CWMC Insights 2020|14 - Einführung IIoT Security

2. BERLIN FRANKFURT AM MAIN HAMBURG KÖLN LEIPZIG MÜNCHEN STUTTGART WIEN ZÜRICH PRODUKTIVITÄT INTELLIGENT MAXIMIEREN.© CWMC INSIGHTS 2020|14 EINFÜHRUNG IIOT SECURITY

3. 06.08.20202CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © EXECUTIVE SUMMARY Sehr geehrte Damen und Herren, IIoT („Industrial Internet of Things“), die intelligente Vernetzung der Produktion und seinen Bestandteilen, wird für Unternehmen immer wichtiger, um die eigene Überlebensfähigkeit am Markt und im Wettbewerb zu sichern. Neben vielen Vorteilen birgt die Erweiterung des Netzwerkes aber auch große Risiken. Unternehmen müssen daher nicht nur in neue IIoT-Techniken investieren, sondern auch in entsprechende Cyber-Security-Maßnahmen ergreifen. So gab es laut Kaspersky Lab allein im ersten Halbjahr 2019 weltweit über 105 Millionen Angriffsversuche auf Unternehmen. Vielen Unternehmen ist allerdings diese Gefahr immer noch nicht im Bewusstsein angekommen. Allein ein einzelnes angegriffenes IIoT-Device kann das ganze Netzwerk eines Unternehmens stilllegen, die Produktion stoppen und noch viel größere Schäden anrichten. Als Einführung zu diesem komplexen Thema sollen die kommenden Folien eine erste Übersicht zu den verschiedenen Aspekten der IIoT Security geben. Für Fragen, Anmerkungen und sonstige Anregungen stehen wir Ihnen herzlich gerne zur Verfügung. Mit den besten Wünschen Christian Wild Executive Senior Managing Partner

4. 06.08.20203CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © INHALT 1 IIoT Angriffsflächen 2 IIoT Architektur und Security Modell 3 IIoT Security Bestandteile 4 IIoT Security Standards

6. 06.08.20205CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © ANGRIFFSFLÄCHEN IN IT UND OT IT OT Enterprise Network Internet DMZ FWFW Control center / HMI Supervisory network / SCADA Network Field network and devices Industrial control network Remote sites Quelle: CWMC Analyse DMZ: Demilitarized Zone FW: Firewall OT: Operations Technology HMI: Human-Machine-Interface SCADA: Supervisory Control and Data Acquisition

8. 06.08.20207CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © IIOT DOMÄNEN UND NOTWENDIGE SYSTEMCHARAKTERISITIKEN MIT HOHER VERTRAUENSWÜRDIGKEIT Quelle: CWMC Analyse Funktionale Domänen Business Operations Information Application Control Physische Systeme Systemcharakteristika Querschnitts- funktionenConnectivity Distributed Data Management Industrial Analytics Intelligent & Resilient Control … Scalablility Privacy Resilience Security Safety Komponenten der Vertrauens- würdigkeit in allen Funktionen Die funktionalen Domänen werden mit Ihren Systemcharakteristiken spezifiziert und über die Querschnittsfunktionen ausgerichtet. Dabei sind die vertrauensstiftenden Komponenten über alle Ebenen hinweg mit Priorität zu betrachten.

9. 06.08.20208CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © DAS IIOT-KONZEPT IIoT Services IIoT Infrastructure Platform Intelligent Gateway IIoT Service Provider Communication Network IIoT Devices Security (Complex) Event Processing Interface HMI Big Data & Analytics Quelle: CWMC Analyse

10. 06.08.20209CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © FUNKTIONALE DOMÄNEN IM BEREICH IIOT UND DEM FOKUS AUF DIE BEZIEHUNG ZWISCHEN OPERATIONS UND CONTROL DOMÄNE Functional Domains Business Operations Information Application Control Sense Actuation Physical Systems Operations Prognostics Optimization Monitoring & Diagnostics Provisioning Deployment Management Control Domain A B C Customers Quelle: CWMC Analyse

11. 06.08.202010CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © DIE 3-TIER IIOT SYSTEM ARCHITEKTUR Domain ApplicationsService Platform Edge Tier Platform Tier Enterprise Tier Proximity Network Edge Gateway Device Management Data Aggregration …. Access Network Edge Gateway Data Flow Control Flow Data Transform Analytics Operations Rules & Controls Data Flow Control Flow Service Network Quelle: CWMC Analyse

12. 06.08.202011CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © MAPPING DER FUNKTIONALEN DOMÄNEN AUF DIE 3-TIER ARCHITEKTUR Edge Tier Platform Tier Enterprise Tier Control Domain Controller Actuators Sensors Application & Gateway Information Domains Data Services & Platforms Analytic Services & Platforms Ingestion & Transformation Persistance & Distribution Streaming & Batch Persistance & Distribution Operations Domains Provisioning & Deployment Asset & Meta Data Management Prognostics & Optimization API & Portal Monitor & Diagnostics Business Domains Analytics OSS CRM BSS EMR … Application Domains Logic & Rules API & Portal Proximity Network Access Network Service Network Daten Orchestrierung Asset Mgmt Daten Informationen Daten Quelle: CWMC Analyse

13. 06.08.202012CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © EIN BEISPIELHAFTES 4-EBENEN-SECURITY MODELL FÜR IIOT Tier 4 Process and governance Tier 3 Cloud platform and applications Tier 2 Communication and connectivity Tier 1 Endpoints and embedded software Data Governance Policy Security Standards System Security Guideline Security Policies Security Threat Analysis Data Center Security Secure Application Platforms Secure Analytics Platforms XaaS Cyber Security Gateway Protection Secure Edge Intelligence Media Protocol Security Cryptographic Protection Configuration, Monitoring, Management IDS und IPS Engines Endpoint Identification Secure Configuration & Mgmt Root of Trust Sandboxing Access Control Secure Boot Physical Security Quelle: CWMC Analyse

15. 06.08.202014CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © SECURITY ASPECTS IN IIOT PROCESS PARTS Business Case Integration of ▪ Business Objectives ▪ Vision and Values ▪ Problem definition ▪ Customer Usage ▪ Business Model ▪ Governance Model and Processes System Definition Consideration of ▪ Use Cases ▪ System Architecture and Requirements ▪ Security Regulations and Standards Development ▪ Secure component boundaries and APIs ▪ Access control, HW RoT ▪ Coding practices and standards ▪ Security Testing ▪ Requirements traceability Deployment ▪ Secure Processes in delivery and deployment ▪ Specific security platforms and architecture, standards and protected environment ▪ Selection of vendors and partners with a security basis Operations ▪ Secure device integration and provisioning ▪ Security monitoring, analysis and regular audits ▪ Stress testing ▪ Incident Management ▪ Enterprise Security Program Quelle: CWMC Analyse

16. 06.08.202015CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © BESTANDTEILE EINES IIOT SECURITY PROGRAMMS IIoT Security Security Audits Risk Assessment Incident Manage- ment Security Policy Security Monitoring Regulatory Comp- liance Quelle: CWMC Analyse

17. 06.08.202016CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © IIOT SECURITY – HERAUSFORDERUNGEN AM HORIZONT Trust Intelligent Edge Security Standards Interop Awareness Collaboration Blockchain AI, ML, TSN, etc. Quelle: CWMC Analyse

18. 06.08.202017CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © SECURITY GOVERNANCE PROGRAM NACH DEM PDCA-VORBILD Risk Mgmt 3rd Party Security Security Education Event Analysis Security Intelligence Policy Definition 1 2 3 4 5 6 Quelle: CWMC Analyse

19. 06.08.202018CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © ÜBERSICHT AKTUELLER ENDPOINT PROTECTION TECHNOLOGIES Intelligent Security ▪ Anomaly Detection ▪ Intrusion Detection ▪ Intrusion Prevention ▪ ML enabled Anomaly Predictors Enhanced Security ▪ Crypto Enables Upgrades ▪ Digital Signature Chains ▪ Crypto Measurements ▪ Process Isolation ▪ Virtual Isolation ▪ Container Isolation ▪ Network Isolation ▪ Measured Boot ▪ Protected Boot ▪ Perimeter Protection ▪ Compliance Analytics ▪ Security / SIEM Analytics Intermediate Security ▪ Secured Connectivity ▪ Secure Bootstrap ▪ Trust Store ▪ Protected Storage ▪ Auditing & Logging ▪ Trusted Execution Environment ▪ Crypto Libraries ▪ Trust Chains ▪ Key / Certificate Management ▪ Secured Access ▪ PenTesting ▪ Whitelisting Hardware Security ▪ HW Identity ▪ Root of Trust ▪ FPGA / Firmware Security ▪ Crypto Accelerator ▪ Protected Storage ▪ Isolation and Access Control Quelle: CWMC Analyse

21. 06.08.202020CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © HILFREICHE STANDARDS FÜR DEVICE ENDPOINT SECURITY CWE Common Weakness Enumeration FIPS 140-2 Security Requirements for Cryptographic Modules FIPS 180-4 NIST-CSRC Secure Hash Standard (SHS) ISO/IEC 197702 Specification on Software Tagging ISA 62443-1-1 Security for Industrial Automation and Control Systems Part 1 – Terminology, Concepts and Models ISA 62443-3-3 Security for Industrial Automation and Control Systems Part 3 – System Security Requirements and Security Levels ISO/IEC 15408 Common Criteria for Information Technology Security Evaluation NIST SP 800-155 Boot-process integrity measurement NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations Quelle: CWMC Analyse

22. 06.08.202021CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © HILFREICHE STANDARDS FÜR INDUSTRIAL CONNECTIVITY INFRASTRUCTURE SECURITY ISA-95 Enterprise Reference Architecture Enterprise-Control System Integration ISA-99 Industrial Automation and Control Systems Security IEC 62443 Industrial Network and System Security IEC 62541 OPC Unified Architecture Specification IEC 61850 Substation Automation Protocols IEEE 1588 IEEE Standard for a Precision Clock Synchronization Protocol for Network Measurement and Control Systems NIST SP 800-53 Recommended Security and Privacy Controls for Federal Information Systems and Organizations NIST SP 800-82 Guide to Industrial Control Systems (ICS) Security NIST SP 800-52 Guidleines on the Selection and Use of Transport-Layer-Security TIA-942-A Telecommunications Infrastructure Standard for Datacenters Quelle: CWMC Analyse

23. 06.08.202022CWMC - CHRISTIAN WILD MANAGEMENT CONSULTANTS UG 2020 © HILFREICHE STANDARDS FÜR EDGE-CLOUD SECURITY ISO/IEC 27001 High-level management systems standards and ist associated cloud-services-specific standards: ISO/IEC 27017 (for security) and ISO/IEC 27018 (for protection of personal data) ISO/IEC 27033 Network Security ISO/IEC 27034 Application Security ISO/IEC 19086 Cloud service SLAs ISO/IEC 20889 Standard ffor de-identification techniques NIST 800-175B Guidance for cryptographic methods NIST SP 800-144 Guidelines on Security and Privacy in Public Cloud Computing Quelle: CWMC Analyse

24. CWMC – CHRISTIAN WILD MANAGEMENT CONSULTANTS UG RHEINSTRAßE 44 76467 BIETIGHEIM WWW.CWMC.BEST KONTAKT@CWMC.BEST +49 7245 9473443 PRODUKTIVITÄT INTELLIGENT MAXIMIEREN.© BERLIN FRANKFURT AM MAIN HAMBURG KÖLN LEIPZIG MÜNCHEN STUTTGART WIEN ZÜRICH

CWMC Insights 2020|14 - Einführung IIoT Security

CWMC Insights 2020|14 - Einführung IIoT Security

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados(6)

Similar a CWMC Insights 2020|14 - Einführung IIoT Security

Similar a CWMC Insights 2020|14 - Einführung IIoT Security(20)

Mais de CWMC - Christian Wild Management Consultants

Mais de CWMC - Christian Wild Management Consultants(10)

Último

Último(10)

CWMC Insights 2020|14 - Einführung IIoT Security