The document discusses the importance of cyber security in industrial control systems, emphasizing the need for measures to protect against both intentional and unintentional cyber threats. It details Schneider Electric's six-step defense in depth (DID) approach, which includes creating security plans, network separation, perimeter protection, network segmentation, device hardening, and continuous monitoring. The responsibilities of both vendors and customers in handling security vulnerabilities and staying informed about potential threats are also highlighted.

1. Industrial Control System Cyber Security and
the Employment of Industrial Firewalls as a
Partial Solution
Hatem Mohammed
Schneider Electric
Industry NOW Express
1

2. Agenda
●What is Cyber Security and why now?
● A security incident
● Vulnerability tracking
● Vendor responsibility
● Customer responsibility
●How to Secure a System?
● The Schneider Electric 6-Step Defense in Depth (DiD) approach to
cyber security
●Cyber Security demo
● Features of the Schneider Electric ConneXium Switch and Industrial
Firewall
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 2

3. Cyber Security?
● Measures used to protect assets against computer threats.
● Covers both intentional and unintentional attacks.
● Malware or network traffic overloads can affect a control system.
● Accidental miss configuration or well intentioned but unauthorized control
system changes.
● Direct attacks by internal or external threats.
● Increasing the security of the assets also increases the integrity of
the production system.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 3

4. What is a Security Incident?
● Customer site issue – attack or misuse
● Vulnerability disclosure – internal or external
● Becoming aware of an issue in our products or systems that could allow
an attacker to modify the behavior, obtain information that should not be
available, or impact the availability.
● US Government Agency Computer Emergency Readiness Team
● ICS-CERT disclosures up from
38 (2010) to 136 (2011)
●500 predicted in 2013
● Schneider Electric product disclosures up from
2 (2010) to 11 (2011)
● 4 in Jan 2012 alone (3 in Industry)
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 4

5. Why is Cyber Security Important?
●Potential risks:
● Safety of personnel (injury, fatality)
● Production, equipment and financial loss
● Loss of sensitive data
●Key security principles:
● Confidentiality – prevent disclosure of private information.
● Integrity – data cannot be modified without authorization.
● Availability – the information must be available when it is needed.
●In the industrial world the priorities are integrity, availability,
confidentiality.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 5

6. Why Now?
● The rapidly changing world of technology makes computer systems more vulnerable
to a cyber attack.
● Increase in attacks on general IT systems and directed attacks on companies result in
an increase in threats to control systems.
● Open systems have proven to be desirable and effective but expose a control system to
greater risks.
● Government and companies are responding with cyber security standards for
control systems.
● Awareness that control systems contain valuable business data and are also
vulnerable has increased the focus on cyber security.
● Dedicated attacks are increasing for industrial companies.
● Researcher focus on control systems is increasing awareness and providing tools.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 6

7. What is the Trend?
What language are you speaking on Ethernet?
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 7

8. Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 8

9. Ethernet Trend in Automation
Complete
Complete
Industrial Ethernet
Industrial Network Penetration
Industrial Ethernet
solutions
solutions
Fastest growing
Fastest growing
technology in
technology in
Industrial networks –
Industrial networks –
Expanding from
Expanding from
control to fieldbus
control to fieldbus
Standard in data
Standard in data
transmission, Internet
transmission, Internet
and business networks
and business networks
Past Present Future
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 9

10. The Future is an Integrated Ethernet Architecture
● Increase plant uptime
● Network (hence data) is
accessible yet secure
● Lower cost to maintain
● Ethernet will be the
common link for IT,
process, control, energy
management and building
automation
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 10

11. Integrated Architectures – ICS Vulnerabilities
Intrusion vulnerability points
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 11

12. What is a Cyber Security Vulnerability?
● A weakness within a product or a system
that could allow the system to be attacked.
● Security researchers are exposing product
vulnerabilities
● Profit, publicity
● To force improvements by vendors
● Vulnerabilities are very common
● Microsoft fixes 10-50 each month
● Over 500 vulnerabilities predicted in industrial
control systems in 2013
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 12

13. ICS Security Researchers
● Exposing vulnerabilities in industrial control
systems and products
● Release exploit examples to drive vendors to
improve security
● Exploit examples make hacking a system easier
● Motivation
● Desire to change the industry
● Publicity, money
● Vendors and customers share
responsibility for response
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 13

14. Vendor’s Responsibility to a Vulnerability
● Provide fixes and patches to vulnerabilities
● Keep customers informed of latest fixes
● Recommend mitigations to limit the risks or
remove vulnerability
● Use industrial firewalls when needed
● Securing your ConneXium switches
● Analyze vulnerabilities to understand their
impact on a customer’s system
● A PLC command vulnerability on FTP is only
an issue for a system if FTP access is allowed
from people that will send that command
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 14

15. Customer’s Responsibility to a
Vulnerability
● A sound security plan and employee training
● Stay informed on vulnerabilities applicable to
their system
● Analyze risk involved with every vulnerability
and understand impact on application
● Apply mitigations to limit the risks or remove
vulnerability
● Use industrial firewalls when needed
● Securing ConneXium switches
● Applying vendor fixes and patches
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 15

16. How are Vulnerabilities Tracked?
● Vulnerabilities are tracked by US-CERT and other National CERT bodies
● Customers should watch these databases for issues with products they use
● Many vulnerabilities reported on blogs and online magazines
● Schneider Electric updates US-CERT for fixes and recommends
mitigations for our products
● Schneider Electric Cyber Security Web Site
● Lists all product vulnerabilities
● Lists mitigation actions and patches
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 16

17. Schneider Electric Cyber Security Website
● White Papers
Global Main Page: Support  Cyber Security
● Product vulnerability data
● Vulnerability list for all products
● Mitigation recommendations
● Patches and Firmware updates
● Secure vulnerability reporting
● Cyber security news stories
● Product releases and updates
● Industry news
● RSS feed for vulnerability and news
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 17

18. Security is a Risk Evaluation
● Customers and vendors should both handle security based on risk
● Evaluate the risks, take actions on the risks above a defined level
● Both systems and products can and should be evaluated for risk
● Risks on a product can be mitigated by another component of the system
● Risk = Threat x Vulnerability x Consequence
● Threat - a person or event with the potential to cause a loss
● Vulnerability - a weakness that can be exploited by an adversary or an
accident
● Consequence - the amount of loss or damage that can be expected from a
successful attack
● Mitigation - something that is done to reduce the risk
● Normally reducing the vulnerability or raising the skills needed to exploit it
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 18

19. Exercise – Discuss in your group:
●Has your management asked about cyber security?
●Are you doing anything right now for cyber security?
●How are you and your team trained in security?
●Do you have an automation and operation policy?
●Are you willing to change behavior for a more secure
system?
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 19

20. Agenda
●What is Cyber Security and why now?
●A security incident
●Vulnerability tracking
●Vendor responsibility
●Customer responsibility
●How to Secure a System?
●The Schneider Electric 6-Step Defense in Depth (DiD)
approach to cyber security
●Cyber Security demo
●Features of the Schneider Electric ConneXium Switch
and Industrial Firewall
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 20

21. Security Best Practice - Defence-in-Depth
• Developed by US Gov’t Control Systems Security
Program (CSSP)
• Multi-layer approach:
• Appliances
• Architectures
• Policies
• Training
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 21

22. Schneider Electric’s Recommendation
The “Defence in Depth” Approach (DiD)
6 key steps:
1. Security Plan
2 2. Network
Separation
3 5 3. Perimeter
Protection
4 4. Network
Segmentation
5 5. Device
Hardening
6. Monitoring &
Update
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 22

23. Defence-in-Depth Step #1: Security Plan
● Define: Assessment
● Roles and responsibilities
● Allowed activities, actions and processes and Design
● Consequences of non-compliance Service
● Full network assessment:
● Communication paths ConneXium
● Audit of all devices
● Security settings Network
● Network drawings Manager
● Vulnerability assessment:
● Potential threats
● Consequences
Product Alerts
● Risk assessment and mitigation
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 23

24. “Defence in Depth” Step #2: Network Separation
● Separate the Industrial Automation & Control System
(IACS) from the outside world PlantStruxure
● Create a ‘buffer’ network (DMZ) between the IACS network Secure
and the rest of the world, using routers and firewalls Reference
● Block inbound traffic to the IACS except through the DMZ
firewall Architectures
● Limit outbound traffic to essential and authorized traffic only
● DMZ host for servers
● Vijeo Historian mirror
● Web servers
● Authentication server
● Remote access server
● Anti-virus server
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 24

25. “Defence in Depth” Step #2: Network Separation
Secure Reference Architectures
Secure PlantStruxure
architectures incorporating
key security zones:
● Control Room DMZ
● Operation Network
● Control Network
● Device
Network/Functional
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 25

26. “Defence in Depth” Step #2: Network Separation
Secure Reference Architectures
● Data flows
between zones
● Defines the
settings for
conduits/firewalls
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 26

27. “Defence in Depth” Step #3: Perimeter Protection
● Protect the Industrial Automation &
Control System perimeter using a Examples:
firewall
● Validate packets and protocols ConneXium
● Manage authorization of certain data
packets Firewall
● Restrict IP address or user access
via authorization and authentication
Configuration
● Protect critical parts of the process Remote
with additional firewalls within the ICS Access/VPN
● Secure remote accesses
● Use the VPN technology of routers
and firewalls
● Use the latest authentication and
authorization technologies. They’re
evolving fast.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 27

28. “Defence in Depth” Step #3: Perimeter Protection
ConneXium Firewall
● Firewall - a device for filtering packets based on source/destination IP address
and protocol.
● Ingress and Egress filtering
● Source IP addresses should be very few
● Rule placement
● Firewalls should be configured with a default Deny All rule
● Rules that address the expected traffic
● Permit Rules should have specific IP
addresses and TCP/UDP port numbers
● Only pre-defined traffic should be
allowed from the IT network to control network
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 28

29. “Defence in Depth” Step #3: Perimeter Protection
Industrial Firewall Configuration
● The National Institute of Standards and Technology (NIST) has provided the
following guidelines:
● The base rule set should be “deny all, permit none.”
● Ports and services enabled on a specific case-by-case basis.
● Risk analysis and a responsible person identified for every permit rule.
● All “permit” rules should be both IP address and TCP/UDP port specific.
● All rules should restrict traffic to a specific IP address or range of addresses.
● Traffic should be prevented from transiting directly from the control network
to the corporate network. All traffic should terminate in a DMZ.
● All outbound traffic from the control network to the corporate network should
be source and destination-restricted by service and port.
● Control network devices should not be allowed to access the Internet even if
protected via a firewall.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 29

30. “Defence in Depth” Step #3: Perimeter Protection
Remote Access / Virtual Private Network
● Description
● Used to provide secure communications across non-trusted networks
● Provides security through encryption and authentication, restricting access and
protects the data as it moves.
● Client VPN (telecommuter for example), or Site-to-Site
● Basics
● An extended protection of network or allow client access across internet
● Two flavors IPsec and SSL/TLS
● Can utilize RADIUS - uses several different types of authentication; examples are
username and password, digital signatures, and hardware tokens
● Can also use LDAP in making access decisions
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 30

31. “Defence in Depth” Step #4: Network Segmentation and
Zones
● Create Security Zones
● Limit and monitor access ConneXium
between zones Switches
● Limits the effect of a
security issue, alerts when
an issue occurs ConneXium
Firewalls
● Use managed switches
● Limit access to network
packets.
● Precisely segment the
network using VLANs
● Limit rates of ‘multicast’ and
‘broadcast’ messages to
protect from DoS type
attacks
● Limit physical connections
using port security
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 31

32. “Defence in Depth” Step #4: Network Segmentation and Zones
ConneXium Switches
● Switches
● Limit traffic flow to prevent data gathering
● Implement VLANs to allow the logical and physical architectures to be
different (less hardware cost but more complex setup and maintenance)
● Segmenting the network is…
● Good network design but also assists with security
● Allows the creation of concentration points to move from one zone to
another, allowing a single place for security checks
● Limits the impact of a security breach
● Weakness
● Can be bypassed by flooding the switches
● Can cause difficulty when trying to connect and login
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 32

33. “Defence in Depth” Step #4: Network Segmentation and Zones
ConneXium Firewalls
● Separate security zones using ConneXium deep packet inspection firewalls
● Apply normal firewall rules
● Deep packet inspection
● Filter modbus requests to read/write
● Limit access to specific registers/ports
● Allow or disallow programming
● MAC address filtering
● Use special rules to mitigate vulnerabilities by blocking before they reach the
device
● Example: FTP buffer overflow rule for PLC, allows FTP access but prevents overflow
packets
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 33

34. “Defense in Depth” Step #5: Device Hardening
● On all devices
● Replace default passwords with ‘strong’
passwords
● Shut off unused ports, communication services • Vijeo Citect PCs
and hardware interfaces • Vijeo Historian PCs
● Set up broadcast limiter functions
● Use multicast message filtering • Unity Pro PACs
● Avoid generating requests faster than system • Magelis HMI terminals
can handle • ConneXium switches
● On PCs and HMI terminals
● Forbid or seriously control the use of any • Modicon STB
external memory I/O islands
● On Unity Pro and Vijeo Citect • Altivar speed drives
● Set up all security features - passwords, user
• Any I/O or instrument
profiles, operator action logging
on fieldbus
● On ConneXium switches
● Restrict access on ports to assigned
addresses only
● On remote I/Os
● Restrict access to authorized PACs only
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 34

35. Password Management
● Fundamental tools of device hardening
● Passwords that can easily and quickly be implemented but are too often neglected in
the control system network.
● Policies and procedures on password management are often lacking or missing
entirely.
● Password Management Guidelines
● Change all default passwords immediately after installation :
●PC / SCADA / HMI user and application accounts
●Network control equipment
●Devices with user accounts
● Grant passwords only to people who need access. Prohibit password sharing.
● Do not display passwords during password entry
● Passwords should contain at least 8 characters and should combine upper and
lowercase letters, digits, and special characters such as !, $, #, %
● Require users and applications to change passwords on a scheduled interval.
● Remove employee access account when employment has terminated.
● Require use of different passwords for different accounts, systems, and applications.
● Password implementation must never interfere with the ability of an operator to
respond to a situation (e.g. emergency shut-down)
● Passwords should not be transmitted electronically over the unsecure Internet,
such as via e-mail.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 35

36. PC Hardening
● Restrict physical access to administrators or similar authorized personnel.
● Locate physical machines outside of operator access areas
● Restrict network access using a DMZ if possible.
● Disable or remove unused programs and services.
● Hardening of servers, particularly user account management and patching, should
be a continuous process improvement. All file systems should be NTFS.
● Harden the PC server and its operating system via strong and unique user and
administrative account passwords.
● Use enterprise grade operating systems, such as Windows 2008R2 Standard
Server, maximizing the benefits of DEP (Data Execution Prevention) and UAC (User
Account Controls) provided by these operating systems.
● Patch operating system to current required levels on a documented, monitored
schedule.
● Implement Microsoft Windows authentication, perhaps centrally using Active
Directory if possible.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 36

37. Anti-Virus
● Description
● Monitoring of the system and blocking / removal of programs matching a
known virus
● Basics
● Anti Virus is a blacklisting technology – defines what is not allowed.
● Based on signatures of known bad items (software, files etc.)
● Weakness
● Processor intensive since the system must be scanned against the known
signature list.
● Most system contain < 1/3 of the virus signatures that are known.
● Anti Virus vendors distribute signatures based on active viruses and location
in the world.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 37

38. Switch Hardening
● SNMP
● Deactivate SNMP V1 & V2 and use SNMP v3 whenever possible
● Change default passwords / community strings
● If SNMP V1/V2 is needed use access settings to limit the devices (IP Addresses) that can access
the switch. Assign different read, read/write passwords to devices.
● Telnet/Web Access (HTTPS)
● Both active in default state and allow full switch configuration
● Deactivate the telnet server if not using the command line interface to configure switch
● Change the default read and read/write passwords for the telnet and Web servers
● After configuration and operational verification disable the web server for highly secure systems
●Note: Disabling both the telnet server and the web server will result in only being able to
access the switch via the V.24 port.
● Ethernet Switch Configurator Software Protection
● The Ethernet Switch Configurator Software protocol allows users to assign an IP address, net
mask and default gateway IP to a switch.
● Once configuration is complete disable the Ethernet Switch Configurator Software Protocol
frame or limit the access to read-only.
● Ethernet Switch Port Access
● A malicious user who has physical access to an unsecured port on a network switch could plug
into the network behind the firewall to defeat its incoming filtering protection.
● Ethernet switches maintain a table called the Content Address Memory (CAM) that maps
individual MAC addresses on the network to the physical ports on the switch.
● A MAC flooding attack fills the CAM table and the switch becomes a hub allowing capture of data.
● Ethernet Switch Port Risk Mitigation
● Disable unused ports
● Lock specific MAC addresses to specific ports on the Ethernet switch.
● Lock specific IP addresses to specific ports on the Ethernet switch
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 38

39. PLC Hardening
● Modify HTTP passwords when possible
● Block access to unused services using an external firewall
● HTTP Soap
● FTP
● SNMP (not a big issue due to read only access)
● Limit Modbus access using Access Control List
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 39

40. PLC Hardening - Access Control Lists
● Description
● Limits Modbus access using a list of permitted IP addresses
● Only protection available today on the PLC for Modbus Protocol (external
protection is better)
● Basics
● Similar to a firewall but only
applicable for Port 502
● Weakness
● Easy to bypass with IP address
spoofing or “man in
the middle” attack
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 40

41. Citect Hardening
● Run Citect with non-administrative privileges only.
● Do not install developer tools on a running production Vijeo Citect server.
● These tools should be installed only on dedicated workstations
● Provide operator access to the server via Vijeo Citect Web Clients.
● Use Web clients instead of internet display clients
● Limit who can see specific information by configuring roles within Vijeo
Citect.
● Prevent web and e-mail access on systems directly on or accessing the
Vijeo Citect system. It is recommended that web and e-mail access be
highly restricted, if not disabled entirely for any system in the control
room.
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 41

42. “Defense in Depth” Step #6: Monitor and Update
● Monitor, manage and protect service • Monitor, Manage,
● 24/7 remote security monitoring Protect Service
● Configuration monitoring
● Reporting for audit compliance •Citect Log Files
● Network and host intrusion detection systems
•Unity Pro log files
● Monitor •PLC Event Viewers
● Authentication traps
•PLC Diagnostics and
● Unauthorized login attempts
access lists
● Unusual activity
● Windows Event Viewer
● Network load
● Device log files
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 42

43. “Defense in Depth” Step #6: Monitor and Update
Intrusion Detection Systems (IDS)
● Description
● IDS monitors events occurring in a computer system or network and detects signs of possible
incidents (malware, worms, virus, attacks, etc)
● Network and Device IDS systems are possible
● Alert administrators (emails, user interface etc) and logs issues
● Basics
● Can be configured per FW rule set, or policy
● Classes of detection methodologies - signature-based, anomaly-based, and stateful protocol
analysis or some combination
● Signature – known threat, Anomaly – normal/abnormal deviations. Stateful understands and can
track state of certain stateful protocols
● Network IDS requires a concentration point to collect traffic when used in a switched network
● Can be very useful to develop custom rules to address new threats
● Weaknesses
● False positives, false negatives, true Positive, true negative
● Requires significant skill and full time effort
● Architecture placement is important
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 43

44. “Defense in Depth” Step #6: Monitor and Update
Intrusion Prevention Systems (IPS)
● Description
● Similar to IDS but add the ability to prevent vs detect
● Mostly end device not network
● Alert administrators (emails, user interface etc) and logs issues
● Basics
● Can be configured per FW rule set, or policy
● Classes of detection methodologies- signature-based, anomaly-based, and stateful
protocol analysis or some combination
● Signature – known threat, Anomaly – normal/abnormal deviations. Stateful
understands and can track state of certain stateful protocols
● Commonly use White Listing as a prevention technique
● Weaknesses
● False positives, false negatives, true positive, true negative
● IPS – can shut down traffic that is ok to have on the network
● Requires significant skill and full-time effort
● Architecture placement is important
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 44

45. “Defense in Depth” Step #6: Monitor and Update
Monitor, Manage, and Protect
● Monitoring and management of control system
● Devices, protocols, communications, user accounts,
product/Firmware versions, device settings
● Host intrusion detection
● Network intrusion detection
● Protection of control system
● Boundary and security zone firewalls
● Application White Listing
● Compliance audit and change management
● Partnership with Industrial Defender
● Number 1 in Smart Grid security (Pike Research)
● Hardware and service offer
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 45

46. Secure Products
● New products developed to Industry Security Standards
● Achilles certified for robustness, ISA Secure certified
for complete security
● Legacy products
● Protected using industry-leading ConneXium Tofino application firewalls
● Partner products for advanced security
● Access to Hirschmann network infrastructure
● Access to Industrial Defender industrial security suite
● Secure network infrastructure
● ConneXium range of secure network
infrastructure products.
● Includes Schneider Electric ConneXium Eagle
and Tofino firewalls.
● Security Certification Center
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 46

47. Industry Cyber Security Solution
Windows Integrated Security
Application White Listing
Monitor the security
and adapt
Securely connect
zones
IDS, IPS, Security Event Manager
Protect the SCADA
Protect the perimeter
Protect large zones
Secure configuration
Restrict traffic
between zones
Access control,
Protect
communications
Protect within a zone
Device Monitor
Hardening
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 47

48. Industry Cyber Security Solution
Customized
Assessment and Expertise
Solutions
(Americas, Europe, Asia)
(Worldwide) (Americas, Europe) (Asia)
Advise and Assistance
PSX Competency Center
(USA, France, China)
Adaption by
Solutions
Generic
local project teams
Reference
Architectures (TVDA)
Products
Basic
Secure Products
Secure Solutions
Provider
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 48

49. Agenda
●What is Cyber Security and why now?
●A security incident
●Vulnerability tracking
●Vendor responsibility
●Customer responsibility
●How to Secure a System?
●The Schneider Electric 6-Step Defense in Depth (DiD)
approach to cyber security
●Cyber Security demo
●Features of the Schneider Electric ConneXium Switch
and Industrial Firewall
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 49

50. Summary
● Security implementation is a solution and not a product
● People, Policies, Architectures, Products
● Security requires a multi-layer or Defense in Depth (DiD) approach
● Security Plan, Network Separation, Perimeter Protection, Network
Segmentation, Device Hardening, Monitoring & Update
● A Defense-in-Depth approach is the best approach- mitigates risk, improves system
reliability
● Vendor’s responsibilities
● Design products & solutions with security features
● Ensure they enable customers to comply with security standards
● Provide recommendations and methodologies to guide implementation
● Customer’s responsibilities
● Define security procedures (organizational security)
● Mandate responsible people (personal security)
● Ensure compliance with security standards
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 50

51. Summary
The Schneider Electric Security Solution
● Information for customers
● Web portal for guidance, vulnerabilities and information
● Secure products
● New products developed to industrial security standards
● Legacy products protected using pre-configured security appliances
● Secure network infrastructure
● Secure reference architectures
● Secure PlantStruxure architectures validated by leading security experts
● Assessment and design services
● Assessment Service – allowing security to be applied where it is needed most
● Design Service – customizing the secure PlantStruxure architecture creating a unique
solution for each customer
● Monitor, manage and protect services
● Tools and services to continually monitor a plant configuration and operation to ensure
security and production is maintained
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 51

52. Thank You!
Schneider Electric - Industrial Control Cyber Security and the Employment of Industrial Firewalls as a Partial Solution– 2012 52