wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Security in Industrial Communication Systems 22-3
22.2 Planned Approach to Security: Defense in Depth
Security should be a planned process that comprises the complete system. The security policy, also called
security architecture, describes all security measures but also all relevant organizational procedures and
the system environment required to protect a system. It includes the organization’s approach to risk, a
formal statement of rules through which people are given access to the organization’s assets, a definition
of business and security goals, and a description of the implemented security measures.
Security is only 20% technology and 80% organization including personnel, process descriptions, etc.
Relevant areas can be comprehended in the 4 P’s of security: People, Policy, Processes, and Procedures.
The setup and maintenance of a security policy includes the following steps:
1. Asset and risk analysis identifying the values to be protected (e.g., information or hardware),
possible attacks, and the possible damage to the system.
2. Threat analysis is based on the risk analysis and is assigning the impact of damage. Whereas the
risk analysis is only committed to the identification of risks, the threat analysis is giving a priority
to the impact of risks and assigns occurrence probabilities as well as the extent of damage. The
resulting risk finally is the product of caused damage and the probability of the threat. In general,
for industrial communication systems, a qualitative risk assessment is common since it is hard to
precisely determine values for damage and its probability.
3. Analysis of weaknesses tracking vulnerabilities of the system. In this step, the system will be carefully
analyzed. Based on the previous two steps, actual weaknesses will be identified. Only for
these weaknesses countermeasures must be designed.
4. Design and specification of security measures dealing with the planning and implementation of
appropriate countermeasures. Especially important in this step is to find the trade-off between
consequences of an attack and “comfort.” For example, consequences could be a monetary loss
but also a damage of the image or an environmental damage, whereas “comfort” subsumes many
areas beginning from efficient data transmission, low installation costs, easy usability, or social
acceptance. Hundred percent security is not possible. Only an optimum within this trade-off can
be found on the base of a certain application or application class. Another important part of this
phase is the definition of the system boundaries of the security architecture. For example, the best
cryptography to protect the transmission channel is useless, if the password requires being so
complex that all users maintain a paper copy of the password beneath their keyboard.
This general procedure to design a security policy is a continuous process throughout the life time
of a system. In particular, a good security policy is active and not only reactive in the sense that it foresees
incidents and avoids being a pure reaction on attacks. Adversaries are favored; they can concentrate
on certain vulnerabilities and do not have to protect the whole system. To all these procedures,
the principle of Kerckhoff should be applied demanding that the complete cryptographic algorithm
must be public and the security should only rely on the secrecy of the keys [KER]. No security by
obscurity. Allowing algorithms and procedures to be open allows wide spread security analysis, and
therefore reduces the risk of undiscovered security holes. Additionally, this principle also reduces the
risk of insider attacks since the knowledge of the system structure offers no advantages unless the
proper keys are known.
For industrial automation systems a “defense-in-depth” concept is the favorable approach to protect
systems since many industrial communication systems are already structured in a hierarchical way following
the computer-integrated manufacturing (CIM) model philosophy and also following the need
to structure the network. Defense in depth relies on different security layers to protect valuable assets:
Using the famous onion analogon, we see that removing the outmost (security) layer reveals another
layer and many more remain to be peeled away before the assets become vulnerable. In the physical
world such a procedure is natural (also in industrial automation) having a fence around the factory area,
© 2011 by Taylor and Francis Group, LLC