wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

22-4 Industrial Communication Systems
Company or internet domain
(entrance domain)
Intranet domain
(checking domain, DMZ)
Security
measure
Security
measure
Shop floor
domain
(fieldbus)
Inner security structure
Trustworthy
entity
Security
measure
FIGURE 22.1
Three-zone security model.
locked doors to the shop floor, and locked cabinets to the control. Figure 22.1 shows a three-zone security
model optimized for industrial communication applications as also introduced by [SC2,TR1,KHA1].
Corresponding to the interconnection zones in the company network three zones are available. The
inner fieldbus zone hosting the field-level communication systems mostly located at the shop floor, the
intranet zone often build upon IP-based LANs inside the plant (it also includes demilitarized zones
(DMZs) and checking domains or inner security structures to strengthen the security), and finally the
Internet zone also referred to as company or entrance domain connecting multiple plants, remote maintenance
sites, customers, etc. The zones are separated from each other by dedicated security measures
often located at dedicated network nodes that can be used as anchor points for the security strategy.
Typical examples are firewalls between the company and the intranet domain or application gateways
between the intranet domain and the shop floor. As there is only a limited number of those network
nodes (between every couple of zones), it is possible to use state-of-the-art components in regard to security
without straining available resources too much. In this way, a defense-in-depth approach is installed
preventing that an adversary has access to all zones and especially to the most inner zone forming the
core of production. Additionally, focusing most of the efforts to those anchor points of the network
infrastructure avoids misconfiguration that may happen if the number of security-relevant nodes grows.
22.3 Security Measures to Counteract Network Attacks
To counteract network attacks, two possibilities exist. First, unauthorized access to the network and
thus to the data that is transmitted over the network can be avoided. One approach is to limit the physical
access to the network medium by, for example, immuring the network cable. Obviously, preventing
physical access is not always possible. Consider, for example, the use of wireless or wide area networks
where public access cannot be avoided. Therefore, organizational measures that limit the logical access
can be used instead. Typical examples are the use of virtual private networks (VPNs) (cf. Section 22.3.1)
and firewalls (cf. Section 22.3.2).
Second, the transmitted data itself can be protected in a way that an adversary is not able to maliciously
interfere with it even in cases where an adversary has access to the network. According to [GR1],
the following security objectives can be guaranteed: data confidentiality (against interception attacks),
data integrity and authentication (against modification attacks), data freshness (against fabrication
attacks), and data availability (against interruption attacks). Depending on the security requirements
© 2011 by Taylor and Francis Group, LLC