This document discusses security aspects related to developing enterprise applications for Industry 4.0. It begins with an overview of Industry 4.0 and its key components like cyber-physical systems, the internet of things, and smart factories. It then discusses the complexity of enterprise applications and important non-functional requirements like security, performance, and availability. The document outlines the OWASP top 10 security risks and provides examples of recent security incidents. It emphasizes that with Industry 4.0, security must extend from enterprise IT to connected industrial systems and devices. The document concludes with discussing building security into each phase of development from design through implementation, testing, and ongoing maintenance.

1. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 1
www.convergence-creators.siemens.comwww.convergence-creators.siemens.com
Security aspects
in development of enterprise applications
Industry 4.0 and Cybersecurity
Siemens Convergence Creators

2. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 2
www.convergence-creators.siemens.com
Industry 4.0
Next Industrial Revolution
Industry 4.0
- German federal government announced it in 2011 as one of their key
strategic initiatives - “High-Tech Strategy 2020 for Germany”1
- An industrial revolution that‘s „predicted a-priori“1
- Was introduced as a strategy, giving vision and basic solutions it aims at
and what it should be, yet „most companies in Germany do not have a clear
understanding of what Industrie 4.0 is and what it will look like”1
Key Components
 Cyber-Physical Systems (CPS)
 Internet of Things (IoT)
 Internet of Services (IoS)
 Smart Factory (SF)
CPS IoT IoS SF
Interoperability X X X X
Virtualization X - - X
Decentralization X - - X
Real-Time - - - X
SOA - - X -
Modularity - - X -
Key Principles
 Interoperability
 Virtualization
 Decentralization
 Real-Time
 SOA
 Modularity

3. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 3
www.convergence-creators.siemens.com
Enterprise Applications and Security
Enterprise Application:
MSDN definition 7 – “An enterprise application is
a business application”, “complex, scalable,
distributed, component-based, and mission-
critical”, “In short, they are highly complex
systems.”
Martin Fowler 11 – “Enterprise applications are
about the display, manipulation, and storage of
large amounts of often complex data and the
support or automation of business processes
with that data. Examples include reservation
systems, financial systems, supply chain
systems, and many others that run modern
business. Enterprise applications have their own
particular challenges and solutions...”
Systems that are:
• Complex
• Layered
• Modularized
• Distributed
• Mission-critical
...
a lot of REQUIREMENTS
Functional Non-Functional
Performance
Availability
Reliability
Recoverability
Integrity
Scalability
Security
Serviceability
Usability
Maintainability
Portability
Interoperability
Extendibility

4. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 4
www.convergence-creators.siemens.com
OWASP Top 10
The Ten Most Critical Web Application Security Risks (2017 RC1)3
1 Injection Injection flaws – e.g. SQL/OS/XXE/LDAP injection
2 Broken Authentication and Session Management Incorrect authentication/session management implementation
3 Cross-Site Scripting (XSS) Allowing attackers to execute scripts in victim’s browser
4 Broken Access Control Improper enforcing of restrictions on authenticated users
5 Security Misconfiguration
Old software, improper configuration of applications,
application/database/web servers, frameworks, platforms, etc.
6 Sensitive Data Exposure Lack of encryption of sensitive data during it’s rest or transit
7 Insufficient Attack Protection Insufficient basic input validation or similar techniques
8 Cross-Site Request Forgery
Forcing victim’s browser to generate requests a vulnerable
application thinks are legitimate
9 Using Components with known vulnerabilities Exploits of vulnerable libraries, frameworks and other SW modules
10 Underprotected APIs
Rich client apps and APIs (in JS) connecting to often unprotected
and vulnerable WS APIs

5. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 5
www.convergence-creators.siemens.com
Highlights in Security News
spear phishing and
social engineering to
gain access to the steel
mill’s office network
Sirens in Dallas “singing”
~23:45 to ~01:30
Energy carrier
network operators
attacked
Various targets
WannaCry
Ransomware

6. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 6
www.convergence-creators.siemens.com
Industry 4.0 – Relevance of Security
Shop-floor and Enterprise IT / Cloud
connections must be secured!
Siemens:
• PLC interfaces
• Industrial device data integration
(incl. management)
• IOT2040 devices
Other HW vendors:
• Other PLC interfaces support
• OPC UA, MQTT, AMQP
(standard Industry protocols)
 Applications and Analytics:
• Siemens
• OEM / Solution Providers
• End-Customer
• Partners
 Siemens Cloud:
• Visualization
• Data management
• Analytics / rules
• System management
• Industrial device
management
 3rd Party Clouds
• Interconnection
 3rd Party Applications
Securing Industry 4.0
digital enterprise
transformation
Security
- In Practice
- Continuous
ImprovementShop-floor
Industrial
Devices
Enterprise
IT / Scada
“Cloud”

7. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 7
www.convergence-creators.siemens.com
Security of Enterprises and Information
Security
Principles
Availability Integrity
Confidentiality
Security: ability to protect from
unauthorized access to business, data,
application and infrastructure
Information Security: focused on
enterprise related data information on its’
partners or customers stored within the
enterprise
Tools: Standards conformance, Access
control, Encryption, Isolation/Zoning,
Information Security Training, enforcing of
policies, etc.
Continuous application and
evolution of implemented security
principles enables relatively
sufficient security of enterprises
and information.

8. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 8
www.convergence-creators.siemens.com
Design for Security
Security Readiness
Development Phases over time
Design
Implement
QA
Production
Stage
Design for Security:
• Data security
(CIA – policies, identities, encryption, checksum, signing)
• Application security
(authenticate, authorize, account)
• Infrastructure security
(Firewall, DMZ, HTTPS SSL/TLS, isolation, redundancy)
During design phase, design for security aspects and
devise sufficiently prioritized tasks/stories which
ensure required security levels (network/HW/SW
planning, user-data, accounts & history, manufacturing
device management/controlling – e.g. melting furnace,
boiler!), usage of architectural patterns

9. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 9
www.convergence-creators.siemens.com
Implement for Security
Security Readiness
Development Phases over time
Design
Implement
QA
Production
Stage
Continuous Integration:
• Implementation coding & testing simultaneously
• On-commit/hourly/daily
• Test builds
• Test executions
• IMMEDIATE (failure) result feedback
Development scope = implementation, testing, documentation
Expect the best, plan & prepare for the worst.
Utilize: static code analyzers (e.g. PMD), automated production
and testing platforms (e.g. Jenkins,ant/robot/junit/selenium/
etc.), vulnerability scanners (e.g. see SecTools.org).
Always use GA SW / security patches in pre-staging testing.

10. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 10
www.convergence-creators.siemens.com
Implement for Security
Security Readiness
Development Phases over time
Design
Implement
QA
Production
Stage
Staging:
• Continuation of dev. cycle integration
• Continuous Release Candidate testing with expanded scope
• Distribution production, pre-on-site hardening
(e.g. default passwords, HW firmware patching, recommended
security updates od 3rd party SW)
• Local installation, test creation & execution
(before deploymente, in cooperation with customer/partners)
Dedicated Project Team scope = testing, documentation
Utilize: vulnerability scanners (Nessus, see SecTools.org).
Always use latest GA SW / security patches in pre-staging
testing.

11. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 11
www.convergence-creators.siemens.com
Implement for Security
Security Readiness
Development Phases over time
Design
Implement
QA
Production
Stage
Going Live:
• Cooperation with Customer
• Installation steps as documented
• System prep for Acceptance Testing incl. customer specific
hardening requirements (usually you get that when on site )
• Acceptance procedure execution, Backup & Restore process
• After go-live and acceptance  maintenance mode
(EMCY, bugs, preventive maintenance, customer RfEs, CRs, etc.)
Dev. scope = AT support, maintenance, opportunities
Keep production “mirror” in local test environment, keep up to
date with maintenance updates (i.e. corrections), patch SW,
Track CVE / CWE sites4 5 6, CERTs, emergency support

12. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 12
www.convergence-creators.siemens.com
References
Literature & Web Sites
Industry 4.0 & CyberSecurity
(1) Design Principles for Industrie 4.0 Scenarios: A Literature Review; Working Paper;
Hermann, Pentek, Otto; Technische Universität Dortmund, Fakultät Maschinenbau
(2015)
(2) http://www.plattform-i40.de – Platform Industry 4.0
(3) OWASP – Open Web Application Security Project – Top 10
https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
(4) CVE – Common Vunerabilities and Exposures
http://cve.mitre.org/
(5) CWE – Common Weakness Enumeration
http://cwe.mitre.org/
(6) CVEdetails - http://www.cvedetails.com/
(CVE/CWE DB search tool)
(7) MSDN - https://msdn.microsoft.com/en-us/library/aa267045(v=vs.60).aspx
(8) http://www.ioti.com/security/10-most-vulnerable-iot-security-targets
(9) http://www.csoonline.com/article/3119765/security/hackers-found-47-new-
vulnerabilities-in-23-iot-devices-at-def-con.html
(10) https://www.wired.com/2015/12/2015-the-year-the-internet-of-things-got-hacked/
(11) Patterns of Enterprise Application Architecture, Martin Fowler, 2003
(12) http://gizmodo.com/u-s-government-fears-a-monday-explosion-of-the-ransomw-
1795208518
(13) http://jalopnik.com/renault-and-nissan-plants-hit-by-massive-ransomware-att-
1795190743

13. © Siemens Convergence Creators GmbH 2017. All rights reserved.
Page 13
www.convergence-creators.siemens.com
Thank You for Your attention!
Denis Jakus, dipl. inf.
Project Manager
Siemens Convergence Creators d.o.o.
E-mail: denis.jakus@siemens-convergence.com
Speaker