Secure communication, network access protection and network segmentation with Security Integrated components

In industrial automation and control engineering, standardized hardware and software components are increasingly being used that allow end-to-end networking among themselves and also with the office IT and Internet. These open systems simplify the integration of the individual components and reduce the dependency of certain suppliers since the interoperability is significantly better. This speeds up production, allows a better overview and reduces development and production costs. Overall, the aim is for better efficiency to maintain or even improve competitiveness.

These advantages, however, involve risks since open systems are also susceptible to attacks, manipulation, sabotage and industrial espionage.

To protect an automation system, a comprehensive security concept is necessary. This multi-level concept is also known as defense-in-depth.

The defense-in-depth concept can be divided into 3 levels:

• Plant security - this involves organizational measures such as the physical protection of the plant by monitoring and access control as well as the establishment of a security management process
• Network security - in other words, restricting access to the production network
• System integrity - access control and protection of data integrity of automation components

The central element in the defense-in-depth concept is network security; in other words, protecting access to the automation network from other networks or remote access from the Internet as well as the security-relevant segmentation of the automation network (cell protection concept).

Advantages of the cell protection concept:

• Protection of devices that do not have their own security functions
  • Secure communication from and to the cells
  • No influence on real-time communication (e.g. PROFINET) within the automation cells by security functions
  • Protection function simple to integrate even in existing networks

Security Integrated

The Security Integrated attribute identifies products for industrial use with special security functions to improve the security standard and to minimize the risks for automation applications.

The following Security Integrated products are available:

• SCALANCE S security modules, e.g. S623 with additional DMZ (demilitarized zone) port that opens a separate and, if required, restricted network access for service purposes, e.g. for remote maintenance over the Internet.
• Protection of SIMATIC S7-300 and S7-400 controllers by CP 343-1 Advanced and CP 443-1 Advanced communications processors, the latest versions of which include both firewall and VPN (virtual private network) functions.
• With the CP 1628 communications processor, industrial PCs are protected by firewall and VPN – for secure communication without special operating system settings. This means that computers equipped with the module can be connected to protected cells.
• The SOFTNET Security Client software allows access via the Internet or an internal company network to automation cells or PCs protected by SCALANCE S or a component with Security Integrated.
• SCALANCE M875 UMTS router for secure access to plant sections via the UMTS mobile wireless network.

SIMATIC S7-1500 with Security Integrated:

• Protection of the controller by access protection (authentication) via the S7-1500 CPU:
  • New protection level 4 for complete locking of the CPU (even HMI connections require a password).
  • Individual assignment of permission levels (1 to 3 with own password).
  • For access via the CPU and CM interface - general configuration block via the CPU display.
  • Expandable access protection (firewall) via security CP 1543-1 thanks to an integrated firewall (control of the data flow).

Security Integrated products for industrial use with special security functions to improve the standard of security