## 7 Security Considerations and Proposed Zero-Trust Security Model
### Proposed Zero-Trust Security Model
There is always a simple communication from the ICS systems to the servers reporting each production cycle's batch number and product count along with the time and date of manufacturing. This is one of the many examples when the manufacturing systems will automatically send data to the server for audit control and business documentation. All these communications must be encrypted and authenticated every time the data is sent for each cycle of production even though the communication is internal to the OT network. Every manufacturing phase is isolated from the others and no direct communication is possible between them to ensure if a system in one phase is under cyberattack, then it can be contained within that phase without being able to spread across other phases. The only common link between them is the storage server and thus it is very critical to secure the communications between the manufacturing devices and the storage server as shown in Figure 15.  
Ideally, one of the systems in each production phase is responsible for uploading the manufacturing data to the storage server, hence it is convenient and faster to use symmetric encryption, such as AES with a pre-shared key between the manufacturing device and the storage server for data encryption. The advantage of using the symmetric algorithm is it is faster when compared to an asymmetric one; however, the key management and its storage can be a challenge. Hence, the key management can either be handled by a centralized key distribution server (KDC) responsible for distributing session keys to all the manufacturing devices in every phase using the Kerberos protocol. However, in the case of limited infrastructure, keys can also be generated by one of the communicating entities and transported to the other using an asymmetric key distribution protocol. Certificate-based authentication of the identity for each manufacturing device while sending the data will provide data integrity and ensure that it was not modified during transmission. This can be achieved by generating digital certificates of public key signed by a trusted Certificate Authority (CA), and the process of a digital signature using DSA, as explained earlier in this section. While the above architecture is best suited when the storage server is hosted on-premises inside the manufacturing network, the design will change in the scenario of cloud storage hosted and managed by a third-party cloud provider. In that case, an additional component called a cloud connector must be implemented in the private manufacturing environment which is responsible for maintaining a secure connection with the cloud and any data that are to be stored will go via this cloud connector component. Figure 16 below shows the architecture of a zero-trust implementation in a hybrid environment. Figure 15: Zero-Trust security architecture without any implicit trust. All the communication channels are encrypted and secured with a proper authentication mechanism in place using certificates. Additionally, the cloud connector is responsible for policy evaluation before sending any data to the cloud. Since there is only a single point of contact for the cloud storage, it is configured in such a way that it only accepts requests from the cloud connector's IP address. The firewall rules are also set to support this configuration.