The document discusses several challenges in securing industrial networks for Industry 4.0, including enabling internet connectivity, legacy vulnerable devices, and the need for remote access. It describes moving networks from proprietary and isolated "islands" to a converged plantwide network with flexible multi-service platforms. The document provides an example of applying network standards and designs to segment a legacy machine tools network. It emphasizes that defining security policies requires network visibility and moving through stages from blind monitoring to segmentation and enforcement.

1. Stuart Traynor
Technical Specialist - Manufacturing
13th November
Industry 4.0 Security
Evolution of Factory Security for Industry 4.0

2. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Agenda
• Challenges in securing Industry 4.0
• Standards for ICS systems
• Legacy machine tools example
• Policy based IoT security

3. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Enabling internet connectivity to
the OT environment
• New attack vector
• Potentially leveraging the same
network as the automation,
traditionally air-gapped
• Sometimes no automation
network in place and leveraging
the standard enterprise network

4. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Move towards IoT cloud platforms and other cloud services including MES,
the shop floor needs to support this transition
• Shop floors have traditionally legacy devices e.g. PLC’s, Windows XP/7 or
older devices which are vulnerable
• Need for remote access to systems from external vendors, partners etc.
• Networks are segmented in a static fashion, making changes complex, costly
and slow e.g. moving a networked machine can take many weeks / months.
Other common challenges to security from Industry 4.0

5. Cisco Confidential 5© 2016 Cisco and/or its affiliates. All rights reserved.
Starting Point:
Proprietary
Serial
Islands
Unmanaged,
unconverged
Ethernet
Converged
Plantwide Network
Flexible,
Multi-Service
Platform
• Still siloed
• No security
• Individual OEM
networking
• Converge siloed
networks
• Static environment
• Typically air-gapped
networks
• Industry 4.0
• Cloud/Edge Computing
• Software Defined
Factories
• Enterprise wide security
policy
Everyone’s at a different stage on the journey
Phase 1
Phase 2
Phase 3

6. Cisco Confidential 6© 2016 Cisco and/or its affiliates. All rights reserved.
What is Converged Plantwide Network?
The basis of the Connected Factory
“CPwE is co-owned Solution Architecture created jointly by Cisco and
Rockwell Automation to architect IP from the Enterprise level down to the
Operational cell/zone level within the manufacturing plant floor. CPwE
solution is designed specifically for industrial Ethernet applications.”
The CVD (Cisco Validated Design) is a 700 page design and best
practice guide for Engineering IP at the Cell/Zone level and interworking
to the Enterprise
https://www.cisco.com/c/en/us/solutions/enterprise/design-zone-
manufacturing/landing_ettf.html

7. Cisco Confidential 7© 2016 Cisco and/or its affiliates. All rights reserved.
Industrial Network Convergence
Enterprise Zone
DMZ
Manufacturing Zone
Cell/Area Zone
Demilitarized Zone — Shared Access
Enterprise Network Level 5
Site Business Planning and Logistics Network Level 4
Site Manufacturing Operations and Control Level 3
Area Control Level 2
Basic Control Level 1
Process Level 0
• Levels – ISA 95, Purdue
• Zones – IEC 62443, NIST 800-
82, ICS-CERT

8. Sensors
Cell/Area Zone
Levels 0–2
Layer 2 Access
The Legacy machine tools example
Drive
Controller
HMI Distributed I/O
VLAN 10 - automation VLAN 20 - sensors
Gateways
• Remote access
• Industrial specific
security
• Network
Segmentation
• Control network and
IoT connectivity
• Policy based routing
• Data encryption
• Secure cloud
connectivity
Manufacturing Zone/
Demilitarized zone
Level 3
Distribution and Core
Enterprise
Levels 4–5
A fairly straight forward application of the standards and designs

9. Firewall
(Active)
Firewall
(Standby)
Application Servers
Network Services
Patch Management
Terminal Services
Application Mirror
AV Server
Cell/Area #1
(Redundant Star Topology)
Drive
Controller
HMI Distributed I/O
Controller
DriveDrive
HMI
Distributed I/O
HMI
Cell/Area #2
(Ring Topology)
Cell/Area #3
(Linear Topology)
Layer 2 Access Switch
Controller
Cell/Area Zone
Levels 0–2
Layer 2 Access
Manufacturing Zone
Level 3
Distribution and Core
Demilitarized Zone
(DMZ) Firewalls
Enterprise Network
Levels 4–5
Web Apps DNS FTP
Scaling out…

10. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
The next step on the journey…

11. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Defining Security Policies without Visibility is Complex
Security Platforms
C a m e r a
P r i n t e r
L a p t o p
P h o n e
?
? ?
? ? ?
? ? ? ?
Enterprise Assets Industrial Assets

12. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• Many controls teams view segmentation and enforcement as a hindrance to operations
• Maybe bitten in the past by IT actions disrupting production
• You need to explain to them how segmentation increases reliability in addition to security, as they do care about reliability
• Most importantly, in many cases, their networks are not ready, poorly architected, and process/people are not in place to
consume a sophisticated security solution
Moving towards a policy
Blind Monitor / Baseline Segment Enforce

13. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Manufacturer
Usage
Descriptions
Work on
Standards?

14. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
IoT Device Business Challenges
Device Visibility Intent-based
Policy
Standard
based
Do you know devices
well enough to
differentiate service?
Does customer
knows behavior of
devices to build their
policy?
Is there any industry
standard way of
connecting IoT
devices to enterprise
network?
14

15. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
• The needs of the automation and operations networks are changing
• Everyone's at a different stage of the journey
• Start to look at your automation network, how do you prepare it for
Industry 4.0
• There's validated designs and guidance for all kinds of scale
• Visibility of what's on the network and security policy is going to become
key
Summary