Volume 67, Issue 5 - Special Issue: IT-Security in Automation Technology / Jörn Müller-Quade, Jürgen Beyerer and Brandon Broadnax

“Stagnation is death“. This quote can be applied to two aspects. First, it is bad for a company if an outage occurs since then it cannot produce goods anymore and thus can make no more profit. Second, this quote can also refer to the developments leading to Industry 4.0. But what happens if technological progress creates more risks? The following article explores this issue with respect to IT security.

Industrie 4.0 fosters the concept of systems within one company to communicate with external systems in other companies or cloud services. Such communication across security domains creates new challenges as multiple stakeholders with different, sometimes conflicting objectives are involved. Typical examples are confidentiality versus monitoring. Current security architectures and protocols are not designed to resolve these challenges.

Today, industrial cybersecurity is in the early stages of its development, gradually evolving into a science and technology discipline that will become the cornerstone of industrial manufacturing and construction technologies, the infrastructure of modern cities, transportation, healthcare, etc. The community of researchers and engineers is constantly looking for solutions to protect both existing systems and future technologies. As we depart from the starting point, we must build our assumptions on an objective assessment of the current situation, because, at this stage, even seemingly insignificant misconceptions can cause major fluctuations that prevent us from choosing the right strategy. In this article, we will discuss typical misconceptions and common errors in assessing the security of industrial control systems that Kaspersky Lab ICS CERT experts encounter in their day-to-day communication with people from different industrial sectors and the community of information security experts. We will support our conclusions with the results of the past several years’ research into the various cyberthreats affecting industrial enterprises.

Industrial automation and control systems (IACS) play a key role in modern production facilities. On the one hand, they provide real-time functionality to the connected field devices. On the other hand, they get more and more connected to local networks and the internet in order to facilitate use cases promoted by “Industrie 4.0”. A lot of IACS are equipped with web servers that provide web applications for configuration and management purposes. If an attacker gains access to such a web application operated on an IACS, he can exploit vulnerabilities and possibly interrupt the critical automation process. Cyber security research for web applications is well-known in the office IT. There exist a lot of best practices and tools for testing web applications for different kinds of vulnerabilities. Security testing targets at discovering those vulnerabilities before they can get exploited. In order to enable IACS manufacturers and integrators to perform security tests for their devices, ISuTest was developed, a modular security testing framework for IACS. This paper provides a classification of known types of web application vulnerabilities. Therefore, it makes use of the worst direct impact of a vulnerability. Based on this analysis, a subset of open-source vulnerability scanners to detect such vulnerabilities is selected to be integrated into ISuTest. Subsequently, the integration is evaluated. This evaluation is twofold: At first, willful vulnerable web applications are used. In a second step, seven real IACS, like a programmable logic controller, industrial switches and cloud gateways, are used. Both evaluation steps start with the manual examination of the web applications for vulnerabilities. They conclude with an automated test of the web applications using the vulnerability scanners automated by ISuTest. The results show that the vulnerability scanners detected 53 % of the existing vulnerabilities. In a former study using commercial vulnerability scanners, 54 % of the security flaws could be found. While performing the analysis, 45 new vulnerabilities were detected. Some of them did not only break the web server but crashed the whole IACS, stopping the critical automation process. This shows that security testing is crucial in the industrial domain and needs to cover all services provided by the devices.

Cryptographic primitives do not remain secure, they deteriorate over time. On the one hand increasing computing power leads to more powerful attacks on their underlying mathematical problems. On the other hand quantum computing threatens to break many widely used cryptographic primitives. The main goal of cryptographic agility is to enable an easy transition to alternative cryptographic schemes. Considering the long lifetime of products within industrial automation, we argue that vendors should strive for cryptographic agility in their products. In this work we motivate cryptographic agility by discussing the threat of quantum computers to modern cryptography. Additionally, we introduce the reader to the concept of post-quantum cryptography. Ultimately, we demonstrate that cryptographic agility requires three elements: 1) cryptographic application programming interfaces, 2) secure update mechanisms and 3) documentation of cryptographic primitives. By providing practical concepts we show how to meet these requirements in software-based systems.

The recent advances in technology had an exceptional impact on the performance optimization and the provisioning of more flexible Industrial Control Systems (ICS). Nevertheless, most ICS communication protocols, as they are currently and widely implemented, are extremely vulnerable to various cyber attacks. This paper proposes a lightweight application-oriented data authentication scheme applicable to existing ICS infrastructures by adopting the characteristics and computational advantages of hash functions and hash chains. Extensive experimental results on a Phoenix Contact industrial controller, which runs the control logic of a real ICS implemented in a Romanian gas transportation network, demonstrate the effectiveness of the proposed scheme and its immediate applicability to existing installations.

Industrie 4.0 (I4.0) in Germany—or Industrial Internet 4.0, as it is called internationally—are key initiatives in order to bring digitization into the automation domain by taking advantage of recent technology advancements such as the Internet of Things (IoT). The core concept for I4.0 is the digital twin or asset administration shell (AAS), as it is called by the German Plattform Industrie 4.0 initiative. It shall provide a machine-readable description of I4.0 components, being available over the entire lifecycle and being used for various advanced use cases and services. Security has been an increasingly known and needed aspect during the last years and is a key requirement to make I4.0 actually happen. In a previous paper we proposed concepts for integrating authorization tightly into OPC Unified Architecture (OPC UA)-based information models. OPC UA is a new and promising industrial technology, which could be used to implement AAS concepts. The current proposals for AAS define necessary security concepts; however, there is no work explaining how these concepts can be implemented in OPC UA. This paper closes this gap by elaborating on realization alternatives in OPC UA. Furthermore, we extend our basic performance evaluation with more realistic data access patterns based on I4.0 use cases, showing the applicability of our approach in practice.