Cyber Security - IT Security Meets OT Security
Paul Didier
Manufacturing Solution Architect
Cisco Systems
Presented at the ODVA2018 Industry Conference & 18th Annual Meeting
October 10, 2018
Stone Mountain, Georgia, USA
Abstract
This paper will look at how CIP Security can be used in-conjunction with current and in-development IT
Security tools and technologies to significantly improve plant floor security and protection. We will discuss
how to apply network access control and Plant and Cell-Area zone segmentation policies in a structured,scaleable manner. As well, we will review the value of monitoring network and security health through theuse of traffic flow monitoring (NetFlow/IPFIX, IETF RFC 7011-7015) features and security monitoring
applications. Lastly, we will look at some advanced, under-development standards to automatically apply
trust and policy based on IETF standards such as Bootstrapping Remote Secure Key Infrastructure(BRSKI) and Manufacturer Usage Description (MUD) specifications

Introduction: Why are we talking about thisThe IoT is expected to grow rapidly over the upcoming years. Below is a chart of estimated IoTunits/things that are expected to be connected. That large growth of things poses challenges inecosystems that are expected to manage closely the devices that are connected, such as Manufacturing.

Gratuitous IoT Growth Chart

25b+

IoT Units Installed BaseGrand Total

6.4b
3.8b

2014

4.9b

2015

2016

2017

2018

2019

2020

Source: http://www.cisco.com/c/en/us/solutions/service-provider/visual-networking-index-vni/index.html

2018 ODVA Industry Conference

1©2018 ODVA, Inc.

This rapid growth will be a significant problem for administrators of the networks that are the focus of thisgrowth, such as production facilities, factories and plants found in Manufacturing. A key consideration will
be how to automate the on-boarding and policy deployment for new things on the network. To that point,some “IT” new standards are being developed to help solve those challenges. But those can only beeffectively deployed with the cooperation of the thing makers – of which the ODVA is a good ecosystemof device vendors.
Security Standards – A thing’s view
This paper will introduce 2 developing IT-based, IETF standards that should help automate the security
processes for Industrial Automation and Control devices as they become operational in machine builder,customer or system integrator’s processes. They help automation the onboarding by automatically
deploying secure credential to devices (BRSKI) and help Manufacturers express key characteristics about
how the device should be classified and authorized – key steps to eventually segment and protect thedevices and the Industrial Automation and Control System where they operate. The table below depicts
some of the key standards in that process of securing devices.

BRSKI – An overview of Bootstrapping Remote Secure Key Infrastructure

The ODVA has established standards for devices around Identification and Authorization in the CIP
Security standards. Recently, a “pull-model” has been adopted as a mechanism to automate the deliveryof secure credentials to a CIP device. In the IETF, the Autonomic Networking Integrated Model andApproach (ANIMA) Working Group is developing a standard (RFC) around Bootstrapping Remote Secure
Key Infrastructure (BRSKI). The BRSKI standard outlines means to automatically deploy identity todevices so that they can be authorized on the network and establish secure communications. Thisenables Zero-touch provisioning of IACS devices that meets both the needs of OT for known devices tobe on the network and IT to do that in automatic and secure mechanisms.
The necessary components for this process to occur include:

2018 ODVA Industry Conference

2©2018 ODVA, Inc.

•
•
•
•

The device is manufactured with an X.509 certificate and private key that conform to IEEE
802.1AR.
• This is a standard definition of a “manufacturing certificate”
The device & production network support a multi-vendor bootstrapping protocol (BRSKI)• draft-ietf-anima-bootstrapping-keyinfra-04
The IoT device manufacturer supports a Manufacturer Authorized Signing Authority (MASA),
which keeps a log of which devices have been installed in which IT or OT domains
At the end of the BRSKI protocol, the device and production network have a mutual trust, and theIoT device can be admitted to the network.

Below is a depiction of the key components and the process outlined in BRSKI:

This model should be relevant for device vendors, machine builders, system integrators and customers
as a key part of securing the chain of suppliers needed to build production systems.

MUD – An overview of Manufacturer’s User Descriptions
In the IETF’s Operations and Management Area Working Group (opsawg), they are working on the
Manufacturer Usage Descriptor (MUD) specification. The MUD “file” would be a means for
manufacturer’s to describe policy about devices that can help classify and authorize devices as they join
production networks. This information can be used to help establish network policies aroundsegmentation to protect IAC devices and systems. The same working group also established IP Flow
Information and Export protocol (IPFIX) used to monitor communications in IP networks, such as a CIP
EtherNet/IP network.
The depiction below describes how a device can express where to find the relevant MUD file and how
IACS production network can retrieve, store and maintain those files. The device expresses this via a
Universal Resource Locator (URL).

2018 ODVA Industry Conference

3©2018 ODVA, Inc.

There are two basic means envisioned to support how a device can express where to find it’s MUD URL.
First the URL could be contained within a devices certificate, for example its CIP-Security certificate. Or it
can be programmed to express the URL via common network discovery or addressing functions, such as
LLDP or DHCP.
The below depicts how the MUD file could be retrieved via the certificate and via 802.1x autorization:

The below depicts how the MUF file could be retrieved via LLDP or DHCP

The end results of deploying MUD information is that the production system and network can establish
segmentation. This still requires more input and process from both the IT and OT communities, but it’s akey step in the process of automating these security procedures.
How it could Work – Simple
Together, BRSKI and MUD can be combined to automate much of the security deployment andimplementation for IACS devices, such as CIP, in production networks.
In a simple example envisioned for brownfield deployments with largely SW-based enhancements todevices. Below is a depiction of the process:1. Initial Configuration2018 ODVA Industry Conference

4©2018 ODVA, Inc.

2. Onboarding process

3. Device announces itself via LLDP or DHCP

2018 ODVA Industry Conference

5©2018 ODVA, Inc.

4. MUD File is retrieved

5. Approval given and Policy Assigned

2018 ODVA Industry Conference

6©2018 ODVA, Inc.

6. Network Access Control granted based on Policy

How it could Work – Complex
1. Initial Configuration2018 ODVA Industry Conference

7©2018 ODVA, Inc.

2. Onboarding Processa. Device Connects

b. Bootsrapping starts – find registrar

2018 ODVA Industry Conference

8©2018 ODVA, Inc.

c.

Initiate Registration – express MUD URL

d. Retrieve MUD file

2018 ODVA Industry Conference

9©2018 ODVA, Inc.

e. Request Voucherf.

Approval (for first time device types)

2018 ODVA Industry Conference

10©2018 ODVA, Inc.

3. Install Trust Anchor

4. Authenticate via 802.1x

2018 ODVA Industry Conference

11©2018 ODVA, Inc.

5. Determine Authorization

6. Network Access Control granted based on Policy

2018 ODVA Industry Conference

12©2018 ODVA, Inc.

References (optional)
IETF’s Anima Working group
Website: https://datatracker.ietf.org/wg/anima/about/
Email: anima@ietf.org
IETF’s BRSKI specification: https://datatracker.ietf.org/doc/draft-ietf-anima-bootstrapping-keyinfra/
IETF’s Operations and Management Area Working Group
Website: https://datatracker.ietf.org/wg/opsawg/documents/
Email: opsawg@ietf.org
IETF’s MUD specification: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/
IETF’s IPFIX specification: https://datatracker.ietf.org/doc/draft-ietf-opsawg-ipfix-bgp-community/*****************************************************************************************************************************************************The ideas, opinions, and recommendations expressed herein are intended to describe concepts of the author(s) for the possible useof ODVA technologies and do not reflect the ideas, opinions, and recommendation of ODVA per se. Because ODVA technologies
may be applied in many diverse situations and in conjunction with products and systems from multiple vendors, the reader andthose responsible for specifying ODVA networks must determine for themselves the suitability and the suitability of ideas, opinions,and recommendations expressed herein for intended use. Copyright ©2018 ODVA, Inc. All rights reserved. For permission toreproduce excerpts of this material, with appropriate attribution to the author(s), please contact ODVA on: TEL +1 734-975-8840
FAX +1 734-922-0027 EMAIL odva@odva.org WEB www.odva.org. CIP, Common Industrial Protocol, CIP Energy, CIP Motion, CIP
Safety, CIP Sync, CIP Security, CompoNet, ControlNet, DeviceNet, and EtherNet/IP are trademarks of ODVA, Inc. All othertrademarks are property of their respective owners.

2018 ODVA Industry Conference13©2018 ODVA, Inc.