Holistic Cybersecurity for Industrial IoT Applications Arun Siddeswaran, Cisco Systems, Inc. Gregory Wilcox, Rockwell Automation, Inc. October 10, 2018
Industrial IoT (IIoT) offers the promise of business benefits through the use of innovative technology. The challenge for industrial operations is to develop a balanced security stance to take advantage of IIoT innovation while maintaining the integrity of industrial security best practices. No single product, technology or methodology can fully secure IIoT applications. Protecting IIoT assets requires a holistic security approach to help address different types of threats. This approach uses multiple layers of diverse technologies for protection and detection, applied at different levels of IloT applications, while being implemented by different personas. This paper, authored and presented by Cisco Systems and Rockwell Automation, will provide an overview of a holistic IIoT security framework. This framework incorporates aspects of IEC-62443 and NIST 800-82, leverages CIP Security™ for security zoning, addresses OT and IT personas, and enables secure connectivity from smart devices to smart machines to cloud applications. Agenda . . Industrial IoT (IloT) Opportunities / Challenges Industrial Security Trends . Holistic and Diverse Plant-wide Security . Key Takeaways . Recommended Resources Industrial IoT (IloT) Opportunities / Challenges

Source: Rockwell Automation
Threat Actors Internal/Insiders Hacktivist Cyber Criminals Nation States EQUIPMENT / SKIDS /MACHINES
Source: Rockwell Automation
Scalable, Reliable, Safe, Secure and Future-ready Industrial IoT Architectures requires an ecosystem. Cybersecurity Threats éat Types Threat Actors Internal/Insiders Removable Hackers Hacktivist Cyber Criminals Ransomware Nation States creasing Risk Endress+Hauser re bitoot 1Gri SMART Distribution Center
Internet of Things Information Technology Industrial loT Operational Technology Technical Track © 2018 ODVA. 2018 Industry Conference & 19th Annual Meeting All rights reserved. Source: Cisco-RA CPwE www.odva.org
Source: U.S. Department of Homeland Security 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org 9 Industrial Security Trends
Cyber threats increasing in frequency, scale, sophistication and severity of impact Several nations have undertaken offensive cyber operations against private sector targets Cyber threat cannot be eliminated, rather, cyber risk must be managed The likelihood of a catastrophic attack is remote at this time; rather, we envision an ongoing series of low-moderate level cyber attacks which will impose cumulative costs on U.S. economic competitiveness and national security Director of National Intelligence James Clapper to the House Permanent Select Committee on Intelligence - September 10, 2015 Cybersecurity market estimated to be worth $75.4B in 2015 Expected to reach $101B in 2018 and $170B by 2020 Source: U.S. Department of Homeland Security 2018 Industry Conference & 19th Annual Meeting All rights reserved.
www.odva.org

FY16 Incidents by Sector: 290 Total FY16 Infection Vector: 290 Total Source: U.S. Department of Homeland Security 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org
Stance on Availability, Safety and Security . Drivers for determining overall tolerance to risk and for developing risk management policies: –  Business practices –  Corporate / local standards – Application requirements – Applicable industry security standards –  Government regulations and compliance . Security/safety policies and procedures, for access control and network and security ownership: –  Alignment with industrial functional safety standards such as IEC 61508, IEC 62061 (SIL), ISO 13849 (PL) –  Alignment with industrial security standards such as IEC-62443 (formerly ISA99), NIST 800-82 and ICS-CERT
www.odva.org
18
All rights reserved.

. International Electrotechnical Commission (IEC) – IEC 62443 (Formerly ISA99), Industrial Automation and Control Systems (IACS) Security Zones and Conduits Defense-in-Depth Security Zones . National Institute of Standards and Technology (NIST) –   NIST 800-82, Industrial Control System (ICS) Security Cybersecurity Framework: Identify, Protect, Detect, Respond, Recover Defense-in-Depth NIS Security Zones . Department of Homeland Security – The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) . National Cybersecurity & Communications Integration Center (NCCIC) – Recommended Practices, Secure Network Architecture Defense-in-Depth Security Zones . Department of Homeland Security - Idaho National Lab –  DHS INL/EXT-06-11478 – Control Systems Cyber Security: Defense-in-Depth Strategies Defense-in-Depth Security Zones
All rights reserved.

IEC 62443 Industrial Automation and Control System Security
IEC 62443 - Series of Standards - Availability, Integrity, Confidentiality - Security Zones & Secure Conduits - Multiple Levels of Foundational Requirements - Multiple System Security Levels (SL 1 – SL 4) 2018 Industry Conference & 19th Annual Meeting Holistic and Diverse Plant-wide Security
. . Levels – ISA 95, Purdue Reference Model Zones – IEC 62443, NIST 800-82, DHS/INL/ICS-CERT Recommended Practices Source: Cisco-RA CPwE 2018 Industry Conference & 19th Annual Meeting All rights reserved.
Personas Control System Engineers (OT) Control System Engineers in Collaboration with IT Network Engineers (Industrial IT) Security Architects in Collaboration with Control Systems Engineers 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org Defense-in-Depth - Architectural Best Practices for Holistic and Diverse Threat Detection and Protection IEC 62443 - Zones & Conduits - Availability, Integrity, Confidentiality NIST 800-82 - Cybersecurity Framework - Identify, Protect, Detect, Respond, Recover DHS/INL/ICS-CERT - Recommended Practices
Defense-in-Depth - Architectural Best Practices for Holistic and Diverse Threat Detection and Protection IEC 62443 - Zones & Conduits - Availability, Integrity, Confidentiality NIST 800-82 - Cybersecurity Framework - Identify, Protect, Detect, Respond, Recover DHS/INL/ICS-CERT - Recommended Practices Personas Control System Engineers (OT) 2018 Industry Conference & 19th Annual Meeting All rights reserved.
Plant-wide Zoning . Functional Areas / Security Groups . Smaller Connected LANs –   Smaller Broadcast and Fault Domains – Smaller Domains of Trust (Security Groups) . IACS application micro- segmentation . Alignment with Security Standards –  IEC 62443-3-2, Security Zones and Secure Conduits Model –   DHS/INL/ICS-CERT Recommendations . Industrial IoT Technology Mix . Source: Rockwell Automation ustry Conference & 19th Annual Meeting All rights reserved.
Source: Rockwell Automation Technical Track © 2018 ODVA, Inc. 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org

Application / Device Security
CIP Security™, part of a holistic and diverse defense-in-depth security approach . Connections between Trusted Endpoints – Reject data that has been altered (integrity) Reject messages sent by untrusted people or l untrusted devices (authenticity) l Reject messages that request actions that are not allowed (authorization) . Capabilities l System management Micro-segmentation l – Device-based firewall – Legacy Device Support – e.g. Whitelisting . This does not replace the need for network security – e.g. firewalls, segmentation.
Personas Control System Engineers in Collaboration with IT Network Engineers (Industrial IT) Defense-in-Depth - Architectural Best Practices for Holistic and Diverse Threat Detection and Protection IEC 62443 - Zones & Conduits - Availability, Integrity, Confidentiality NIST 800-82 - Cybersecurity Framework - Identify, Protect, Detect, Respond, Recover DHS/INL/ICS-CERT - Recommended Practices 2018 Industry Conference & 19th Annual Meeting All rights reserved.
Defense-in-Depth - Architectural Best Practices for Holistic and Diverse Threat Detection and Protection IEC 62443 - Zones & Conduits - Availability, Integrity, Confidentiality NIST 800-82 - Cybersecurity Framework - Identify, Protect, Detect, Respond, Recover DHS/INL/ICS-CERT - Recommended Practices Source: Cisco-RA CPwE Personas IT Security Architects in Collaboration with Control Systems Engineers 2018 Industry Conference & 19th Annual Meeting All rights reserved.
Network Security - Segmentation (Zoning) - Functional Areas / Security Groups Source: Cisco-RA CPwE Technical Track © 2018 ODVA, Inc. 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org
Assign role-based groups Assign business-based groupings to provide consistent policy and access independent of network topology Get up and running quickly Utilize Identity Services and Security Group Tagging (SGT) to support group design Establish context-aware groups Leverage attributes such as location and device type to define group assignments 2018 Industry Conference & 19th Annual Meeting All rights reserved.
Security Policy based on Topology High cost and complex maintenance Non-Compliant Tag security policy to reduce OpEx Source: Cisco Systems 2018 Industry Conference & 19th Annual Meeting All rights reserved. IT Persona - Holistic and Diverse Plant-wide Security Network Security - Segmentation (Zoning) - Functional Areas / Security Groups Virtual Software-Defined Security Group Segmentation Challenges? Sample SGACL Policy Table Role-based Entorcement
Technical Track © 2018 ODVA. Inc 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org
Network Security - Segmentation (Zoning) - Functional Areas / Security Groups Virtual Software-Defined Security Group Segmentation Challenges? Technical Track © 2018 ODVA. I 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org
Network Security - Traffic Flow Analysis Monitor A Understand your network normal Gain real-time A situational awareness of all traffic A A Detect behaviors linked to APTs, insider threats, DDoS, and malware Analyze A Collect & Analyze holistic network audit trails A Achieve faster root cause analysis to conduct thorough forensic investigations A A Accelerate network troubleshooting & threat mitigation Respond quickly to threats by taking action to quarantine through Identity Services Leverage Network Behavior Anomaly detection & analytics
Network Security - Traffic Flow Analysis NetFlow Enabled Device Inspect Packet Source IP Address Destination IP Address Source Port Destination Port Layer 3 Protocol TOS Byte (DSCP) Input Interface NetFlow Cache Flow Information
Create a flow from the packet attributes Source: Cisco-RA CPwE 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org
Cloud Connectivity . technology . - - Source: Cisco-RA CPwE
www.odva.org
All rights reserved.

Reliable and Secure Remote Access . Balanced Security Stance –   Multiple layers of diverse technology Edge firewall with . access policies . IDMZ best practices . Identity services for AAA . Remote access server . Security zoning –   Enabling Remote Asset Management –   Protecting Integrity of Safety and Security Best Practices
Personas Control System Engineers (OT) Control System Engineers in Collaboration with IT Network Engineers (Industrial IT) Security Architects in Collaboration with Control Systems Engineers 2018 Industry Conference & 19th Annual Meeting All rights reserved. www.odva.org Defense-in-Depth - Architectural Best Practices for Holistic and Diverse Threat Detection and Protection IEC 62443 - Zones & Conduits - Availability, Integrity, Confidentiality NIST 800-82 - Cybersecurity Framework - Identify, Protect, Detect, Respond, Recover DHS/INL/ICS-CERT - Recommended Practices Key Takeaways
. Develop products that align with Industrial Automation and Control System (IACS) Security Standards and Technologies: –  IEC 62443 . Education and awareness for your teams and customers . Strategy to address 4-1 and 4-2, where it makes sense for your business –  CIP Security •   Harden EtherNet/IP products • Adopt CIP Security where it makes sense for your business . Conformance testing Participate in PlugFest .
. Utilize standards, reference models, tested and validated reference architectures (simplified design, quicker deployment, reduced risk in deploying new technology). . No single product, technology or methodology can fully secure IIoT applications.  Protecting IIoT assets requires a holistic security approach to help address different types of internal and external threats. This approach uses multiple layers (administrative, physical, electronic) of diverse technologies for threat protection and detection, applied at different levels of IIoT applications, while being implemented by different personas. . Although industrial security should be holistic for greenfield IIoT projects, there are many solutions available to help industrial operations incrementally improve the security stance for their legacy IIoT architectures.
. Implement risk management policies for availability, safety and security: determination of risk tolerance, performing a risk assessment and implementing risk mitigation solutions. . Align with Industrial Automation and Control System (IACS) Security Standards. Recommended Resources ODVA –  The Common Industrial Protocol (CIP) and the Family of CIP Networks –  Network Infrastructure for EtherNet/IP: Introduction and Considerations –  Media Planning and Installation Manual –  Guidelines for Using Device Level Ring (DLR) with EtherNet/IP –  Securing EtherNet/IP Networks
. Converged Plantwide Ethernet (CPwE) Architectures – Cisco –  Rockwell Automation . Education / Awareness –  Industrial IP Advantage (IIPA) eLearning industrial–ip.org . Training / Certification –  Industrial Networking Specialist •   IMINS Training, 200-401 Exam –  CCNA Industrial . IMINS2 Training, 200-601 Exam THANK YOU