Dear Reader,
Today, IoT devices have a deeper penetration in manufacturing, healthcare, and business than in our homes or phones; you can expect that trend to continue.
For companies interested in implementing an industrial Internet of Things system, this article will provide an overview of industrial IoT, as well as some important IIoT definitions, information about the underlying technology.
IIoT Security is one of the least talked about areas today since the world focuses more and more on Information security, Blockchain, and others.
Ambimat Electronics with its experience of over 4 decades as an ODM of IoT products wishes to draw the attention of its customers and readers of blog posts towards this neglected field.
Industrial Control Systems (ICS) house some of the most important components of a shop floor’s critical infrastructure. The ICS includes what are known as Programmable logic controllers (PLC). PLCs are basically computers used for automation of typically industrial electromechanical processes, such as the control of machinery on factory assembly lines, amusement rides, light fixtures, power stations, power distribution systems, power generation systems, and gas turbines, to name a few.
Industrial Control Systems run critical infrastructure
It is very likely that most PLCs will either have a critical service, operate a critical system or service, or be used in a critical system. If you care about any of your critical processes, functions, or systems, you definitely should care about the security of various components upon which they depend. Hence many layers of protection need to be in place for PLC to be called or considered ‘secure’. Human risk factors, the protection of the logic inside the PLC, secure communications, application-layer security, operating system security, hardware security and last but not least, the management of all aspects of all of the above security requirements are just some of the things that should be taken into consideration.
In Spite of PLCs (and in general ICS) being a very important component of the IIoT infrastructure as a part of the entire OT (Operational Technology) floor their security is a hugely neglected topic and is often confused by implementing traditional IT security thought processes for their protection.
We expect to draw attention to the complexity of this matter of security by first focusing on the various threats posed against the ICS.
Threats to the ICS
One cannot rely on the custom architecture of ICSs to protect them from electronic threats. Historically, cyber-attacks were not considered serious threats to control and automation systems because ICS networks were either isolated or did not follow IT standards. We can make three important observations about this.
- Control and automation networks are increasingly connected to standard and open networks because they need to interface with other systems.
- In industry, a proprietary protocol can easily be reverse-engineered at a reasonable cost. The danger here is that any weaknesses in that protocol may never have been studied, understood, or remedied. It is dangerous to think that a proprietary protocol offers security just because its knowledge is not in the public domain. This assumption has been proven to be wrong and misguided; it is the “security through obscurity” concept. This vulnerability of insecure protocols contrasts markedly with publicly known and trusted protocols for which threats and responses are well understood.
- Networks are not the only path for cyber attacks. Consequently, an isolated infrastructure in an ICS might be vulnerable to other attack media such as USB keys or maintenance consoles.
Just like industrial networks not following documented and well-known protocols, so to the proprietary architecture of PLCs do not normally offer security protection.
While ICSs have a different architecture from the typical IT infrastructure and fulfill different requirements, nonetheless, most of the threats to generic IT infrastructures can also affect ICSs. Unfortunately, the list of those threats is long and troubling: malware injection such as worms or viruses; software or hardware configuration changes; fake messages or orders from an attacker; identity theft; and unauthorized observation.
Hence it becomes extremely difficult to protect the ICS but there are multiple ways to ‘Do your best’. Let’s look at the ways to protect your ICS.
Ways to protect your ICS
There are perhaps multiple ways to protect your ICS. Just to name a few here:
- Put the Highest Level of Protection Inside the ICS
- Protect the ICS with Embedded Cryptography
Put the Highest Level of Protection Inside the ICS
With security being a pervasive concern for industrial and automation applications, protection and mitigation actions are being implemented. Until now, most of these defensive measures have included security procedures, environment, and physical protection, and staff education. The ICS itself remains vulnerable. Before we leap to criticize the industrial community for these minimal precautions, we should recall that this is how security started in the traditional IT domain. This is really the first level of protection, a foundation that must be the start.
These traditional defensive tactics do not, in any way, provide the ultimate level of protection needed for an ICS. Procedures, even if audited on a regular basis, are never 100% followed; physical protection like locking doors can be bypassed and cannot be applied everywhere. Most important, defensive manual procedures do not cover attacks performed by highly skilled people with the time and budget to build the most sophisticated scenarios. Even worse, there are examples where bribery led ICS operators to bypass procedures.
No, the security answer is embedded. It is in the ICS hardware. The upper-level hierarchy of security protection techniques involves generic IT security techniques such as cryptography and hardware security
Protect the ICS with Embedded Cryptography
Generic IT policies cannot be systematically applied to the broad range of ICSs at work in the industry. However, there is one technology used universally in the IT world that can be implemented: cryptography.
Cryptography answers most of the threats listed above. Still, it is not a magic wand and the approach cannot be as simple as, “I’ll add crypto to my ICS, and all of sudden it will be secure.” Crypto algorithms and protocols are building blocks that should be implemented on a case-by-case basis after a thorough analysis of the threats to each subsystem. Restated simply, cryptography is a tool common to ICSs and IT infrastructure, but its implementation in an ICS must be tailored to the specific system. Within the broad range of cryptographic techniques, two are very important for an ICS: digital signature and encryption.
- Digital Signature: In a SCADA system, you want to trust information coming from a field sensor. That is where Digital signatures play a very important role.
- Encryption: Data encryption over ICS networks would prevent such disclosure of user’s behavior thus helping to protect the customer’s assets
Conclusion
In conclusion, a simple picture taken in a work environment could provide an attacker with the last piece of information missing to be successful in his/her operations. PLCs are very important components of critical infrastructure and should be protected at all costs.
Protecting PLCs alone would not solve the problem against cyber-attacks. General governance should be in place to ensure that all aspects of security within the organization are properly addressed. A holistic approach to security is highly recommended.
About Ambimat Electronics:
With design experience of close to 4 decades of excellence, world-class talent, and innovative breakthroughs, Ambimat Electronics is a single-stop solution enabler to Leading PSUs, private sector companies, and start-ups to deliver design capabilities and develop manufacturing capabilities in various industries and markets. AmbiIoT design services have helped develop Smartwatches, Smart homes, Medicals, Robotics, Retail, Pubs and brewery, Security.
Ambimat Electronics has come a long way to become one of India’s leading IoT(Internet of things) product designers and manufacturers today. We present below some of our solutions that can be implemented and parameterized according to specific business needs. AmbiPay, AmbiPower, AmbiCon, AmbiSecure, AmbiSense, AmbiAutomation.
To know more about us or what Ambimat does, we invite you to follow us on LinkedIn or visit our website.
References:
https://www.maximintegrated.com/en/design/technical-documents/tutorials/5/5522.html
https://blog.nettitude.com/uk/programmable-logic-controller-security
https://www.helpnetsecurity.com/2019/08/09/siemens-plc-vulnerabilities/
