wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Quality of Service 19-3
19.2 relationship with Information Security Topics
As remarked before, some of the topics related with QoS are the information security facts that any
network professional must know, at least at an introductory level, related with the need of continuous
availability and reliability of the industrial network and data.
As special security problems in industrial networks, it is necessary to emphasize the following:
• Physical security problems: The scope of these problems is the range of devices found in a network:
PCs or client workstations, servers, routers, switches, or special dedicated equipment.
Especially for the most sensible devices, if they are not correctly placed, they faced a possible
destruction or an easy unauthorized access to the console of the device, with the consequent
risk for the control of the device or for the data being there and, as a consequence, for the value
of the network.
• Software security problems: It is necessary to include here the operating systems of devices, any IP
protocols implementation, and any industrial application installed in the devices. The most common
problems are the security bugs due to bad coding (very common), the insecure configuration
of the authentication and authorization files in the operating system, the insecure configuration
of the permissions for the file systems, or a bad policy for the security copies of the data. Also,
it must be taken into account the problems due to incorrect implementation of protocol stacks
or the use of dangerous protocols or applications, as the case for Telnet, ftp, tftp, RIP, SMTP,
and so on.
• A significant emphasis must be put on the need of having a good antivirus system and special control
for the attachments in any mail entered in the network, especially if our industrial network
shares the media with the staff network.
• It is also important to take time to analyze the security in the fundamental network devices, the
switches and the routers. They are no more than hardware and software; but the consequences of
security breaches in them can be extremely dangerous. For example, if one of the switches in our
network suffers a denial of service attack, every device running our applications is disconnected
and the final result is that we have no network. Sometimes also we can suffer a capture attack in
one of our routers and, from the router, using a privilege escalation technique, our servers can be
hacked and obliged not to do its usual job.
From the technical point of view [5], we have many tools to face all these security problems, but, in
a consistent way with the idea of quality expressed in the previous section, we need a security policy to
organize all the implementations of security defenses.
An information security policy can be defined as “a formal statement of the rules by which people,
who are given access to an organization’s technology and information assets, must abide” [6].
The main goal is to inform all the people in the organization about the obligatory requirements to
observe, to protect the technological values and resources and all the organization’s information.
The policy must make explicit the mechanisms for us to obey each norm and the methodology to follow
for each of the particular cases. If it is complete enough, it can give the hints to select the technologies,
including software and hardware to implement the policy.
To build a good network security policy for a concrete organization, a number of key questions must
be answered:
• What exactly must be protected? First a complete inventory must be built, taking into account
different security standards like ISO/IEC 27001 [7] or ISO/IEC 15408 [8]. Then, a selection (with
assigned priorities) of the actives to protect must be built.
• Who could attack our network? It is extremely important to analyze every internal and external
people that work with us and decide in which trust. Also, it is a good idea to think about the
possible motivations of virtual attackers.
© 2011 by Taylor and Francis Group, LLC