Editor's Choice


Industrial control system cybersecurity - Part 5: ICS network segmentation.

October 2018 Editor's Choice IT in Manufacturing

In the last three articles on cybersecurity in ICS environments, we have covered risk assessments, asset discovery and vulnerability management, environment hardening and security monitoring. In the penultimate article, we will cover network segmentation in ICS networks.

Historically, many ICS/engineering departments were not focused on protecting the inside of their networks, only the perimeter was protected with the firewall being seen as the single line of defence against the malicious insiders, third-party vendors and the bad guys from the outside. This strategy, while effective for its day, does not hold true in the modern digital world. Today’s attacks are being facilitated by large and well-funded groups of cyber criminals looking to steal intellectual information, stop production and extort companies. Once access is gained by breaching the perimeter, these cyber criminals are able to move freely within your network. This is why it is strongly recommended to implement a network segmentation framework.

Splitting up the network

ICS network segmentation is the process of splitting up your network into different segments or sub-networks, to improve performance, but more importantly, to make it more difficult for an adversary to freely move around if they compromise a part of your network. To define this further, it is the process of grouping similar assets and then enforcing a segment between the levels both above and below.

To put this into perspective, Target Corporation, a leading USA retailer, lost 40 million credit and debit card numbers in December 2013. The first part of this compromise is that the cyber criminals stole credential information from a third party HVAC supplier. The second part is that these credentials were then used to gain access to the Target Corporation network. The third part is that once the cyber criminals gained access they targeted the POS systems, by installing malware on them. There is more to this incident (an entire article on its own), but it does highlight the need for strong effective network segmentation. If there was proper network segmentation between the POS network, the third party network and the main corporate network, it would have been much more difficult to steal the information.

Purdue Enterprise Reference Architecture

One of the most commonly used models is that of the Purdue Enterprise Reference Architecture model, more commonly known as PERA or just the Purdue model. I strongly urge all of those responsible for ICS cybersecurity to review this method. It was developed by the Industry-Purdue University Consortium for Computer Integrated Manufacturing, and has been widely adopted by major industrial control system cybersecurity frameworks such as NIST 800-82 and ISA/IEC 62443.

From a hierarchical view the model is comprised of 6 levels and 5 zones. The 6 levels are:

• Level 0: Process.

• Level 1: Basic control.

• Level 3: Operations and control.

• Level 4: Business planning and logistics.

• Level 5: Enterprise network.

And the five zones being:

• Enterprise zone.

• Demilitarised zone (DMZ).

• Manufacturing zone.

• Cell/area zone.

• Safety zone/Safety Instrumented System (SIS).

The diagram is a very basic control network depicting how the Purdue model should logically be implemented.

One aspect to take note of from the diagram is that no control system protocol should traverse the ICS network into the enterprise or business network. All too often we still find ICS traffic on the IT network(s), which not only slows down network performance by having unnecessary traffic ‘on the wire’, but also provides huge security risks as these protocols have no, or very limited, built-in security. If ICS traffic is absolutely required to traverse the ICS network through to the IT network, ensure that is it is strictly controlled.

Each ICS system is different and requires certain tweaks and changes to the customer’s specific ICS network segmentation framework. Where the Purdue model helps is that it assists in designing a base framework which you can then build on. As I’ve stated previously, there is no ‘one size fits all’ framework that is right for everyone, and there are other models that you might want to consider to suite your organisation’s needs. The Industrial Internet of Things (IIoT) and Software-Defined Networking (SDN) is also changing the way we see and segment our networks.

Tommy Thompson

Tommy Thompson is a passionate cybersecurity professional with some 15 years’ experience. Starting as a firewall engineer in 2001, Thompson has assisted a variety of companies in numerous roles with their cybersecurity problems. He holds a BComm degree in Information Management from Oxford Brookes University (UK) and he is certified by PECB (Canada), as a Scada Security Professional (CSSP).

For further information contact Tommy Thompson, +27 (0)11 463 0096, [email protected]





Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

STEMulator – a gift to the youth of the nation
Editor's Choice News
STEMulator is a groundbreaking virtual platform designed to ignite the spark of curiosity in young minds and stimulate their interest in STEM subjects.

Read more...
Innovate, accelerate, dominate
Festo South Africa Editor's Choice Pneumatics & Hydraulics
Festo’s latest innovations, revealed through the Ramp Up Campaign, offer a blueprint for performance excellence, using the anatomy of a race car as an analogy to simplify and powerfully communicate how their technologies address industry challenges.

Read more...
Case History 198: Cascade control overcomes valve problems.
Editor's Choice Flow Measurement & Control
There are many processes where it is undesirable for the load to suddenly change quickly, for example in the paper industry. Examples of level control have involved reasonably fast tuning. An example of a level loop tuned this way and responding to a step change in setpoint is given.

Read more...
Advanced telemetry solutions
Editor's Choice Industrial Wireless
Namibia is one of the driest countries in sub-Saharan Africa, with an average annual rainfall below 250 mm. To address this challenge, the Namibia Water Corporation has employed one of southern Africa’s most powerful and well-proven telemetry solutions, designed and manufactured by SSE/Interlynx-SA.

Read more...
Navigating the future of intralogistics
LAPP Southern Africa Editor's Choice
In the rapidly evolving landscape of global markets, the demand for agility, efficiency and scalability in intralogistics has never been more critical. At LAPP Southern Africa, we stand at the forefront of this transformation, offering cutting-edge connection solutions tailored to the dynamic needs of intralogistics.

Read more...
Cutting-edge robotics and smart manufacturing solutions
Yaskawa Southern Africa Editor's Choice
Yaskawa Southern Africa made a compelling impact at this year’s Africa Automation and Technology Fair.

Read more...
A cure for measurement headaches in contract manufacturing
VEGA Controls SA Editor's Choice
A contract manufacturing organisation provides support to pharmaceutical and biotechnology companies in the manufacturing of medications, formulations and substances. VEGA’s measurement solutions offer accuracy and reliability for monitoring levels and pressures during the manufacturing process.

Read more...
PC-based control for a food capsule and pod packaging machine
Beckhoff Automation Editor's Choice
For TME, a machine builder specialising in the packaging of powdered foods, Beckhoff’s PC-based control technology offers unlimited opportunities when it comes to performance and innovative capacity in terms of flexibility, scalability and openness.

Read more...
Simple and efficient level measurement in the mining, minerals and metals industries
Endress+Hauser South Africa Editor's Choice Level Measurement & Control
Measuring devices in the mining, minerals and metals industries face the challenge of varying material states and long distances in measurement height. Endress+Hauser’s answer to these challenges is the new Micropilot family.

Read more...
PC-based control for fertiliser
Beckhoff Automation Editor's Choice Fieldbus & Industrial Networking
On a farm in the USA, valuable ammonia is extracted from slurry and processed into ammonium sulphate. NSI Byosis has transformed this complex process into a flexible modular system. This modular approach requires an automation solution with flexible scalability in both hardware and software, which this Dutch company has found in PC-based control from Beckhoff.

Read more...









While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd | All Rights Reserved