster and scalable.

South African manufacturing sector’s readiness for Industry 4.0
Editor's Choice IT in Manufacturing
New research from PwC’s Insights into the I4.0 Readiness of SA Manufacturing 2022 report shows that I4.0 tools have the ability to increase the quality, flexibility, performance and overall competitiveness of the manufacturing sector. 

Gain more visibility into your power substation operations
RJ Connect Electrical Power & Protection
The key dilemma is that many RTUs, HMIs, Ethernet switches and intelligent electronic devices (IEDs) installed in substations are from different vendors.

Security certified IIoT edge gateway
Omron Electronics IT in Manufacturing
The DIN-mountable device can be installed in machine control panels to provide remote access for on-demand, real-time servicing of industrial equipment.

EPLAN relegates device data DIY to history
EPLAN Software & Services IT in Manufacturing
With the new Data Portal Request Process, customers can order individual device data in Data Standard quality using a credit system.

Recovering from industrial data disasters
Absolute Perspectives IT in Manufacturing
Aside from bringing production to a sudden halt, there are often safety and environmental implications when shutting down a plant.