We have been talking for a long time about the need to segment and protect the factory network according to what is contained in the IEC62443 standard and as recommended by leading experts to avoid any propagation of problems and contamination from one area of ​​the network to another.

Then when a concrete case is presented to us by a Client, we often have to compromise: the Client only wants to protect "that part of the network", as an intervention on "the whole network" could be too intrusive and often even too expensive, ultimately, impractical if the segmentation were extended to the entire factory network.

It's not about not understanding the goal of the need to properly secure automation and control systems or not appreciating the benefits, it's about bridging the gap between where they are today and what's needed to implement a comprehensive and sustainable segmented network in the future.

It's a long way to go, and resources are often scarce. We have also often talked about this in other other white papers on the subject.

Most solutions use a network-wide approach to planning a solution.

GE Digital has also published a guide talking about the importance of virtual segmentation strategies and areas for a SCADA with iFix and/or Cimpicity: it is a very good document, with nice graphics that highlight many important points. (find it here   https://www.ge.com/digital/sites/default/files/download_assets/ifix-secure-deployment-guide.pdf )

These are some points that we find as obstacles:

  • The systems and electro-instrumental equipment of industrial machinery are often found inside electrical cabinets (cabinets) in fixed positions, close to machinery and systems, sometimes distant from each other and difficult to reach, and almost certainly cannot be moved  
  • The real segmentation of the network, the physical one, is therefore even more complex than you think, and it is often difficult to connect all those physically distant and separate endpoints in congruous areas
  • Traditional enterprise networking techniques, such as VLANs and routing rules, are sometimes difficult to implement and manage with limited staff maintaining ICS/OT networks and systems

SUMMARY OF THE WHITE PAPER

  • The segmentation of the ICS/OT network
  • Approaches to the segmentation of the entire network
  • Approach to “selective segmentation”
  • What is a Trusted Domain Segment?