Secure Connectivity for Rail Infrastructure Monitoring

Restricted © Siemens Mobility GmbH 2019
2019Page 1 Andres G. Guilarte / Secure Connectivity
Bulletproof IoT in Rail
Safe & Secure Connectivity for rail
www.siemens.com.dcuSiemens Mobility GmbH 2019

Cybersecurity in Rail
more frequent and severe and it will only increase
WannaCry

… and risks
WHY?
Increased connectivity and evolving threat landscape
Opportunities
Blue Boxing
Cryptovirology
AOHell
Level Seven Crew hack
Denial-of-service attacks
Cloudbleed
sl1nk SCADA hacks
Meltdown/Spectre
Infineon/TPM
AT&T Hack Morris Worm Melissa Worm
ILOVEYOU WannaCry
NotPetya
Heartbleed
Industroyer/Chrashoverride
Stuxnet
Signaling systems move
from dedicated and
separate to
interconnected and
standardized system of
systems using COTS
components
Exposure to malicious
cyber attacks is also
growing dramatically,
putting our lives and the
stability of
our society at risk
2000 2004 2008 2012 2016 202019961988 1992
Remote Operation of
Interlocking
CBTC over WiFi
Electronic
Interlocking
Industrial IoT – Data Analytics – Artificial Intelligence
ETCS over GSM-R
Page 3

Approaches for rail cyber security
Application of accepted and aligned standards
IEC
62443
ISO 27001
Page 4

Charter of Trust co-founded by Siemens in 2018
1 Protecting the data of individuals
and companies
2 Preventing damage from people,
companies and infrastructures
3 Establishing a reliable foundation on which confidence
in a networked, digital world can take root and grow
Page 5
Leading global companies joined forces for creating security in a networked world.

The cost of “IoT” has dropped
as new ways to analyze mountains of data were developed
What is overlooked is a secure and cost effective solution to connect critical infrastructure
to the Internet
For example…

2019Page 7 Andres G. Guilarte / Secure Connectivity2019Page 7 Andres G. Guilarte / Secure Connectivity
Cybersecurity regulations for Rail
• IEC 62443: Industrial communication
networks – network and system security
• ISO 27001: Information security
management systems
Security standards
• OT security threats are a relatively new topic for
the industry
• Industrial systems typically have a long lifecycle (≥
20 years)
• Increasing connectivity (convergence of IT and OT,
connection to cloud etc.)
Long life-cycles + complex systems
+ IT overlapping Security of network and
information systems (NIS)
IT-Sicherheitsgesetz
National strategy for the
protection against cyber risks
APCIP (Austrian Program
for Critical Infrastructure
Protection)
Ley 8/2011
Loi de Programmation
Militaire
UK Cyber Security Strategy;
Rail Cyber Security
China Cyber Security Law
The Comprehensive National
Cybersecurity Initiative
Russian federal service for
technical and export control,
N 31 of 03.14.2014
New national and international
security laws and initiatives
FR Network and Information Security Agency (ANSSI) - “Firewalls are not allowed to be used to connect
any class 3 network, such as railway switching systems, to a lower class network or corporate network,
only unidirectional technology is permitted”
US Department of Homeland Security (DHS): Regulators have encouraged the use of unidirectional
gateways to protect equipment and processes in safety instrumented systems (SiS)
UK Department for Transport (DFT) - Signaling systems should be protected with unidirectional gateways
and that there should be a clear separation between enterprise and operational rail networks.
DE German association of machinery and plant engineering (VDMA) - Recommends the use of data
diodes to protect critical network segments & transition zones.
Factors

Rail security and IT security have different priorities
Harsh Environment
Location
of use
Climate-controlled offices
Rail commissioning
personnel Installation Network specialists
Automation-specific Topology Star-shaped
Network failure
times <300 ms
Availability
Second to minute range
accepted
Low, switches
with fewer ports
Device
density
High, switches with large
number of ports
Part of automation
monitoring
Network
monitoring
By trained
specialist
Integrity
Availability
ConfidentialityConfidentiality
Availability
Integrity
Rail (OT) Security IT Security
Highest priority

2019Page 9 Andres G. Guilarte / Secure Connectivity2019Page 9 Andres G. Guilarte / Secure Connectivity
Connectivity Built-in
Siemens offers to pre-equip new
systems with secure connectivity HW
as a standard !
EBA Certified
Highest safety standards in rail
automation !
Protecting & Connecting data of safety critical networks
DCU, a World first!

DCU provides cost-effective secure connectivity to all critical
infrastructure
10
01
01
11
01
00
11
10
10
01
01
11
10
01
01
11
10
01
01
00
01
00
11
10
10
01
01
11
10
01
01
11
Data Capture Unit (HW)
DCU
One-way gateway (SW)
Receiver
One-way gateway (SW)
Sender
Industrial IoT Operating System
(cloud or local IT)
Receive and push data
Customer Assets
Isolates Critical OT network from IT network
Your critical network
remains physically isolated
via the integration of the
Data Capture Unit (DCU)
as an IT – OT
100% secure edge device
10
01
01
11
10
01
01
11
10
01
01
11
MindSphere Apps
Collects and filter data
Critical Network
(OT)
(IT)
Open Network
has lowered the cost of
unidirectional connectivity 20X

DCU Connects while keeping networks physically separated
No possibility of interfering with the critical network
• Purely passive with no influence on critical
network—no possibility of introducing external data
into critical network
• Unidirectional, unobtrusive, and undetectable—
keeps critical and open networks physically
separated
• Use as a smart & secure network tap or one-way
gateway with gateway applications
• IEC 62443-4-2 Security Level 3 with Secure Super
Long Life Linux OS and IT security features
• Gateway protocols like file transfer and OPC-UA
across a unidirectional connection
Networks protected by firewalls are not
infallible; in all known cases of successful
cyber-attacks, networks had firewalls in
place
IPC 1 DCU IPC 2 Power

How?
Our hardware design
▪ Guarantees complete protection and
isolation of networks, hardware
design that lacks the vulnerability of
firewalls
▪ Reliable - MTBF +500.000hrs
▪ Privacy and data integrity via TLS for
encrypted communication to IT or
cloud
▪ Galvanic isolation & physical
separation ensures only one-way
communication
▪ Optional software emulating bi-
directional communication
Critical network Open network
Rx
TxPHY
PHY
Rx
Tx
Rx
Tx
Rx
Tx
Rx
Tx
4
Siemens
DCU
Electromagnetic induction

Interlockings
Real time data capture from electronic interlocking safety network
Siemens Mobility Data Center
Data analytics and visualization of bus communications to identify anomalies
and point machine defect prediction 6-8 hours in advance of a potential failure
Siemens Simis Interlocking
Bremen HbF (Main Station)
Vital electronic interlocking system

Overview
Key features
• Status of interlocking over a defined
time period with monitoring :
• Switches
• BUS communication (telegram
retransmissions)
• Status and time signals are turned
on/off,
• closing time of level crossings
• EGM time stamp messages
Benefits
• Increase availability without
additional sensors
• Efficient planning of maintenance
activities/ optimization of
maintenance planning

Interlocking messaging data
Allows to identify trends
Interlocking
messaging data
(Simis C, Simis D,
Sicas)
Analysis of interlocking traffic and traffic quality
Point failure prediction
Occupation analysis of infrastructure components
Monitoring of media entry in cabling for signals
Improvement of maintenance after earthing events

Interlocking messaging data
Allows to identify trends .. Point machine operation behavior and weather

Wayside equipment
Real time data capture from safety network for track circuits data
Wayside
Track circuit component
Equipment room
Data from control module
Central office
Cloud-based data processing, analysis and visualization
Siemens TCM 100
DCU provides secure, passive access to safety critical network
Livestream

Secure Connectivity solution + App
App: Clearguard Performance Monitoring
Basic functionalities:
1. Access from any PC, Tablet or Smartphone.
2. Real time overview and status of all the connected assets
3. Real time performance monitoring and event recording
4. Real time and automatic notifications of asset malfunction
5. Centralized management of alarms per asset / line.
6. Digital tickets for fast troubleshooting and paperless response to alarms
7. Automatic troubleshooting guide for fast repair / calibration
8. Simultaneous visualization of multiple assets for behavior analysis with
neighboring effect
9. Different user accounts for operator / maintainer profiles.
10. 5yrs storage of all the data generated by the assets for investigation of
failure/incidents analysis or data analytics.

Operation Control Systems
Real-time data capture to enable digital services
Problem
• Operator needed connectivity for an operation and control system.
• No compromise on safety – Zero modification of safety case.
• Critical data needed to be safely captured and sent across the globe for
monitoring, data analysis, and smart prediction.
Solution
• Data sent to Germany for remote support during start-ups and real time system
error analysis to reduced downtime.
Customer Benefit
• DCU proved trustworthy and simple for secure communication of critical data
• No additional sensors
• Zero interference to the existing system
• Reduced system downtime by giving remote access to the system
Operation Control System
Hong Kong

Intrusion Detection Systems (IDS)
= Safe and secure transmission of network traffic/bus communication data; DCU = Data Capture Unit
Step 1
Safe and secure transmission
of network traffic
Step 2
Automatic identification
of anomalies + intrusions
Step 3
• “Sort out” false positives
• Analysis + evaluation
Step 4
Quick notifications
Problem-solving advice, others
On-premise
Operations control system
DCU
Intrusion
Detection System
Operator - End customer
Off-premise or Cloud
Monitor
Anomalies, suspicious
incidents
Cybersecurity Operations Center
(1st level)
Support by R&D
(3rd level)
Support by security experts
(2nd level)
Dashboard

Real-time Intrusion Detection of safety critical Networks
Remote or Central office
On-premise or Cloud-based Intrusion detection
Interlocking Room
Data from Interlocking network
IDS SW

Bulletproof IoT in Rail
More information at www.siemens.com/dcu
Andres G. Guilarte
Global Business and Technology strategy
Siemens Mobility GmbH
Berlin & Braunschweig, Germany
andres.guilarte@siemens.com

Q&A
What is the most important need for you, as an operator/vendor?
A
Q
1 Secure access to critical network to get real-time data
2 Vendor locked data – proprietary protocols
3 Real time data Vs. warehoused
4 Network security – Access to cloud
5 Asset monitoring

Data-based & cloud applications for
Daily Rail security management tasks
Cloud-based
condition monitoring
• Cloud connection without
increase of attack surface
• Option for "dormant" bi-
directional link for algorithm
updates
Managed OT security
services
• Ensured plant communication
for security data collection
• Option to protect a single
connection or individual
critical network segments
Invisible security
monitoring
• Overlay security monitoring network
• Invisible to attackers
• Prevention of anti-forensic
techniques (e.g., footprint cleaning)
Network monitoring
and management
• Ensured availability of critical assets
is monitored
• Segmented and monitored
communication
• Option for true air-gapped systems
(SIS, interlocking networks)
Secure delivery of patches
and updates
• Unidirectional file replication from
DMZ to secure "update zone"
• Focus on antivirus updates and
software update delivery
• Inbound only mode prevents
interactive malicious behavior
Transient media secure
access
• Additional step to prevent cross-
contamination across multiple
critical network zones
• Combination of diode and USB
storage media sanitization possible
• Ensured protection when using
USB media usage
And more …
Process historian data
collection
Database replication
CCTV
NTP
Edge or cloud
Analytics
• Predictive maintenance
• Process Optimization
• AI-enabled applications

Features
▪ Power supply
24 VDC (16.8-78 VDC)
▪ Power consumption
3.4 to 7.2 W
▪ Current consumption
229 mA (24V / four ports active)
▪ Overvoltage protection
85 VDC, 1 s
▪ Electrical isolation
Ethernet ports 1.5 kV
▪ Electrical isolation
Power supply 3.5 kV
▪ USB port max current supply
500 mA
▪ Temperature range
-40ºC to +85ºC / - 40ºF to +185ºF
▪ Dimensions (HxWxD)
167 x 60.6 x 110.5 mm
▪ MTBF
+/- 500.000 hrs
Specifications
DCU 1.0 ▪ Passive interception, galvanic
isolation, and physical separation
between critical and open network
▪ 4x 10 Mbit/s, full duplex
capture ports
▪ 1x Gigabit Ethernet output
▪ >30 Mbit/s throughput
▪ 1x USB 3.0 interface
▪ PCAPNG packet capture format
▪ PCAP filtering
▪ Protocol independent packet capture
▪ Local storage on USB drive
▪ NTP time synchronization
▪ Linux OS
Features
DCU 2.0 ▪ Passive interception, galvanic
isolation, and physical separation
between critical and open network
▪ 4x 10/100 Mbit/s, full duplex
capture ports
▪ 1x Gigabit Ethernet output1
▪ >200 Mbit/s throughput
▪ 2x USB 3.0 interface
▪ PCAPNG packet capture format
▪ PCAP filtering
▪ Protocol independent packet capture
▪ Local storage on USB drive
▪ NTP time synchronization
▪ Secure Super Long Life (S2L2)
Linux OS
▪ IEC 62443-4-2 Security Level 3
compliant
▪ Data integrity via sequence
numbers and SHA512 based record
signatures
▪ Secure communication via TLS1.2
▪ Certificate management in PKI
infrastructure or enabled for local
security measures
▪ Secure boot and secure key store
▪ Hardware watchdog
▪ Keep alive messages
▪ RS485 interface for feedback
channel
▪ SD card with configuration data
▪ OPC UA based diagnostic interface
▪ Tagged VLAN support
▪ Prepared for IPv6 operation
▪ SNMPv3 alarm messages
▪ Firmware update
Features

App
Cloud / MindSphere
SW - Gateway
Receiver
SW- Gateway- Data
Collector
Customer Assets
Secure Connectivity Solution + Apps
Solution breakdown
Local
OpenNetworkSafetyNetwork
Gateway
Data Collector
DCU
1
2
4
6
5
▪ Application running in MindSphere
▪ Visualization on standard PC web browsers or mobile devices (Android/iOS)
▪ Cloud / MindSphere IoT Platform collecting real time/live data
▪ Host Application for visualization, advanced functions and analytics
▪ Capture and store data from DCU
▪ Secure network to the cloud
▪ Push data to local LAN or cloud via dedicated secured MindSphere Protocol
▪ Perform cybersecurity function via Data Diode
▪ Isolate Safety network from Open Network (Secure bridge between OT & IT)
▪ Capture and filter all diagnostic data from the connected/monitored aseets
▪ Siemens or third party products in operation
HW - Data Capture
Unit (DCU)
3
Cloud

DCU as a secure network tap or one-way gateway
Configurations
Securely capture any bit stream, independent of protocol, over
any asset or network segment or terminated connection in
a critical network
Enable a full duplex communication link over unidirectional
gateway with Client and Server proxies running gateway
software
1. Monitoring 2. One-way gateway

Connectivity in Rail is a reality
Rolling stock and rail infrastructure
Trains and infrastructure are
connected across systems
Maintenance and operations
Optimized service for 100% availability & Security
Data analysis and rail expertise
Artificial intelligence combined
with unique domain know-how
Ecosystem
Open ecosystem integrating
best-in-class rail applications
Mobility connectivity solution suite
Various standardized solutions for assets
of all types and ages are provided by our
connectivity toolbox.

Optional Cybersecurity Offerings
Secure OT – IT Integration
Goals
Predict when and where to
expect security risks, before
they occur
Enable the organization
to adequately address security
and provide technology as
building blocks for security
Offering
We offer
• Threat and Risk Analysis
• Self-Assessments
• Threat Intelligence
• Security Analytics
We offer
• Managed Identities and Access
• Secure Communications and
Applications
• Embedded Security Anchors
• Security Robustness
• Advanced Cryptography
• Security Standardization
(e.g. Protocols, Interfaces)
• Security Requirements
• Security Architecture
• Security Engineering
• Customizing and Integrating
Building Blocks and 3rd Party
Components
• Process Improvements
• Qualification and Training,
Coaching
• Definition of Roles in Organization
• Technical Guidelines
(e.g. Hardening, Coding)
Measure and assure
adequate security level
We offer
• Penetration Tests and Attestation
• Security Test Tools
• Compliance Readiness
Assessment (e.g. ISO2700x,
IEC62443)

Secure Connectivity for Rail Infrastructure Monitoring

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Secure Connectivity for Rail Infrastructure Monitoring

Similar to Secure Connectivity for Rail Infrastructure Monitoring (20)

Recently uploaded

Recently uploaded (20)

Secure Connectivity for Rail Infrastructure Monitoring