Schneider-Electric & NextNine – Comparing Remote Connectivity Solutions

Comparing Remote Connectivity SolutionsBenefits, Disadvantages, Architectures for allowing 3rd Party Access

Michael Coden, CISSP, Vice President, NextNine Inc.Gary Williams, MSc ITSEC, Sr. Director, Schneider Electric

Presenters

Michael Coden, CISSPVice President, NextNine Inc.Editor, ISA/IEC-62443Associate Director, MIT-(IC)3

[email protected]

Gary Williams, MSc ITSECSr. Director Technology, CyberSecurity & Communications, Schneider ElectricLead Auditor ISO/IEC [email protected]

mailto:[email protected]


Introduction

The challenge of keeping Control, Safety & SCADA systems current once delivered, and continuously operating, is huge.

Vendors have to be dynamic in evaluating each new threat against components, devices & systems, often resulting in a plethora of patches, configuration and supporting documentation.

Each solution has to be delivered to our Clients in a secure manner ensuring the integrity from dispatch to delivery.

The Challenge

We all want to have our systems patched to mitigate against new threats.

Vendors want Clients to update ICS, Safety & SCADA systems to mitigate the latest vulnerabilities

We all want the latest signature files to ensure our Anti-Virus is up to date

Ideally Clients want Vendors to monitor their systems in near real-time and provide feedback to ensure optimised running and productivity.

To enable this, ICS systems need external connectivity to facilitate this & other support.

The days of air-gapped systems are gone!

MethodologiesThere are a number of methodologies used today to enable connectivity to third parties and between outlying plants. e.g:

• VPN• Cryptographic devices• Data Diodes• Secure Web Interfaces• Bespoke configured Firewalls• One time connectivity approach• NextNIne

All of these have value, however, the general requirement is :

‘A resilient, sustainable methodology to provide Secure Communications between Sites & off-site engineers, including 3rd Parties, ensuring the integrity of any data, whether operational or administrative and provision of OS & AV patches’.

VPN

A secure wide area network (WAN) comprised of 2 or more endpoints, at least one of which is the Server.

Pros:• Cheap technology• Flexible in growth

Cons:• Use several protocols to perform tunneling: PPTP; L2TP; IPSec & SSL• The design and security implementation is complex• Uses a number of ports: 47, 50, 443, 500,1701, 1723, 4500, both outbound and inbound

dependent on protocol

Hardware Security Modules (HSM)

Provides crypto protected links, via physical or data key

Pros:• Good for point to point. • Good for James Bond

Cons:• Expensive• Requires third party hardware for key infrastructure and support• Configuration of Services on either end can be very complex• Restricted number of links/channels• Point to MultiPoint feasible but very expensive

Data Diodes

Provides unidirectional network via a bespoke appliance

Pros:Excellent choice for classified data, governments and nuclear plants• They allow traffic to travel in one direction only• Good confidentiality

Cons:• They allow traffic to travel in one direction only• Restricted number of services can be achieved due to unidirectional traffic flow.• Typically only allow connection to one single device or system• Expensive to maintain, often a spare is required on the shelf• Not suitable for services like Remote Desktop

Secure Web Interface

Secure Web based communications often based on certificates or SSL

Pros:• Enables Remote Users to provide data input• Used by banking, qBittorrent and commercial ventures such as car hire• Cross platform• Transport Layer Security

Cons:• Certificate management can be difficult• Not suitable for sustained long term connectivity• Subject to multiple threats as it is browser based

Bespoke configured Firewalls

Use of Firewalls specifically configured for known IP to known IP

Pro:• Security by obscurity

Cons:• Security by obscurity• Not very secure• Not very reliable• Difficult to configure and maintain• Not suitable for long term services requiring constant connection

Schneider Electric’s approachSchneider Electric’s Process Automation Systems resolved this conundrum 10 years ago, by partnering with NextNine. Why?

At the time, we were looking for ways of transmitting field device & system data back to Foxboro for monitoring, to enable predictive maintenance and provide an early warning to Clients of anomalous activity, equipment failure etc.

Clients then and now, wanted to control such connectivity to ensure the integrity of both the data and access. At the time, there were few solutions that would enable a Client to control connectivity to multiple parties, whether internal or external, especially one that was sustainable.

Over the last 10 years, the solution has evolved to meet the increasing demand of ICS Security.Today we provide OS, AV and System patches on a regular basis to address the increasing threats. But, we also use the system for attack mitigation and Remote Maintenance enabling our experts to work remotely together with engineers onsite.

Remote Site A

Remote Site B

Remote Site C

Secure CenterCertificate

Something I know

Certificate Something I know



Trusted Platform Module



VSE = Virtual Security Engine; TPM = Trusted Platform ModuleConnectivity is outbound only through a single port, to specific IP address.

-- No possibility of VPN bleed or spoofed connections-- Only one single Firewall Rule to manage for all remote functionality.

-Outbound only

-Single Port (443)

-Specific IP Address

-FIPS 140-2 Compliant

-1024-bit TLS Encrypted

Secure Multi-purpose Tunnel with Mutual Strong M2M Authentication

Remote Site A

Remote Site B

Remote Site C

Secure Center

End-customer approves remote access

Remote Site VSE Interface

Secure Remote Desktop Sharing with Site Control– With Remote Access, Cyber Security and 3rd Party experts can immediately connect to your system

– Remote Site controls granting of access– Remote Site can Supervise remote access

Remote Site VSE Interface

Remote Site A

Remote Site B

Remote Site C

Secure Center

Secure Remote Desktop Sharing with Site Control– With Remote Access, Cyber Security and 3rd Party experts can immediately connect to your system

– Remote Site controls granting of access– Remote Site can Supervise remote access

Centralize/Automate Patch, S/W, AV Delivery – Minimize Vulnerability

WSUSePO

SEPM

WSUSePO

SEPM

DevicesSystems

Applications

NetworkDevices

VSE

Network& Security

Devices

VSE

DevicesSystems Applications

Remote Sites

Internet

External UsersPartner / SI / OEM

Field Service

Full Web UI Full Web UIInternal Users

DMZ

Windows WSUS Server

McAfee ePO

Server

SymantecSEPM Server

Product PatchServer

--Vendors-- --Vendors-- --Vendors----Vendors--

Security Center

Application Server

CommServer

DatabaseServer

Collect Logs for SIEM Analysis – Scan Ports & Services vs. Whitelist

DevicesSystems

Applications

NetworkDevices

Virtual Security Engine™

LocalPeronnel

Network& Security

Devices


LocalPersonnel

Devices, Systems, Applications

Internet


Field Service

Full Web UI

Cyber Security SIEM and Analysis Tools, e.g.: ArcSight, Q-Radar,

Nitro, ….Detecting Rogue

Devices, Ports, Services

Full Web UI

Internal Users

DMZ

Houston

CentralSecurity Center

Application Server

DatabaseServer

Nigeria

Qatar

VSE continuously scans Ports and

Services – comparing

against Whitelist & Blacklist.

Full Web UI

Cybersecurity Experts

CommServer

VSE continuously collects logs, converts them to CEF (Common

Event Format) sends logs for analysis and detection of malicious activities.

Secure Offsite Backups – Automated Verification – Restore/Recovery

Devices SystemsApplications

NetworkDevices


LocalPersonnel

Network & Security Devices


Devices, Systems, Applications

Internet


Field Service

Full Web UI

Backup Location# 2 With

Auto-Verify of Backups

Backup Location# 1 With

Auto-Verify of Backups

Full Web UI

Internal Users

DMZ

Houston

Central Security Center

Application Server

CommServer

DatabaseServer

Nigeria

California Amsterdam

Qatar

Automated Asset Discovery – Daily Inventory – Change Management

DMZ

Security Center

Application Server

CommServer

Real-TimeDatabase

Server

VSE

Local IT

Devices – Systems – Applications

Remote Site/s

Internet


Full Web UIInternal Users

WSUS, ePO, SEPM, SIEM,

Patches

WMISNMPOPCSSHHTTPTelnet (CLI)SFTPFTPProprietaryOthers

Solution supports all versions of: Windows (NT, XP, Vista, Win7, 2000,

2003, 2008, 2012) Unix (HP-UX, AIX, Solaris, ….) Linux (Red Hat, Ubuntu, ….) Any other product that can be accessed

via the protocols at the left.

Network& Security

Devices

Rapid Development & Instant Application Deployment Remotely

DMZ

Security Center

Application Server

CommServer

Real-TimeDatabase

Server

VSE

Local IT

Devices – Systems – Applications

Remote Site/s

Internet


Full Web UIInternal Users

WSUS, ePO, SEPM, SIEM,

Patches

Network& Security

Devices

Heartbleed scanner

was delivered

in 48 hours!

ShellShock scanner

was delivered

in one week!

• GUI based App Development Environment• Develop new Apps in a few hours• Distribute Apps to all VSE’s • No recompile or reboot of VSE is

required• App is used immediately

Most Functions of ISA / IEC – 62443 Scale Cost Effectively Remotely

All Major Functions of Cybersecurity Framework Scale Remotely

ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443ISA99 / IEC-62443

Automated Asset Discovery and Inventory

Automated Patch-AV DeliveryAnd Compliance/Enforcement Reports

Event and Incident Log Collection,Conditioning, and Transfer for SIEM Input

Secure Remote Access and Device-to-Device Connection

Mutli-Site File Transfer for Secure Software &File Transfers, & Multi-Site Backup / Restore

The authors would like to acknowledge the important contributions and gracious support of the following organizations in providing the data, research, and resources to produce this analysis and report:

– NextNine Inc.• http://www.nextnine.com

– Schneider Electric• http://www.schneider-electric.com

– Massachusetts Institute of Technology (IC)3

• MIT Interdisciplinary Consortium for Improving Critical Infrastructure Cybersecurity

• To Join, Visit: http://ic3.mit.edu

[email protected]@schneider-electric.com

http://www.nextnine.com/

http://www.accenture.com/

http://ic3.mit.edu/

