Securing IIoT Devices
How to Secure the Industrial Internet of Things (IIoT) Alan Grau Icon Labs
How to secure the IIoT • What is the Industrial Internet of Things • Why worry about security? – Growing threat of cyber-attacks – Regulatory drivers (EDSA, NERC-CIP, etc.)
• Overview of standards • Nuts and bolts of security for IIoT devices – Framework/requirements for security – Implementing security for IIoT devices
• Summary/Questions 2
Industrial Internet of Things • Industrial IoT –cyber-physical systems that are connected and intelligent from the lowest levels of the industrial environment up to the enterprise and into the cloud
3
Value of the IIoT • $32 Trillion value according to GE
• Security is required to realize this value
Source: GE IIoT Presentation 4
Growing threat of cyber-attacks
Security Standards • Industrial automation – ISA/IEC 62443:EDSA •
www.isa.org/isa99/
• Federal Mandate/NIST Cybersecurity Framework – US Federal Executive Order (EO) 13636 •
www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructurecybersecurity
• Power Grid/Smart Grid – NERC/CIP •
www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
6
Regulatory Compliance: Major Driver • Regulatory compliance is frequently a driving force for implementing security – Quantifiable – Understandable
• Executives who struggle to understand nuanced security tradeoffs CAN understand compliance
7
Security Standards • Many standards, but common themes – Identity management – Mutual authentication/authorization – Audit – Protection – Secure communication – Attack detection and mitigation – Security management and visibility
8
Securing IIoT Devices – perimeter solution • One solution: More Perimeters – Expensive! – Doesn’t address fundamental issues
• Security perimeters are only a partial solution – IIoT devices may not be inside of a security perimeter – Perimeters can be compromised – Insider threats account for more than 50% of cyber-incidents
9
Securing IIoT Devices – baked in solution • Don’t rely only on the perimeter • Build the required security into the device – Order of magnitude lower cost – Addresses basic security needs such as secure boot and security management
10
Challenge of IIoT Device Security • IIoT devices are embedded devices – Embedded Linux, Android or RTOS-based – Limited resources for security software – Traditional IT security solutions won’t work
• Not just about data – protecting critical operations • Need new solutions designed for embedded devices – Build it yourself – Find a commercial solution 11
OT devices, IT security • All devices must be – Protected – Trusted – Authenticated – Secured – Managed – Visible
12
Security Requirements for the IIoT • Harden the device – Hypervisor, secure boot, intrusion detection – Leverage hardware security features
• Data protection – Data at rest, data in motion – key and password obfuscation
• Secure communication – Security protocols, mutual authentication, firewall
• Visibility and management – Management system integration (policy updates, events) 13
Security Framework – Designed for embedded use – Portable – Small footprint – Minimal performance overhead
14
Hardening the device • Leverage hardware security features – TPM/TEE – Secure device ID – Crypto acceleration
• Hypervisor • Secure boot • Intrusion detection
15
Leverage HW Security Features • Trusted Platform Module (TPM) – International standard for a secure cryptographic processor – Dedicated microprocessor designed to enable secure devices – Secure key storage – Key generation – Encryption/decryption
• Provides foundation for security
Proprietary Information – Strictly
Hypervisor • Enables partitioning to increase security – Security processing & management isolated from user processing
• Security breach in one partition cannot impact other partitions
17
Secure Boot Before loading software, verify • it came from the OEM • it has not been tampered with
Hardware TPM/TEE can provide • Protected key storage • Protected signature storage • Signature generation
IDS/IPS for Embedded Devices • Communication based IDS/IPS – Report firewall rules violations – Protocol specific DPI – Detect scans, probing
• Configuration based IDS/IPS – Detect unauthorized changes to firmware, libraries and data files
• Report events to a security management system
Securing Embedded Device Data • Data at rest: device is off, how is the data protected? – Encrypted files, full disk encryption
• Data in use: while generated or being processed is it secured? – Obfuscation, MMU based protection methods, user privileges – Protect against memory scraping attacks
• Data in transit: leaving the device, is it being hijacked? – Security protocols
Secure Communication • Security protocols – IPsec/IKE (VPN) – SSH / SSL/TLS/DTLS
• Authentication – – – –
X.509 / Kerberos RADIUS TACACS+ 802.1X
Secure Communication – Embedded Firewall • Endpoint firewall for embedded/RTOS systems • Rules based filtering (IP addresses, ports, protocols) • Stateful packet inspection • Threshold filtering • Protocol specific deep packet inspection • IDS alerts
Management and visibility • Policy management • Event reporting • Situational awareness • Status monitoring • Secure firmware updates
23
Summary • Common requirements – Industry standards help define security requirements – Many standards, but common requirements
• Utilize a security framework that provides building blocks to enable and support the various standards • Integrate security into the device itself – don’t just rely on a secure perimeter
Q&A • Questions?
How to secure the IIoT • What is the Industrial Internet of Things • Why worry about security? – Growing threat of cyber-attacks – Regulatory drivers (EDSA, NERC-CIP, etc.)
• Overview of standards • Nuts and bolts of security for IIoT devices – Framework/requirements for security – Implementing security for IIoT devices
• Summary/Questions 2
Industrial Internet of Things • Industrial IoT –cyber-physical systems that are connected and intelligent from the lowest levels of the industrial environment up to the enterprise and into the cloud
3
Value of the IIoT • $32 Trillion value according to GE
• Security is required to realize this value
Source: GE IIoT Presentation 4
Growing threat of cyber-attacks
Security Standards • Industrial automation – ISA/IEC 62443:EDSA •
www.isa.org/isa99/
• Federal Mandate/NIST Cybersecurity Framework – US Federal Executive Order (EO) 13636 •
www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructurecybersecurity
• Power Grid/Smart Grid – NERC/CIP •
www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
6
Regulatory Compliance: Major Driver • Regulatory compliance is frequently a driving force for implementing security – Quantifiable – Understandable
• Executives who struggle to understand nuanced security tradeoffs CAN understand compliance
7
Security Standards • Many standards, but common themes – Identity management – Mutual authentication/authorization – Audit – Protection – Secure communication – Attack detection and mitigation – Security management and visibility
8
Securing IIoT Devices – perimeter solution • One solution: More Perimeters – Expensive! – Doesn’t address fundamental issues
• Security perimeters are only a partial solution – IIoT devices may not be inside of a security perimeter – Perimeters can be compromised – Insider threats account for more than 50% of cyber-incidents
9
Securing IIoT Devices – baked in solution • Don’t rely only on the perimeter • Build the required security into the device – Order of magnitude lower cost – Addresses basic security needs such as secure boot and security management
10
Challenge of IIoT Device Security • IIoT devices are embedded devices – Embedded Linux, Android or RTOS-based – Limited resources for security software – Traditional IT security solutions won’t work
• Not just about data – protecting critical operations • Need new solutions designed for embedded devices – Build it yourself – Find a commercial solution 11
OT devices, IT security • All devices must be – Protected – Trusted – Authenticated – Secured – Managed – Visible
12
Security Requirements for the IIoT • Harden the device – Hypervisor, secure boot, intrusion detection – Leverage hardware security features
• Data protection – Data at rest, data in motion – key and password obfuscation
• Secure communication – Security protocols, mutual authentication, firewall
• Visibility and management – Management system integration (policy updates, events) 13
Security Framework – Designed for embedded use – Portable – Small footprint – Minimal performance overhead
14
Hardening the device • Leverage hardware security features – TPM/TEE – Secure device ID – Crypto acceleration
• Hypervisor • Secure boot • Intrusion detection
15
Leverage HW Security Features • Trusted Platform Module (TPM) – International standard for a secure cryptographic processor – Dedicated microprocessor designed to enable secure devices – Secure key storage – Key generation – Encryption/decryption
• Provides foundation for security
Proprietary Information – Strictly
Hypervisor • Enables partitioning to increase security – Security processing & management isolated from user processing
• Security breach in one partition cannot impact other partitions
17
Secure Boot Before loading software, verify • it came from the OEM • it has not been tampered with
Hardware TPM/TEE can provide • Protected key storage • Protected signature storage • Signature generation
IDS/IPS for Embedded Devices • Communication based IDS/IPS – Report firewall rules violations – Protocol specific DPI – Detect scans, probing
• Configuration based IDS/IPS – Detect unauthorized changes to firmware, libraries and data files
• Report events to a security management system
Securing Embedded Device Data • Data at rest: device is off, how is the data protected? – Encrypted files, full disk encryption
• Data in use: while generated or being processed is it secured? – Obfuscation, MMU based protection methods, user privileges – Protect against memory scraping attacks
• Data in transit: leaving the device, is it being hijacked? – Security protocols
Secure Communication • Security protocols – IPsec/IKE (VPN) – SSH / SSL/TLS/DTLS
• Authentication – – – –
X.509 / Kerberos RADIUS TACACS+ 802.1X
Secure Communication – Embedded Firewall • Endpoint firewall for embedded/RTOS systems • Rules based filtering (IP addresses, ports, protocols) • Stateful packet inspection • Threshold filtering • Protocol specific deep packet inspection • IDS alerts
Management and visibility • Policy management • Event reporting • Situational awareness • Status monitoring • Secure firmware updates
23
Summary • Common requirements – Industry standards help define security requirements – Many standards, but common requirements
• Utilize a security framework that provides building blocks to enable and support the various standards • Integrate security into the device itself – don’t just rely on a secure perimeter
Q&A • Questions?
