IT in Manufacturing

Secure boundaries enhance industrial cybersecurity

September 2021 IT in Manufacturing

The rise of interconnected OT and IT systems is often attributed to how business models have evolved with the purpose of enhancing operational efficiency. For example, scada networks deployed along oil pipelines now collect oil output data that is essential to billing and pricing systems. This increase in data collection allows companies to predict, with higher levels of accuracy, not only levels of oil production and output, but also expected revenue. However, it should be noted that the downside of such systems is the likelihood of introducing cybersecurity threats to OT systems.

What is compounding this complex issue is that ransomware attacks are increasing in their severity, according to the general manager of IDC Taiwan. With more and more security incidents occurring in OT systems, business owners and regulators are keen to seek solutions that enhance industrial cybersecurity and allow businesses to keep functioning normally.

What is the security boundary concept?

When enhancing cybersecurity, it is important to understand how industrial systems are exchanging data and how they connect to IT-level systems. In the ideal scenario, when traffic crosses different systems there should be boundaries in place between each system to ensure the traffic has good cyber-hygiene, even if it is authenticated and authorised. However, it is challenging and often unrealistic to build boundaries between every system, as it involves significant expenditure and often has a detrimental effect on the efficiency of network communications. For these reasons it is highly recommended to divide OT systems into different digital zones and build up the boundaries to find the right balance between expenditure and acceptable levels of risk.

The defence-in-depth approach, which is recommended by the IEC 62443 cybersecurity standard committee, is widely used across industries and has a good track record of helping build up multiple layers of protection to fulfil operational requirements. In Figure 1 below, the critical assets and operations are shown as the most important. Since they perform vital roles for the business, it is wise to take additional security precautions such as adding more layers of protection, to secure them even further.

Network segmentation: how to build security boundaries

Physical layer segmentation

This is known as air gapping, where two networks are physically isolated. When the operations and security of one system needs to be independently maintained, an air gap is a potential solution. However, as mentioned earlier, it is increasingly difficult to arrange networks this way due to business and operational requirements.

Data link/network (Layer 2/Layer 3) segmentation

As industrial control systems may have been built decades ago, one of the key challenges is to leverage existing infrastructure. One approach that is frequently deployed is to segregate traffic between different network segments using a VLAN, which is one of the functions of managed Ethernet switches. An alternative is to deploy firewalls to protect industrial applications and data, especially when you need to deal with traffic on Layer 2 and Layer 3 networks.

Layer 4-7 network segmentation

Further segmentation can be applied through deep packet inspection (DPI). DPI offers granular control over network traffic and helps filter industrial protocols based on the requirements of the application. When you have multiple devices on the same network, they can all communicate with each other. However, there are certain scenarios, when, for example, Controller A should only communicate with Robotic Arm B at a specific time. DPI technology can thus help engineers to define which controllers can perform read/write commands, or even the direction of traffic.

Secure remote access

According to cybersecurity experts, remote desktop protocols are sometimes exploited to spread malware or conduct unauthorised activity. As remote connections have become more prevalent, it is unsurprising that building security boundaries between two field sites is being talked about more frequently. It is highly recommended to build VPN tunnels and ensure that access control mechanisms are properly maintained.

As business owners are no longer able to enjoy the benefits and security of completely air-gapped networks, it is imperative to enhance security boundaries through different approaches, including network segmentation and secure remote access. Moxa’s newly launched EDR-G9010 series – an all-in-one firewall/VPN/switch/router – enhances cybersecurity while allowing business owners to leverage existing network infrastructure through future-proof investment.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Get full value from factory floor data with data sciences
October 2021, Omron Electronics , IT in Manufacturing
Valuable information needs to be extracted from the data and presented to the right audience, at the right time and in the right way.

Collaboration in the automation ecosystem
October 2021, EPLAN Software & Services , IT in Manufacturing
Data created in the engineering process must be shared with everyone involved in the process.

Unwired unleashes new possibilities
October 2021, RJ Connect , Industrial Wireless
In situations where it is hard to wire or reconfigure industrial operations, wireless LANs (WLANs) provide an ideal alternative.

Siemens’ software for digital transformation of automotive design
September 2021, Siemens Digital Industries , IT in Manufacturing
Model-based development process and systems are used in Japan and globally to adapt to the biggest automotive transformation in 100 years.

Is track and trace through the factory a waste of time?
September 2021, Iritron , IT in Manufacturing
Modern track and trace solutions are purpose-built to introduce as little disruption to the existing production process as possible, while also being flexible enough to cater for plants that range from fully manual to fully automated.

Modularity for scalability
September 2021, RJ Connect , IT in Manufacturing
Businesses are looking for versatile solutions that are easy to maintain to ensure smooth operations while keeping costs down.

Saryx launches TMP
September 2021, Saryx Engineering Group , IT in Manufacturing
The digital transformation that has swept the world in the past few years has fundamentally altered most people’s approach to technology, with an increasing number seeking the ability to manage their ...

Siemens drives digital transformation at virtual Smart Mining forum
September 2021, Siemens Digital Industries , IT in Manufacturing
With its motto: ‘On the road to the digital future’, Siemens hosted its virtual Smart Mining forum from 3-5 August.

Deep-learning AI made accessible
September 2021, SICK Automation Southern Africa , IT in Manufacturing
SICK Automation has launched a set of deep-learning software and services called dStudio, making artificial intelligence (AI) more accessible to the southern African market. This software works with machine ...

Monitoring oil and gas pipelines
August 2021, RJ Connect , Maintenance, Test & Measurement, Calibration
Moxa’s MDS-G4020 series offers a modular platform that can be fitted with fibre interfaces to connect pipeline subsystems to a control centre over long distances.