Highly Secure in Non-Secure Networks With OPC UA

From the perspective of IT security, what fundamental questions arise if a secure network is to be set up for Industry 4.0? 

Steve Schoner:  First, you should be aware of what assets are located in the network – that perhaps the network grew organically over the years and was not always throughly documented. Our cognitix Threat Defender can help answer this question by using asset detection or asset tracking to analyze which transmitters and receivers communicate with one another. Other important questions include:
How should the network be structured?
How can networking be performed securely?
What do you want to network together?

As IT security experts, how do you assess the networking of plants and machinery with OPC UA? Is that first and foremost useful or risky?

Markus Maier: Under the rubric of networking and digitization, the standard is useful for industry in any case. The topic of security plays a fundamental role, of course. IT security is part of the OPC UA standard – a separate security layer was specified for this purpose. This defines mechanisms such as how services or devices identify themselves, how data is encrypted and how the authentication of this data is ensured. It also allows secured sessions between an OPC UA client and server and offers auditing services in the spirit of "when did which device or which client, server or user use certain services." OPC UA also defines an information model specifying how data can be accessed in a structured manner, such as machine data, machine states or alarms. A separate data model exists for this purpose. Thus, the interpretation of the data is standardized as well.

Steve Schoner: The OPC UA protocol thereby does in fact ensure security. It defines uniform interfaces for how data and applications are accessed.

Markus Maier: You also need to be aware that you are dependent on the security of the implementation of the OPC UA protocol or stack. With a given stack, you also need to work with its weaknesses. Anyone who wants to eliminate these risks should consider supplementary security solutions like our high-security cyber-diode. This diode itself allows only unidirectional communication, for example, to channel data from sensitive industrial plants into the IT-security layer of non-secure environments, such as the Internet or a cloud. If the OPC UA stack is compromised due to vulnerabilities, this does not affect the integrity of the industrial plant. In this case, attackers have no access to the plants or machinery. We also supply an encrypted data channel via IPsec from the classified data sector, independent of the OPC UA encryption.

Does this mean that OPC UA significantly simplifies communication in industrial networks but, with respect to IT security, increases the risk of a compromise?

Markus Maier: You can't put it quite like that. The OPC UA standard does, in fact, address the aspect of IT security and, as already explained, does take an integrated security layer for authentication and encryption into account in the design. The problem is that the user is dependent on the implementation of the OPC UA stack of the respective manufacturer. This difficult-to-assess security risk can be intercepted very well by our solutions, e.g., by means of network segmentation or a strict network separation between sensitive and non-secure areas. With the Industrial Firewall genuwall, segmentation, authentication and automation are available to the customer for checking whether a user or a machine is authorized to use a specific OPC-UA server service. And the cyber-diode strictly separates highly critical networks in which standard firewalls do not provide sufficient protection. It offers a reliable communication channel to the Internet without leaving itself vulnerable from the outside.

genua is the IT-security specialist. What expertise can the company contribute to Industry 4.0?

Steve Schoner: When everything is networked to everything else, the question arises as to how individual segments can be effectively secured. This is the area in which genua has its expertise. Our solutions secure domain and segment transitions. What distinguishes our products from those of other IT-security providers is that we offer not only stateful firewalls but also have an OPC UA application filter that queries authorization layers, e.g., to determine whether someone is permitted to send a message to a certain target system. We can offer network segmentation not only on the TCP/IT layer like classic firewalls but also on the application layer. Moreover, we also enable edge computing, i.e., data preprocessing and analysis on a secure platform with flexible docker apps in your own network before the data is diverted vertically for further processing.