A featured contribution from Leadership Perspectives: a curated forum reserved for leaders nominated by our subscribers and vetted by the Construction Tech Review Advisory Board.
Emerson Automation Solutions
Addressing the Complex Cyber Security Needs of Digital Manufacturing
Digital manufacturing runs on data, and while today’s networks are highly sophisticated, they still require data entry, collection, storage and distribution to automate or improve upon tasks previously done manually. Every time data moves from one step to the next or gets handed off from one part of a network to another; it creates an opportunity for theft or manipulation.
Today’s digital manufacturing applications typically use a mix of wired and wireless communication on interconnected networks for transmitting data collected by sensors to host systems. Industrial wireless networks connect to wired systems to hand off data, introducing possible points of vulnerability. This means someone trying to secure the network must look at the infrastructure from end-to-end to create an effective defensive strategy.
Operations technology (OT) personnel have to move data to IT systems so management and accounting can access it. If a hacker can find a vulnerability in the OT applications and networks, this can often provide a path to move into the IT networks. This is a tried-and-true method since OT networks are usually not as well protected as IT networks. Adding industrial wireless networks and extensions make the problem worse by creating additional hand-off points and a larger attack surface.
Unfortunately, the ways security gets applied with industrial wireless devices and networks is uneven, to put it mildly. Most claim some degree of encryption, but if it is not applied well, it can be circumvented. It falls to the network managers to review specifications and practices carefully as they implement digital manufacturing projects.
Prying Open the Door
While hackers are often very clever, the majority have to depend on a handful of established cyber burglar tools. Here are some of the most common, in order of sophistication and difficulty.
Interference or jamming denial of service (DoS)
The easiest attack is simply to disrupt radio communication by creating high amounts of electromagnetic interference. This can be gross and aim at a wide spectrum, or more sophisticated, zeroing in on specific frequencies. In any case, it can stop communication but does not give the attacker anything of value, and the source is usually not difficult to find.
Bad data DoS
Fake failure messages or requests broadcast on the network can cause the AP’s resources to be consumed by bad communications, leaving insufficient bandwidth to serve legitimate clients. Again, this is disruptive and more difficult to pinpoint the source than jamming but doesn’t help the attacker.
Once the proper network is selected, users must be vigilant to ensure ongoing cybersecurity
Ad-hoc wireless bridges
This approach is backward in that the hacker attacks the wireless network from the wired network, which makes it the only approach that can be carried out remotely. At the point where the wireless network interfaces with the wired systems, it is possible to configure some devices to participate in the wireless system via an ad-hoc connection. The hacker can then bridge the gap between the two networks, allowing unsanctioned access to the wireless network from the wired network.
Rogue APs
A poorly managed wireless network may permit the addition of new APs able to communicate with the devices. This capability can be used legitimately to improve network coverage, but a hacker can also insert a device and use it to participate in normal network traffic.
Man in the middle
An intruder inserts a wireless node in the path of legitimate communication between a transmitter and gateway cutting off the direct path. As a result, each end of the link thinks the new node is the other. The hacker can manipulate the data flow, inserting false data or instructions at will. This requires intimate knowledge of the network and management methods, plus the ability to place the device in the network.
Reconnaissance and cracking
As wireless networks have developed over the last decades, the encryption methods have been broken, requiring them to be improved with each networking advance. WirelessHART uses AES 128-bit encryption which remains unbreakable by brute force. So even if an attacker can get close enough to eavesdrop on the device-to-gateway communication, the encryption makes it impossible to decode and understand the data.
These attack vectors can be addressed by implementing the following preventative measures.
Addressing Attack Vectors
Access Control
Controlling access to the network requires every device to authenticate itself so it can join a network and communicate with the gateway.
Network Protection
The two main network protection methods are, first, all wireless communication is encrypted with AES128-bit encryption with multiple keys, and second, all devices on the network are authenticated.
Preserving Data Confidentiality and Integrity
In spite of all these security measures, careless users and poor network managers can create vulnerabilities by being lax with passwords and join keys. If these are not applied to their greatest advantage and workers trained to understand their importance, they can fall into the hands of hackers allowing them to gain access.
Integrating a Solution
Cybersecurity for digital manufacturing initiatives cannot be implemented piecemeal. Networks must be evaluated end-to-end rather than inserting firewalls and other security appliances at random points.
Creating a new cybersecurity strategy or evaluating an existing one requires working with a vendor able to manage the big picture to create a network with the required security features. Once the proper network is selected, users must be vigilant to ensure ongoing cybersecurity. If these steps are taken, the network will be sufficiently secure for the most critical applications.
