This document summarizes eWON's defense-in-depth security approach for remote access. It discusses six layers of security: 1) the eWON device, 2) application filtering with Talk2M, 3) encryption, 4) user management and accountability, 5) the Talk2M network infrastructure, and 6) security policies and procedures. For each layer, it provides details on the specific security controls and countermeasures used, such as network segregation, user authentication, encryption standards, infrastructure monitoring, and compatibility with customer networks and policies. The goal is to protect data integrity, availability, and confidentiality using multiple overlapping security layers based on industry standards and best practices.

1. Security @ eWON
Yvan Rudzinski, RSM eWON range, CEE & NE
yri@ewon.biz

2. • Ensuring a secure and reliable remote access
to your assets is vital for eWON business continuity
• Security VS Usability
• Needs of PLC technician & automation engineer
• Mandate of IT department
• Secure « by design », based on standards
VS
secure « by obscurity » …
Security
#1 PRIORITY @ eWON

3. • Mission of our Security Manager:
• Internal company security
• Services & products security
• Our duty is also to communicate and advise:
• https://ewon.biz/security
• https://ewon.biz/support/news/support
• News letters, white papers, …
• Assessment(s) by independant specialists
• Cyber security experts in Industry
Security
Our daily duty and commitment

4. What exactly we secure for You?
Quick overview of eWON remote access concept

5. Defense-in-depth approach
Layered security model
• Purpose is to protect integrity, availability & confidentiality
of data and information systems
• Coordinated use of multiple security
countermeasures, with several layers of security
controls
• Based on guidelines set forth by leading
security standards ( ISO27002, IEC 62443-2-4,
NIST Cyber security Framework 1.0) in addition to
other publications, guidelines and industry best practices

6. 1st layer: eWON device

7. • Different credential with Talk2M
account login
• Different levels of users
• Several levels of access & security
• R&W, services, etc …
1st layer: eWON device
eWON authentication

8. • Network segregation between the
WAN factory network and the LAN
machine network.
 users can only access authorized devices on LAN
• Security settings enable restriction of traffic between WAN & LAN
1st layer: eWON device
Network segregation

9. • Using eWON DI:
• enabling/disabling the eWON access to Internet
• VPN access can be controlled with
an external key switch
• Increase customer acceptance on the
whole RA solution
1st layer: eWON device
Physical switch

10. 2nd layer: Application

11. • 2 filtering levels
• No filtering in level “Standard”:
• All users access all devices on eWON LAN
• Filtering level “High”:
• Access to restricted list of Ethernet devices
connected on eWON LAN
2nd layer: Application
Filtering with Talk2M Free+

12. 2nd layer: Application
Filtering with Talk2M Pro (1)
• 4 Filtering levels
• User management
• Filtering level “Enforced” :
• Filter on gateways
• Access to restricted list of serial and USB
devices

13. 2nd layer: Application
Filtering with Talk2M Pro (2)
• Filtering level “Ultra”:
• Filter on services
• Access to restricted services ( ftp, http, …)
for a list of devices

14. 3rd layer: Encryption

15. • Used during authentication and on data for secure tunnel transport
• Both are SSL/TLS based:
• the X509 PKI (public key infrastructure)
for session authentication
• TLS protocol for key exchange
• Cipher-independent EVP (DES, 3DES, AES, BF)
interface for encrypting tunnel data,
• and the HMAC-SHA1 algorithm
for authenticating tunnel data
3rd layer: Encryption

16. 4th layer: User Management & Accountability

17. • Password reinforcement policies:
• Minimum length, requiring letter, digit and special char.
• Expiration period
• Old password list
• Double factor authentication:
• Set up by the Talk2M administrator
• After regular login/password
… a second window pops up, requiring SMS key
4th layer: User Management & Accountability
User logging in Talk2M

18. • Only for Talk2M Pro account:
• Group of users
• Pool of routers ( = devices)
• Assigning different rights to users
to allow the access to specific routers
4th layer: User Management & Accountability
Device and user Management

19. • For the Administrator of a Talk2M account
• Details which user connects to which router, how long and when
4th layer: User Management & Accountability
Monthly connection report

20. • For each eWON unit of a Talk2M account
• Provides more details about eWON registration, connection, disconnection, SMS
sent, user messages, etc.
4th layer: User Management & Accountability
eWON logs

21. 5th layer: Talk2M Network Infrastructure

22. • Total devices ever connected: 100 000+
• 28 000+ routers simultaneously connected
• From 150+ countries
• 5 million eCatcher VPN connections
• 10+ million emails
• 55 TB of user traffic
• 25 physical dedicated servers in 11 datacenters across 5 continents
• Dedicated servers in the 4 largest hosting providers worldwide
• Rackspace, OVH, IBM SoftLayer, Amazon
• But also with local players in remote regions
5th layer: Talk2M Network Infrastructure
Talk2M: facts & figures (1)

23. • All our hosting providers are Tier 1 and compliant with:
• ISO 27001
• SSAE 16/ISAE 3402 (formerly SAS 70)
• Servers are globally redundant:
• On-site load balancing
• Across several providers
• And geographical spread (USA, UK, FR, JP, AUS, CN, ZA, …)
• Service Level Agreement provided to Talk2MPro customers with:
• 99,6 % availability services on 365 days
• 4 hours max. breakdown
• No congestion on servers with reserved bandwidth
5th layer: Talk2M Network Infrastructure
Talk2M: facts & figures (2)

24. 5th layer: Talk2M Network Infrastructure
Talk2M: facts & figures (3)
Worldwide presence

25. 5th layer : Talk2M Network Infrastructure
Talk2M: facts & figures (4)
Talk2M shapes the world!

26. 5th layer: Talk2M Network Infrastructure
Talk2M: infrastructure monitoring (1)
Talk2M support console

27. 5th layer: Talk2M Network Infrastructure
Talk2M: infrastructure monitoring (2)
• Continuous automated health checks
• Server connectivity ( ping & TCP tests)
• Processes, heartbeats
• Disk space
• Possible signs of anormal activity, cyber attacks
• Amount of connected eWONs
• Status & health of each VPN connection
• Consistency of DB
• …

28. 5th layer: Talk2M Network Infrastructure
Talk2M: infrastructure monitoring (3)
• Alerts: SMS texts to 5 persons
• 1 dev engineer on duty 24/7/365
• Incident reporting:
• Each incident is reported into our tracking system
• Support, Sales, Marketing & Mgt are automatically notified
• Public notification: http://www.talk2m.com/status

29. 6th layer: Policies & Procedures

30. • Enhanced compatibility with:
• Customer network due to our « Firewall friendly » approach
• Only “outbound” connections
• Use standard ports: 80 (Web access), 1194 (UDP), 443 (HTTPS)
• Compatible with most proxy servers
• Corporate security policies at customer’s
• No intrusive traffic
• Outgoing traffic can be « whitelisted » towards Talk2M servers IP only
• Talk2M administrator can:
• customize and reinforce the password policy to match corporate compliance
• restrict which user can access which device and service remotely
• monitor accurately all possible usage with monthly connection reports and logs
6th layer: Policies & Procedures

31. Thanks for listening!
www.hms-networks.com