technical track securing ethernet/ip networks presented by: paul didier - cisco eddie lee - moxa

Technical Track

www.odva.org

Securing EtherNet/IP Networks

Presented by: Paul Didier - CiscoEddie Lee - Moxa

Technical Track 2011 ODVA Industry Conference & 14th Annual Meeting page 2© 2011 ODVA, Inc. All rights reserved. www.odva.org

Agenda

Securing EtherNet/IP Networks Introduction Best Practices

• Isolated Control Network with Single Controller• Isolated Network with multiple Controllers• Enterprise Connected and Integrated Control Systems

Other Considerations Emerging Industrial Security Technologies

• ISA 99


Introduction

High level paper for customers, implementers to identify security concepts per type of control networks.

• Start with Risk identification and analysis• Identify Risk reduction and mitigation techniques• There will be costs and trade-offs• Differences between IT and Industrial Automation

and Control• Working with IT


Who Needs to Talk to Whom?


Control Network types

Isolated Single Controller• Single Controller• 10s of devices• Potentially multiple

switches• Limited non-CIP traffic• Sharing data via sneaker

net or transferable device

Isolated Multiple Controller• Multiple Controllers• Up to 100s of devices• 10s of switches, maybe a

router• A few networks• Potentially multiple switches• Controllers sharing data• Some non-CIP traffic (e.g.

HTTP, file sharing, etc.)

Enterprise Connected• Many Controllers• Up to 1000s of devices• Lots of switches and routers

and other network infrastructure

• Many “networks”• Sharing data, applications

and services between Enterprise and Plant networks

• Could have lots of non-CIP traffic (e.g. Voice, Video, etc.)


Best Practices – Isolated Single Controller

• Managed Switches • Diagnostics• Port Security

• Device Maintenance• End-device security

• OS patches• Anti-virus

• Network and Application monitoring and management


Isolated Multiple Controller

• VLANs• Basic segmentation• Performance

• Quality of Service• Protect key traffic from

performance or some Denial of Service

Previous Considerations and…

• IGMP (Multicast management)• Network Resiliency

• Spanning Tree or Device Level Ring (DLR)


Quality of Service Operations

Classification and Marking

Queuing and (Selective) Dropping

Post-Queuing Operations


Connected and Integrated Control

• Firewall and DMZ• Control traffic flows• Protect Plant from

Enterprise threats

• Intrusion Detection• Monitor and stop known

and unknown attacks

Previous Considerations and…

• Remote Access• VPN to Firewall/DMZ• Terminal Services into controlled, locked-down

server


Firewalls A firewall is a security device which is configured

to permit, deny or proxy data connections set by the organization's security policy. Firewalls can either be hardware or software based

A firewall's basic task is to control traffic between computer networks with different zones of trust

Today’s firewalls combine multilayer stateful packet inspection and multiprotocol application inspection

Virtual Private Network (VPN), Anti-x, Authentication and Intrusion Prevention Services (IPS) have been integrated

Despite these complexities, the primary role of the firewall is to enforce security policy

Enterprise

Plant


De-Militarized Zone

Enterprise

Plant

• Demilitarized zone is a physical or logical sub-network that contains and exposes an entities external data and services to a larger un-trusted network

• Typically requires a Firewall• DMZ may contain terminal server,

replicated historian, AV, patch, DNS, AD/LDAP or mail servers.

• Buffers a zone from the threats, traffic, scans and other network-born activities in other networks

DMZ


Virtual Private Network (VPN) Overview

Mechanism for secure communication over IP (Internet)

Authenticity (unforged/trusted party) Integrity (unaltered/tampered) Confidentiality (unread)

Remote Access (RA) VPN components Client (mobile or fixed) Termination device (high number of endpoints)

VPN Security Appliance

VPN Client or Browser

VPN tunnel


VPN - What Are We Talking About?

Secure VPN includes a number of technologies

• IPsec• L2TP/IPSec• TLS (HTTPS/SSL)

• DTLS• SSL

• HMAC-MD5• HMAC-SHA-1

• RSA digital certificates

• Pre-Shared key

• DES• 3DES • AES• RC4

Tunneling Encryption Authentication* Integrity

B A N K

*IKE 1st Phase, Not User Auth.


Wireless

CIP and EtherNet/IP, being based on open standards, is readily transportable over

standard wireless technologies.Common wireless security practices include:• IEEE 802.1x Network Access Control and

authentication with shared keys• Encryption – WPA2 is best practice• Disable SSID broadcasting for control WLAN• Rogue access point and end-point detection


Authenticator (e.g. Access Point)

Authentication Server(e.g. RADIUS)

Wireless Client

Wireless Client

How 802.1x Works

IEEE 802.1X (Port-based Network Access Control) restricts port access

to authorized users only. Authentication is done using the local user

database or an external RADIUS (Remote Authentication Dial In User

Service) server.

http://www.vnisoft.com/english/swapdrive.html


Security - Authentication

MAC address filtering

Fast Ethernet

Moving Process

Field Engineers

Access Point

AP Client

MAC Address Access Rights

00-11-12-23-34-45 Deny

00-11-12-23-34-46 Allow

Deny or Allow


Other Security Considerations

Other considerations include:• Security enhanced operating systems• Virtual Private Network (VPN) – tunneled encryption outside for traffic external to Plant network

• Enhanced authentication via Biometrics• Network Access Control and Protection to verify every device on the network


AUTHENTICATEusers and devices to the network

Posture and Remediatethe device for policy compliance

Audit and Reportwho is on my network

Network Access Control

Differentiated Accessrole based access control

NAC is solution that uses a set of protocols to define and implement a policy that describes how to secure access to the network by devices. Network Access Control controls access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do.Network Access Protection (NAP) is Microsoft’s implementation of NAC.


ISA 99


ISA 99 Working Groups


ISA 99 SALs

technical track securing ethernet/ip networks presented by: paul didier - cisco eddie lee - moxa

Documents

th annual meetingpage

networks dmz slide

management slide

server slide

virus network

network infrastructure

trusted network

plant networks