Industrial Ethernet Security Harmonization
Group – Collaboration is Key
Simon Merklin
Endress+Hauser

Welcome
Simon Merklin
Product Owner Security at Endress+Hauser
Leader of Industrial Ethernet Security Harmonization Group
Mail: simon.merklin@endress.com

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

2

Agenda••••••Why implementing security in industrial plants?
What is the Industrial Ethernet Security Harmonization Group (IESHG)?
Presentation of the results of the group
What`s next?
Wrap-up
Q&A

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

3

Industrial Ethernet Security Harmonization
Group – Collaboration is Key
Why implementing security in industrialplants? …and what did we as ODVA achieve
so far?

Industrial Automation Cybersecurity Definition•The prevention of– Illegal or unwanted penetration of IACSs– Intentional or unintentional interference with the proper and intended
operation of IACSs– Inappropriate access to confidential information in IACS•

Security includes devices, networks, operating systems,
applications and other programmable configurable componentsof the systemSource: ODVA Introduction to CIP Security 2022-05

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

5

Why implementing security in industrial plants?
NIS 2

Source: infoguard.ch/Technical Track© 2023 ODVA, Inc.

Cyber Resilience Act

Source: digital-strategy.ec.europa.eu/

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

6Cybersecurity properties

Source: ODVA Introduction to CIP Security 2022-05

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

7

Industrial Ethernet Security Harmonization
Group – Collaboration is Key
What is the IESHG? …and why should youcare?

What is the IESHG?
Before SPS fair 2022

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

After SPS fair 2022

www.odva.org

9Explaining the setup•••••

Collaboration between ODVA, FieldComm Group, OPC Foundation andPROFIBUS & PROFINET International
ODVA participants of IESHG:
Jack Visoky
Joakim Wiberg
Simon Merklin (independent lead)Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

10How we collaborate•••

Online Meetings
Bi-weekly meetings
The results of the group are circulated in the SDOs

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

11Mission of the IESHG•Our mission is the harmonization of cyber security strategies and concepts,
so that end users do not face unnecessary complexity when using security
concepts in their automation systems.

•This group will work out which concepts can be harmonized and how theseconcepts will be harmonized. ​•A harmonization is conceivable for a wide variety of topics, such as common
security recommendations for customers or sharing of security tools of theassociations.

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

12

Roadmap of IESHG
Release ofinternal
whitepaper

2021

Start to work on second
topic:
Certificate
authority/Certificate
management

Support IEC 61406-2
Concerning secure
device identifiers

2022

Start to work on first topic:
Role concepts of theindustrial ethernet securityprofiles

Technical Track© 2023 ODVA, Inc.

Release of our firstpublic whitepaper

2020

2024

2023

Start to work on third
topic:
Mechanism for
identifying devices

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

Work started:
User Authentication andAuthorization ​on Automation
Equipment​

www.odva.org

13

Industrial Ethernet Security Harmonization
Group – Collaboration is Key
IESHG deliverables

Results of internal whitepaper••••••

Role concepts of the industrial ethernet
security profiles
Certificate authority/Certificate management
Mechanism for identifying devices(cryptographical identities)
High level requirements scheme for devices
that utilize industrial ethernet security profiles
Integrity and authenticity checks of devices
and applications
Introductory material for end user motivation
and architecture view

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

15

Role concepts of the industrial ethernet security profiles••

Content:
A crucial part of the access management of industrial ethernet
communication are the role concepts that are used to restrict access to only
those actors who need and are trusted with the access. For example, amaintenance engineer should have a different level of access permission
than an administrator of a plant.
Goal: The group defines a basic set of roles with corresponding definitions
that can be used by all associations

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

16

Result of role concept evaluation•••

The SDOs have different roles that can be grouped into meta-roles.
However, the harmonization of these roles is not being pursued for the time
being, as the roles are too heterogeneous.
The meta-roles are defined and can be built upon.

EngineerTechnical Track© 2023 ODVA, Inc.

Admin

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

Supervisor

www.odva.org

17

Results of internal whitepaper
•
••
•
•
•

Role concepts of the industrial ethernet
security profiles
Certificate authority/Certificate management
Mechanism for identifying devices(cryptographical identities)
High level requirements scheme for devices
that utilize industrial ethernet security profiles
Integrity and authenticity checks of devicesand applications
Introductory material for end user motivation
and architecture view

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

18

Certificate authority/ Certificate management••

Content:
Certificate management and the corresponding authorities will play a central
role in future automation infrastructures. The certificates are a building blockto achieve the security goals integrity, authenticity and confidentiality.
Goal: The goal of this guideline is to establish a framework for a common
terminology that needs to be established in the market.

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

19

Whitepaper Certificate authority/Certificate management

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

20Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

21

What kind of device certificates are described in anindustrial environment?

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

22

Results of internal whitepaper••••••Role concepts of the industrial ethernet
security profiles
Certificate authority/Certificate management
Mechanism for identifying devices(cryptographical identities)
High level requirements scheme for devices
that utilize industrial ethernet security profiles
Integrity and authenticity checks of devices
and applications
Introductory material for end user motivation
and architecture view

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

23

Mechanism for identifying devices•Goal: The goal is to create a detailed guideline for manufacturers for
IDevIDs in device and to reflect the products origin. Furthermore, aguideline to reflect the product ownership via LDevIDs shall be created.

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

24Mechanism for identifying devices
Vendor productionplant▪ Device getsmanufactured invendor production
plant▪ Initial Device
Identifier (IDevID)are created in thedevice

privpub

Ethernetdevice

Technical Track© 2023 ODVA, Inc.

▪ A commonly used
standard for IDevIDs
is 802.1AR

Vendor production
plantVendor CA

priv▪ The IDevID of thedevice gets signedby the Vendor CA
private key.
Shipping

pubSigning

priv

pub

Ethernetdevice2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

25Mechanism for identifying devices
Asset Owner
plant▪ Asset owner takes
possession of thedevice

Validatesignature▪ Asset ownervalidates signatureof device’s IDevIDwith the public keyof the Vendor CA.

Software

pub

pub…

priv

Ethernet
Fielddevice
deviceTechnical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

26

Industrial Automation
DevID Profile

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

27

Industrial Ethernet Security Harmonization
Group – Collaboration is Key
What`s next?

Whats next?
•Today, each SDO, and each product vendor have their own role concepts
and authorization mechanisms.

•Some island solutions already emerged to manage the authentication andauthorization on each protocol in a centralized way.

•However, all these mechanisms to authenticate and authorize at different
protocols will end up to be an administrative nightmare.

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

29

New legislation leads to end-user pain
Today: 4-digit PIN0000

IA component 1

0000

0000

IA component 2

IA component 3

Future: individual digital interfaces
with individual
accounts with individual
passwords
kK&fE856

RSGRJ920!

HKJFSDW€

IA component 1

IA component 2

IA component 3

Security Administrator of plant toMaintenance Staff:Are you serious? You do not change thestandard password?

X 10.000

Maintenance Staff to Security Administrator:
Are you serious? How shall we handle all thesepasswords?! And what do we do when our staffchanges? Shall we change all the passwords all overagain?!

X 10.000

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

30

Industrial Ethernet Security Harmonization
Group – Collaboration is Key
Wrap-up and outlook

Wrap-up and outlook•••

Industrial Ethernet Security Harmonization Group is a cross-SDO working
group for the harmonization of industrial security topics.
The first white paper has been published (more will follow)
The next step will be an SDO-wide definition for device identifiers andcentralized user management

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

32

Q&A•••

Are there other topics that you would like to see harmonized?
How do you identify products in your plants today?
Did you ever have the problem of managing different interfaces in your plant?

Technical Track© 2023 ODVA, Inc.

2023 Industry Conference & 22nd Annual Meeting
All rights reserved.

www.odva.org

34