随着物联网应用及 OT/IT 融合不断加深，网络攻击数量持续增长。工业信息安全解决方案必须具备领先水平，确保数据在全场景下安全应用。
Plant security applies a range of methods to ensure comprehensive security for your entire plant.
Specific cybersecurity concepts for industry build on standards and extensive expertise to ensure security for your plant. The necessary security measures are defined on the basis of a risk analysis, and are then implemented and regularly updated.
Plant operators can no longer afford to do without effective cybersecurity measures. Compliance requirements for security in an industrial setting and legislation to protect critical infrastructure are becoming much more stringent. But time and money for industrial cybersecurity are often short, and experts are rarely available. IT employees need support from security experts with expertise in automation. Then there’s time pressure, resulting from new compliance requirements and legislation, which demand that measures be put in place by a set deadline.
Security Assessments thoroughly analyze threats and vulnerabilities, identify risks, and provide recommendations to close the loopholes that are identified. They maximize transparency and provide a comprehensive overview of the current security status of your automation systems. You can choose between a compact, one-day on-site assessment (Industrial Security Check) or a comprehensive assessment in compliance with IEC 62443 (IEC 62443 Assessment). Industrial Security Consulting provides on-site support by experienced advisers to help you observe security guidelines and develop a plant-specific network layout. They also ensure your specific requirements are put in place.
How do you overcome the challenges of complex IT/OT technologies, the knowledge gap between IT and OT, and the lack of resources? Our ready-to-run IT/OT infrastructure is designed with cybersecurity in mind. Our experts are ready to provide immediate access to their expertise. Solutions for operational continuity maximize availability and cybersecurity compliance. In short: We can help you meet all relevant cybersecurity regulations.
The Industrial Automation Data Center is a custom-configured, ready-to-run IT/OT infrastructure with cybersecurity. Remote Industrial Operations Services include the management of your IT/OT infrastructure. Our experts take care of the operational continuity of your plant with continuous monitoring, proactive support, and managed security services.
Secure communication in industrial networks
The more the connection between IT and OT environments progresses within a company, the more important it is to protect the automation networks against unauthorized accesses.Protection must not compromise production, however, and must therefore be coordinated with the special requirements of automation networks.
It is critical to protect serial machines with identical subnets and safety requirements. All devices without built-in security must be protected within an automation cell. Firewall devices require significant management and configuration effort. A flexible security zone concept and centralized firewall management ensure high data throughput for high system availability and data security. In addition, maximum availability for OT networks, as well as real-time and safety environments, helps meet IEC 62443 requirements. Secure remote access and zero trust principles depend on perimeter and zone protection.
Choosing the right approach lays the foundation for secure network design. A typical example for implementing a network automation concept is a cell security design that relies on Layer 3-based isolation of the cells. The network is segmented by installing SCALANCE S Industrial Security Appliances in front of each cell. Communication is centrally managed by firewall rules via the SINEC NMS network management system. SINEC INS provides additional services for user authentication and centralized logging.
The cornerstone of secure network design begins with the choice of solution approach. In this implementation of an automation network concept, we present a cell security concept that relies on Layer 3-based cell isolation. Industrial Next Generation Firewall devices are placed in front of each cell. We also use Industrial Next Generation Firewalls as front-end and back-end firewalls.
Servicing distributed machines around the world requires significant logistical effort and travel costs. There is also a lack of visibility into distributed machines. The management of established VPN tunnels and the maintenance of connected devices require enormous efforts. Our solution provides huge bandwidth, easy setup, flexibility, easy extensibility and the prevention of manipulation through encryption. Secure data transmission and centralized authentication with UMC prevent unauthorized access. Automatic configuration of SCALANCE devices makes integration easy. And you don’t need special IT skills to manage all your VPN connections and users.
The SINEMA Remote Connect platform technology allows the secure management of tunnel connections (VPN) between the control center, service technicians and installed equipment. This avoids direct access to the corporate network where the machine being serviced is located.Service technicians use a SINEMA Remote Connect client, and the system or machine requiring maintenance is fitted with a SCALANCE S industrial security appliance or a SCALANCE M industrial router. Both the technician and the machine establish separate connections with a SINEMA Remote Connect server as required, and the identity of the participants is determined through an exchange of certificates. Only then is remote access to the machine allowed. Security CPs for SIMATIC S7-1200 and SIMATIC S7-1500 enable you to securely connect your controllers to Industrial Ethernet networks.
Remote Platform Software as a Service provides access to your own instance of the common Remote Service Platform (cRSP). It ensures enterprise security through centralized operation of the cRSP by Siemens and allows self-administration and configuration of the own cRSP instance. The platform can be used to remotely access own industrial devices in distributed locations and to remotely provide services to end customers at their locations.
The need for mobile work options – including remote access to data and systems – is also growing in the areas of development and production. During the operation and optimization phase, employees need access from all locations to these specific development and production areas. The same applies to support for operational processes or the implementation of quality management workflows. This access to the OT areas can be provided either within or outside the company network based on Zero Trust principles, with no need to alter the network infrastructure. Access from within or outside the customer network to OT areas – including restricted areas – must be possible down to machine level.
To incorporate Zero Trust principles, the Zero Trust OT Access Service, based on a security solution from Zscaler Inc., must be made available on the local SCALANCE LPE (Local Processing Engine) processing platform. Installing the solution as a Docker© container on the SCALANCE LPE enables access to industrial automation environments with maximum security.This is where three objectives complement each other: The powerful cell protection offered by “Defense in Depth,” secure access to production networks from outside (for example to enable flexible work from the office or mobile working), and the maximum availability and full real-time capability needed for production networks.
During the operational phase, OT needs data from IT, and also sends data back. This data must be secured in order to prevent data manipulation and data theft, and to comply with security standards. Direct accessibility from the external to the internal network and vice versa is prohibited within the OT infrastructure, however. The IT employees also need support from security experts with expertise in automation in order to put state-of-the-art IT/OT protection in place.
Industrial DMZ Infrastructure is a ready-to-run concept for IT/OT network segmentation with integrated security features. With front and back firewalls, the DMZ protects OT systems against unauthorized accesses from outside. Redundant, ultramodern Industrial Next Generation Firewalls not only function as port filters but also analyze the data at application level (Deep Packet Inspection). The services contained in Industrial DMZ, such as Remote Access, File Exchange, and Active Directory, are made available as virtual machines on a separate high-performance visualization host.The IDMZ itself is based on the Zero Trust concept.
Cyber-attacks must be detected as early as possible to avoid damage and costs. This requires visibility into all ports, network devices, and topology. That’s the only way to detect intrusions in time and respond quickly.
SINEC Security Monitor provides the essential Intrusion Detection System (IDS) capabilities. By mirroring and analyzing the network traffic, assets can be identified passively without disrupting ongoing production. Discovered assets can be correlated with known vulnerabilities to identify affected vulnerable devices. With signature-based anomaly detection based on an extensive database of threat intelligence, as well as signatureless anomaly detection with built-in AI mechanisms, you can discover multi-vendor vulnerabilities of the entire network. We offer the possibility of passive, non-intrusive OT optimized scans, which are also supporting OT specific communication protocols. Our solutions also provide up-to-date solution proposals to mitigate discovered vulnerabilities.
The Industrial Anomaly Detection service provides unparalleled 24/7 remote continuous security monitoring for industrial customers. Our cybersecurity experts, based out of the Remote Industrial Operations Services, utilize the SINEC Security Monitor to detect and act on threats. Our experts are specialists in OT security, and our transparency over data exchange within industrial networks facilitates anomaly detection in manufacturing. Early detection of anomalies and threats increases industrial cybersecurity. Our 100% passive monitoring solution provides state-of-the-art cybersecurity without impacting the monitored industrial control systems.
Protect your production, communications, and intellectual property
The basic principle of industrial enterprises is that production must continue to operate. That’s why automation systems must be protected against accesses and attempted manipulation. Communication within the systems, program code, and intellectual property are particularly deserving of protection.
The security configuration must be in place during the engineering and maintenance phase in order to protect the automation systems against cyberattacks. This must be both efficient and intuitive, to keep the commissioning process simple. Even during commissioning, engineers need an efficient method in order to meet security requirements and reduce human error. That doesn’t always happen, however, which means sensitive data can be left unprotected during commissioning. This is because users lack in-depth technical knowledge about the security configuration, or because the security measures create obstacles to the engineering process by requiring passwords, for example.
Security configuration is easier with help from the security assistant in TIA Portal. With TIA Portal V17, SIMATIC S7-1500/S7-1200, and HMI Panels, you configure confidential configuration data, secure PG/HMI communication, and passwords for different controller access levels. Communication between TIA Portal and the controller, or between the controller and the HMI, is then protected by TLS V1.3.
Unauthorized access to user programs, automation systems, and data must be prevented during the engineering and maintenance phases. Granular configuration of user rights, access management, and efficient administration of users for the entire plant essential are crucial. Importing users/groups from an already available Microsoft Active Directory server saves time and effort. Personalized access provides improved protection instead of the generic password access.
To ensure efficient user administration, import users and groups from Microsoft Active Directory to the UMC server. Connect the TIA Portal engineering station with the UMC server and import users and groups from the UMC server into TIA Portal. You can allocate rights and roles locally.
Because production is becoming increasingly dynamic, data access during the entire product lifecycle is critical. Devices, systems, and users exchange data continuously or as required, with no appropriate data access management or identification mechanisms in place. With no suitable identification mechanisms in place, anyone can connect to the network, which makes the system susceptible to man-in-the-middle attacks. Data is also transmitted in clear text and can be read within the network, which puts it at risk of theft, manipulation, espionage, and sabotage.
Secure communication is possible thanks to end-to-end encryption between TIA Portal, SIMATIC S7-1500/S7-1200, and HMI stations, based on Transport Layer Security (TLS) V1.3. That can be expanded to communication via OPC UA and web server, and also Open User Communication.
Protection for OT systems on which operating systems run is essential in both the operational and the optimization phases. Normally, end-point protection is used in order to ensure the system integrity that’s critical to ensuring the availability of control systems. At the same time, the threat from malware in the form of viruses, ransomware, and trojans is rising exponentially and targeting the industrial sector. Only approved solutions with OT-specific configuration are permitted for use in industrial systems.
We offer two contrasting approaches to Endpoint Protection against malware. Each approach has its benefits, depending on the situation.
In addition, we offer an interoperability test for Endpoint Detection and Response (EDR) to specifically configure a third party supplier’s version of SIMATIC PCS 7 and its EDR software.
Systems must be updated regularly during the operational and optimization phases. Many systems are vulnerable to new vulnerabilities reported daily, which hackers can exploit if no action is taken. Our solution provides instant transparency over relevant vulnerabilities based on sophisticated vulnerability intelligence. It also offers proactive management of cyber risks, easily integrated into your workflow, saving time and cost. Our service identifies and manages vulnerabilities in time to prevent downtime and costly attacks.
Using Vulnerability Services you can secure your infrastructure and your product portfolio by supplying relevant information on vulnerabilities that can be acted on. You receive vulnerability warnings for your individual system via a range of options:
It is crucial to log events to monitor security incidents and identify and respond to security breaches promptly. Events integrity is also essential because any tampering or loss of event data can lead to safety hazards and operational disruptions. We centralize log data from various devices and systems. Log integrity is guaranteed by encrypted event transmission, preventing any unauthorized access, tampering, or cyberattacks of the events. We monitor critical events and activities within the OT environment in real time.
Our solution enables event logging locally and then sends the events by utilizing the secure Syslog protocol. We provide end-to-end encryption between the SIMATIC S7-1500, SCALANCE “Syslog client”, and SINEC INS “Syslog server”.
Unauthorized access to machines and plants must be prevented at all times. During the operation and maintenance phase, individual control of access rights using existing employee ID cards is essential. This ensures maximum process reliability and efficiency. Secure and documented access to machines is crucial for maintaining transparency and traceability in the event of security incidents.
The SIMATIC RF1000 system prevents unauthorized persons from gaining access to your machines and systems, thereby preventing possible operating errors and production downtimes. The SIMATIC RF1100 is the new generation of card readers with convenient web-based management, PoE support and integration options via XML and ModbusTCP.
It is crucial to discover cyber-attacks to avoid damage and costs. Transparency about all ports, network participants, and topology is essential. You have to detect anomalies, intrusions, and multi-vendor vulnerabilities of the entire network to react fast. Passive, non-intrusive OT optimized scans are a possibility, as are OT-specific communication protocols. Up-to-date solution proposals to mitigate discovered vulnerabilities are essential.
SINEC Security Inspector offers unparalleled asset identification and vulnerability detection capabilities. Our platform provides a comprehensive suite of tools to identify assets and test cases to identify vulnerabilities. We utilize AI-based anomaly detection to proactively identify anomalies and intrusions.
A solid disaster recovery strategy is essential for quickly resuming production after a disruption and preventing data loss. In today’s increasingly cyber-threatened world, with new directives like NIS 2, a comprehensive backup solution is a must-have! Our solution ensures faster production restart after a breakdown or cybersecurity incident. And it prevents data loss with easy recovery from online backups. Plus, it’s a ready-to-run infrastructure with system-tested, pre-configured components.
Backup and Restore as part of the SIMATIC DCS / SCADA infrastructure automatically creates backups during plant operation. The solution is embedded in the Industrial Automation DataCenter. During operation, automatic backups are created from the computing cluster and stored on the backup server. In case of a failure, the virtual machines can easily be recovered from the backup server. This allows a fast recovery and prevents data loss.
On October 17, 2024, the EU’s NIS 2 cybersecurity directive became effective, mandating certain industries to show cybersecurity readiness and report significant incidents. Learn if you're impacted and how we can assist you.
