siemens.com/ruggedcom/cybersecurity Cybersecurity from the inside out
Critical to your success
Every minute of More than just a safe or a vault, effective cybersecurity must be a holistic approach to downtime costs protecting systems against unauthorized access or attack. With billions of Internet-of- companies in a Things (IoT) devices connected worldwide, cybersecurity is crucial to the success of the multitude of ways: digital economy. • Outages in critical infrastructure networks as Cyber attacks and threats have escalated and become more sophisticated with the technicians work to resolve convergence of Information Technology (IT) and Operational Technology (OT). communication disruptions Automation and data-driven operations require a strong cybersecurity system to protect • Security breaches with assets, equipment, and intellectual property while reducing downtime. potentially devastating impacts to public safety – Defense in Depth and to a company’s brand
• Expensive repairs from
The benefits of interconnected operations also bring potential threats from web-based damage to equipment hackers, which can cause downtime and disruption. Threats from malware, external or systems attacks, or a vulnerable point in a network can grind operations to a halt. • Specialized IT technicians What’s more, regulatory bodies often require disclosure of security breaches to ensure needed to reconfigure stakeholders are aware when personal and confidential industry information has been networks compromised. Being aware of potential attacks is the first step in neutralizing them, in • Industrial espionage or order to meet and exceed security standards and reporting requirements. theft of intellectual property affecting the integrity Enter Defense in Depth, an approach to digitalized operations based on the IEC 62443 of operations standard that takes into account attacker motivations and a network’s unique design to create a unified solution which protects against current and future threats.
15% $600B 41%
say they are confident in their is the current estimate that of Industrial Control Systems (ICS) current abilities to maintain security cybercrime cost the world last year, attacked at least once in first half of for IIoT devices and systems or 0.8% of glo bal GDP 2018, up from 36.6% in 2017 Source: The 2018 SANS Industrial IoT Source: McAfee, Economic Impact Source: Kaspersky Lab, Threat landscape Security Survey: Shaping IIoT Security of Cybercrime – No Slowing Down, for industrial automation systems, Concerns, July 2018 February 2018 September 2018 A global leader in cybersecurity As a founding member of the Charter of Trust, Siemens is a leader in advancing global cybersecurity. Signed in Munich with partners around the world, the Charter calls for binding rules and standards to build trust in cybersecurity Implement and further advance digitalization. Assess With a full portfolio of state-of-the-art products, systems, and services that protect customers’ data and equipment, Security Siemens is a reliable and preferred partner for companies which strive for the highest standards of cybersecurity. Through a unique and multifaceted know-how as well as comprehensive technology solutions for cybersecurity, Siemens is home to industrial network experts with more than a decade of experience assessing and designing OT networks.
Manage
Assess Implement Manage
Assessment of the network is the first step After working to understand security needs Managing the security of a network means and the key to a successful roll-out of and risks, Siemens implements a new staying on top of key areas: monitoring cybersecurity solutions. security regime. More than just an out-of- threats, keeping security solutions up to the-box security system on top of opera- date, and ensuring quick reaction times to In the network assessment phase Siemens tional technologies, everything companies identify threats. experts analyze the number of assets do should be ‘secure by design’. the customer has. This assessment Keeping network secure does not stop also provides insights into security Before adopting a new system, Siemens with the implementation of cybersecurity vulnerabilities of customer’s network. assists in design and deployment of a solutions. In the managing phase security solution to ensure a smooth customer manages the deployed transition. This includes pre-configuration cybersecurity solution by maintaining and testing services as well as training so the software and signatures up to date. staff can hit the ground running and play their part in secure operations. RUGGEDCOM cybersecurity solutions
Hardware
Software
Services
Comprehensive cybersecurity solutions on the RUGGEDCOM hardware platform detect
potential attacks, reduce their severity, lower costs, and ensure compliance with a growing number of regulations. Siemens offers cybersecurity solutions installed on the RUGGEDCOM Multi-Service Platform product family of cost-efficient, utility-grade Layer 2 and Layer 3 switches and routers – designed for harsh environments and mission-critical applications. This is combined with comprehensive network consulting services, on-site support, security assessments, integration, deployment, and training. Siemens has collaborated with leading minds in industrial cybersecurity to bring bundled solutions with certified partner applications. Third-party applications from leading cybersecurity companies available on RUGGEDCOM devices provide more options for addressing various security challenges. Taking into account region-specific preferences to cybersecurity, Siemens helps create an ecosystem of comprehensive and reliable solutions customized to customers’ needs. With no scheduled maintenance required and 24/7 availability, RUGGEDCOM products provide critical infrastructure access and peace of mind security. Using RUGGEDCOM cybersecurity solutions, Siemens customers can establish an electronic security perimeter around their critical infrastructure to prevent the disruption of mission-critical applications by accidental or malicious acts. Stateful Inspection Firewall Virtual Private Networking (VPN) Strong encryption Stateful inspection firewall to control traffic Provides secure communication links over Utilizes latest encryption algorithms for between different zones of trust within networks. Ensures confidentiality, sender authorization, authentication and privacy. a network. Includes Network Address authentication, message integrity, and Examples include TLS and SSH at upper Translation (NAT) to prevent unauthorized uses IPSec (IP Security) for encryption and protocol levels, RSA and ECC for public or malicious activity, initiated by outside authentication of all IP packets at the key encryption, and 3DES and AES for hosts, from reaching the internal Local network layer. stream encryption. Area Network (LAN).
RUGGEDCOM Multi-Service Platform
The Multi-Service Platform product family of utility-grade Layer 2 and Layer 3 switches and routers has been specifically developed to provide multiple electronic defense layers for the protection of critical cyber assets. RUGGEDCOM Multi-Service Platform is the main point of entry between the local area network (plant floor or substation) and the outside world. The platform combines a Layer 3 router, a firewall, and a VPN in one device.
RUGGEDCOM Application Processing Engine (APE)
RUGGEDCOM RX1500
RUGGEDCOM RX1500 RUGGEDCOM’s RX1500 series is a family of utility-grade Layer 2 and Layer 3 switches and routers. The RX1500’s modular and field replaceable platform allows customers to select amongst Wide Area Network (WAN), serial, and Ethernet options, making it ideally suited for utilities, industrial plant floors, and rail and traffic control systems. These field-proven, industry-leading devices have been coupled with cybersecurity applications to offer customized solutions of various security levels. Field-swappable modules guarantee flexibility and easy maintenance for critical applications and are certified for use in the harsh environments of electric power, transportation, and oil and gas industries.
RUGGEDCOM Application Processing Engine (APE)
The new version of the industrial application hosting platform – RUGGEDCOM APE1808 – is ideal for safely running third party software applications in harsh, mission-critical environments. The module plugs directly into any member of the RUGGEDCOM RX1500 family, except for the RX1512, without the added complications of installing an external industrial PC. RUGGEDCOM APE1808 excels at hosting a range of applications such as next generation firewalls, network log and load processors, and intrusion sensors. Based on Intel quad core and x86_64 architecture with support for Linux and Windows 10, the RUGGEDCOM APE1808 provides a standards-based platform for commercially available software, enabling partnerships with industry leaders in cyber threat detection and prevention. Corporate Network RUGGEDCOM cybersecurity solutions Enterprise installed on the RUGGEDCOM Application Remote Access Multi-Service Platform designed Server(s) 5 for harsh environments and mission-critical applications.
Industrial Ethernet RUGGEDCOM RX1500 with APE1808 and with APE1808 and ADM CROSSBOW SAM-L 1 2 5
1 Anomaly-based Intrusion Detection System (IDS) 1 2 RUGGEDCOM RX1510 with APE1808 Patch Server, 2 Deep Packet Inspection (DPI) Anti-virus, etc. 1 2 4
3 Intrusion Prevention System (IPS) LAN Switch LAN Switch
RUGGEDCOM RST2228 RUGGEDCOM RST2228
4 Next Generation Firewall (NGFW)
Field Devices Controller Engineering
5 RUGGEDCOM CROSSBOW – Workstations Secure Access Control
RUGGEDCOM CROSSBOW – Secure Access Control
RUGGEDCOM CROSSBOW is a secure access management solution designed to provide assistance with cybersecurity compliance including NERC CIP (North American Electric Reliability Corporation critical infrastructure protection) and IEC 62443-1 access to Intelligent Electronic Devices (IEDs). The CROSSBOW solution focuses on delivering produc- tivity gains for administrators and users while assisting with cybersecurity compliance in managing, securing, and reporting on remote access. The RUGGEDCOM CROSSBOW system consists of a central server along with a number of clients connecting securely with TLS 1.2 – typically the user’s desktop or laptop computers. The server contains the system database, based on Microsoft SQL Server, and manages all connections from the clients to the remote IEDs. The central server supports a high availability cluster configuration for increased reliability. With administrator defined Role Based Access (RBA), CROSSBOW provides activity logging and data privacy as users connect to remote Intelligent Electronic Devices (IEDs). Operators are guaranteed a secure connection to field devices without going on-site or entering an application, allowing them access to devices from the comfort, convenience, and safety of the control room. Strong two-factor authentication through RSA SecurID, Active Directory, and RADIUS ensures the highest in process security. In addition to secure access, the RUGGEDCOM CROSSBOW solution provides automated functionality for device password management, configuration and firmware version monitoring, remote connectivity verification, and data file retrieval. Anomaly-based Intrusion Detection System Non-Intrusive, anomaly-based signatureless Intrusion Detection System (IDS) software for mission-critical operational networks, operating on RUGGEDCOM hardware, provides early-warning notification and alerting on vulnerabilities and sophisticated cyber threats that may be undetectable by conventional IT security tools.
Deep Packet Inspection
Deep Packet Inspection (DPI) on the RUGGEDCOM RX1500 with the APE1808 examines data packets utilizing a non-intrusive methodology for mission-critical networks focusing on OT protocols (such as Modbus and DNP3) searching for potential non-compliance traffic, viruses, spam, intrusions, or user-defined criteria to determine whether the packet may pass or if it needs to be routed to a different destination for cybersecurity analysis and mitigation helping to secure communication to control centers and IT networks.
Next Generation Firewall
Utilizing a combination of RUGGEDCOM switching and routing platform, with leading Next Generation Firewalls (NGFW) functionality on a single, integrated appliance, provides for additional integrated DPI/IPS functionalities, offering security when connecting non-critical IT networks, to critical deterministic operational networks.
Intrusion Prevention System
An Intrusion Prevention System (IPS) is a capability available on the RUGGEDCOM hardware if equipped with a NGFW solution. IPS is located between the WAN and the LAN to deny the traffic that represents known threat based on a security profile.
Siemens professional services
From assessment, pre-configuration and testing services to implementation and training, Siemens has it covered. Siemens professional services team offers: • Discovery and analysis of the existing network assets and network architecture • Vulnerability assessment of the network by assessing the existing security features and providing a security assessment report with recommendations on how to improve the security • Design and deployment of security solutions and security training of the stakeholders Published by Siemens AG
Digital Industries Process Automation Östliche Rheinbrückenstr. 50 76187 Karlsruhe, Germany For the U.S. published by Siemens Industry Inc.
Siemens provides products and solutions with industrial security
functions that support the secure operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks against cyber threats, it is necessary to implement and continuously maintain a holistic, state-of-the-art industrial security concept. Siemens’ products and solutions only form one element of such a concept. Customer is responsible to prevent unauthorized access to its plants, systems, machines and networks. Systems, machines and compo- nents should only be connected to the enterprise network or the Internet if and to the extent necessary and with appropriate security measures (e.g. use of firewalls and network segmentation) in place. Additionally, Siemens’ guidance on appropriate security measures should be taken into account. For more information about industrial security, please visit siemens.com/industrialsecurity
Siemens’ products and solutions undergo continuous development
to make them more secure. Siemens strongly recommends to apply product updates as soon as available and to always use the latest product versions. Use of product versions that are no longer supported, and failure to apply latest updates may increase customer’s exposure to cyber threats. To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed under siemens.com/industrialsecurity
