1. Special Security Report
The Target - Industrial Control Systems
Industrial control systems (ICS) are used for managing critical
infrastructure networks such as smart grids, gas supply and
many other critical services to modern life. Hackers looking to
disrupt civilian life have been focusing lately on critical
infrastructure networks to reduce the capability of local and
state governments’ to provide basic services.
The Challenge - Authentication & Control
ICS networks are considered safe because they are assumed to
be isolated from the outside world. However, there are two
main situations where this isolation is compromised: when the
system is physically accessed for system maintenance, and
during remote maintenance.
From both the network operations and the network security
aspects, maintenance operations pose a high-level risk to the
network. Without proper control, access rights granted for
maintenance operations may be improperly used for illicit
activities on the ICS, either by a malicious insider or an
unintentional employee with an infected laptop.
The Radiflow-NEC Solution
Radiflow and NEC have developed an integrated solution for
securing ICSs during both remote and on-site (physical)
maintenance operations. The solution, focused on
human-generated traffic and based on the RBAC (Role Base
Access Control) methodology, is compatible with the Guidelines
for Remote Access Management in NERC CIP Ver.5.
Under the proposed solution, the first, if not the most crucial
step prior to granting a user access to the facility, as well as
network access, is verifying the identity of the user.
This is achieved using an advanced two-factor authentication
scheme utilizing the NEC facial recognition system and
Electronic Card (or username and password in the case of
remote maintenance).
Once the user’s identity is verified, however, it is still imperative
to ensure that he has access to only specific devices on the
network and specific privileges on each device.
Upon authentication, a firewall configuration file is downloaded
to the Radiflow routers. These firewall rules enforce the
predefined task parameters, so that during the maintenance
operation the user is able to send only a specific range of
commands to predefined assets. The user’s privileges must be
aligned with the task at hand, so that he won’t be able to engage
with any other device.
At the same time, inside the facility, the technician’s location is
constantly monitored by the video surveillance system, which
escorts him to the maintained relevant device.
Any violations of these rules are monitored and logged, and
sent as alerts to the control center along with the all network
traffic data. This capability provides a comprehensive, real-time
picture of the maintenance performed.
A New Approach to Managing Human
Maintenance Activities at Remote Installations
Combined with NEC’s Physical Security Solution Suite, offering biometric
identification, access gates, video surveillance and behavior pattern analysis,
Radiflow’s ruggedized routers and gateways (including the 3180 Switch/Router,
shown) allow securing ICSs during remote and on-site (physical) maintenance.
 RTU 2
 
The Radiflow-NEC integrated solution uses two-factor authentication to limit
access to specific devices, allowing secure remote or on-site maintenance.
RTU 1
Radiflow
Server
Radiflow
3180
NEC
Server

2. For example: Brad, a technician for a power generation firm, is
tasked with servicing an ICS at a remote site used for
controlling the set points in one of the generator rooms, and
reduce a target value in one of the RTUs in that generator
room.
To enter the substation, Brad’s electronic card credentials are
cross referenced with his image, as captured on camera and
analyzed by NEC’s facial recognition system.
Once Brad’s credentials are verified, he receives permission to
connect his laptop to the network in order to access the ICS.
However, accidently or not, Brad attempts to instead increase
the target value. Radiflow’s DPI (Deep-Packet Inspection) will
instantly block this session to prevent network-wide damage
and notify the control center about the violation.
Conclusion
With the proliferation of ICS automation at infrastructure
substations and remote facilities and the rising threat of cyber
attacks, it is extremely important to impose strong security for
maintenance operations, both remote and on-site. By
combining NEC’s Physical Security Solutions Suite and
Radiflow’s firewalled switch/routers, you can practically
eliminate the risk inherent to exposing the network to
maintenance operations.
A New Approach to Managing Human Maintenance Activities at Remote
Installations
Specificationsaresubjecttochangewithoutpriornotice.©2015RadiflowLTD.
Special Security Report
Radiflow Secure Switch/Routers
• Ruggedized industrial-grade hardware for harsh operating
conditions
• Distributed per-port DPI (Deep Packet Inspection) SCADA
Firewall with Anomaly behavior detection
• Network Learning for easy creation of firewall rules
• Two-Factor authentication Remote Access, full auditing
• IPSec VPN over Cellular (dual cellular modem) and Fiber
with X.509 certificates
• Syslog reporting to SIEM tools for integration of physical
and cyber security
• Secure management using SNMPv3, SSH and RADIUS
NEC’s Physical Security Solution Suite
• Comprehensive solution set including biometric identification,
access gates, video surveillance & behavior pattern analysis
• Facial recognition solutions recognized as world’s fastest
and most accurate biometric technologies for identification
• Behavior detection solution allows verifying user’s locations
against predetermined list of accessible devices and areas
• Highly resilient to varying environmental conditions
• Highly scalable to large facilities, systems & traffic
• Easy integration with existing systems
• Ability to process live and archived video images
Sample Use Cases
Resulting Process:
Follow maintenance person’s movements inside facility using video surveillance system;
match location of employee against work order.
Triggering Events:
> Visual Positioning/NFC
> Work Order
Resulting Process:
Block access to device and/or access to network; generate alarm and push video alert
to control center; log all activities.
Triggering Events:
> Unauthorized operation
on maintained device
Resulting Process:
Pertinent network traffic flow is automatically mirrored and fully recorded packet-by-
packet by the logging function of the integrated control server.
Triggering Events:
> Execution of admin
commands
Resulting Process:
Redirect and zoom camera toward the physical switch where violation occured; push
video alert to control room; log violation.
Triggering Events:
> Network access violation
> Visual positioning
Resulting Process:
Unlock door upon combined successful authentication by facial recognition and ID
card authentication; firewall rules are sent to RADiFlow router upon authentication
to assure access to only specific devices and commands specified by the work order.
Triggering Events:
> Facial Recognition
> ID Card
> Work Order