The network environment of manufacturing plants is very different from that of the general enterprise office network: there are a large number of industrial control equipment (PLC, DCS, SCADA), digital machine tools, industrial robots, sensors, computers and mobile phones with staff in the premises, as well as PDA and sweep gun in the warehouse logistics area. These end types are complex and have varying safety capabilities, which may affect the operation of the entire production line if an terminal is invaded or infected with a virus, causing loss of output. Network access certification systems deployed at manufacturing factories need to take full account of the specificities of the industrial environment, and see below specific practical points.
Speciality and challenges of the manufacturing plant network
The network environment of manufacturing plants has several salient features: one is complex in terms of end types, with standard PCs and servers, as well as a large number of industrial control equipment (PLCs, digital control machines, industrial robotics), object networking terminals (sensors, cameras, RFID readers), which often do not support the installation of proxy software, operating systems may also be old embedded systems; the other is strict network zoning, where plant networks are usually divided into IT zones (office networks) and OT areas (production networks), and OT regions into on-site equipment layers, process control layers, manufacturing enforcement layers, with stringent access controls between different regions, according to industrial safety standards (e.g. IEC 62443); Third, the availability requirements are very high and production networks cannot be delayed or interrupted by access certification, which could result in a shutdown of production lines, causing significant economic losses; fourth, the relatively weak safety capability of the network for transporters, who are often more familiar with equipment maintenance than network security, requires simple and user-friendly systems. These characteristics determine the programme for the deployment of network access to manufacturing plants that cannot replicate the office network and require targeted design.
Access strategy design for IT and OT Divisions
The endpoints in the IT area (office network) are mainly employee computers and mobile phones, which can be used as a means of compliance check for 802.1X+ terminals, requiring them to install anti-virus software, patches, and access office networks only after compliance checks. The endpoints in the OT area (production network) are mainly industrial control equipment, which often do not support 802.1X and proxy software, should be used as a MAC-certified plus white list to allow only pre-registered equipment access, while strictly limiting access to the OT zone terminals: the field equipment layer can communicate only with process control layers and cannot directly access the IT area or the Internet."Minimum Permissions"Principle: Each terminal and region can only access resources necessary for its operations, without unnecessary access. For maintenance personnel’s laptops, a special access strategy should be used: access is possible only during maintenance periods, access to specified equipment is possible only, dual authorization or work order approval is required to avoid maintaining terminals as safe entry points.
Non-agent access to industrial equipment and equipment identification
The large number of industrial equipment in manufacturing plants (PLC, digital control machines, industrial robots, sensors, etc.) cannot install proxy software and does not support 802.1X certification, which requires non-agential access. Unrepresented access relies mainly on fingerprint identification and the MAC white list: the system identifies the MAC addresses, IP addresses, open ports, communications protocols, vendor information, etc. of the equipment, builds the device fingerprints and compares them to the pre-registered list of equipment, which is only accessible if it is in a white list. Fingerprinting of equipment also detects unusual behaviour on the equipment: for example, a PLC suddenly starts to communicate with an unknown IP, and a change in the protocol for a digital control machine may be signs of invasion. It should be noted that communications agreements for industrial equipment are often exclusive (e.g. Modbus, Profine, EtherNet/IP), and systems need to be able to identify these protocols and conduct in-depth analysis, otherwise they can only be based on MAC/IP identification, limited security capabilities. At the same time, unagental white lists have a heavy maintenance workload and require updating of the white list for additions, replacements and maintenance, as well as a standardized equipment management system to avoid the breakdown of access controls due to the confusion in the management of the white lists.
High availability and unconscious access to production networks
Manufacturing plants have a high demand for network availability, and production networks cannot be delayed or disrupted by access certification. Therefore, network access deployments at the plant must be guaranteed to be highly available and undetected. In high-availability, network access certification systems should use dual-machine heat or cluster deployment to avoid single point failures; RADIUS servers should deploy multiple load balances; connections with switches, firewalls should be timed and downgraded; network equipment can automatically be found in case of system failure, either fail-open (disable) or fail-close (deactivate), which is configured according to security requirements. In the case of non-conscious equipment and fixed office terminals, the MAC NATHHEL_SEAMLESS_AUTH should be used. The automatic authentication after access does not require any manual operation, and no production is affected by the certification operation. For mobile terminals for employees, an automated authentication (a connection once configured) of 802.1X can be used, nor do manual input be required each time. Special attention should be given to the need for caution in changing access strategies for production networks: any change of strategy may affect communications in the production equipment, must be fully validated by the testing environment before deployment in the production environment and should be deployed at a time when production gaps or shutdowns are being chosen so as not to interfere with normal production.
Compliance and audit requirements for manufacturing scenes
Manufacturing plants, especially those involving critical information infrastructure (e.g. energy, transport, water, military and industrial), need to meet the requirements for industrial network security under cyber-security laws, regulations and standards such as 2.0, IEC 62443. The network access certification system requires the following capabilities in compliance auditing: a complete logbook recording the time of access, access location, terminal information, user identity, compliance status, access behaviour etc. per terminal, with log retention for at least six months (part of industry longer); The second is an operational audit, which records all operations of the administrator (treat change, equipment registration, competency adjustment etc.), supports the operation retrospective and accountability determination; the third is a compliance report that generates a compliance check statement meeting the requirements for equivalency insurance, IEC 62443, etc., to support one key export; and the fourth is a docking with the security audit platform, which synchronizes access logs and security events to the enterprise ' s Security Operations Centre (SOC) or SIEM platform, where linkage analysis and situational awareness are not performed."To cope with the inspection"For manufacturing enterprises, it is recommended that web access logs and audits be integrated into the enterprise’s overall security management system, with linkage analysis to other safety equipment (firewalls, intrusion detection, terminal security, etc.) and an overall security protection capability enhanced.
Implementation recommendations for manufacturing deployment
Network access certification system for manufacturing plants, recommended"It's easy to do it in a step-by-step manner."(a) Principle advancement: first, deployment in the IT area (office network), with 802.1X+ terminal compliance checks to build experience and enable capability; second, deployment in non-critical areas of OT zone (e.g. warehouse logistics, office support areas), with MAC white list plus equipment identification to validate the stability of the system in the industrial environment; third, deployment in key production areas of OT zone, with strict zoning plus in-depth analysis of industrial agreements plus access to the white list, which requires careful testing before going on line; fourth, establishment of a continuous mechanism for optimizing transport peacekeeping, regular updating of the white list of equipment, optimization of access strategies, analysis of security logs and security training. In the process of implementation, special attention is paid to coordination with the productive sector: network access can affect communications in production equipment and must be understood and coordinated by the production sector, avoiding conflicts over safety measures affecting production. At the same time, industrial industry-experienced manufacturers and implementation teams should be selected who are more aware of the characteristics and needs of the industry network and can provide more realistic programmes.
The deployment of network access certification systems for manufacturing plants needs to take full account of the specificities of the industrial environment: complex end types, stringent zoning, high availability requirements and relatively weak transport capability. Network access is not a safe and stable operation for manufacturing enterprises through IT/OT zoning strategy design, non-agent access to industrial equipment and equipment identification, high availability of production networks and NATSHEL_SEAMLESS_AUTH, capacity-building for compliance auditing, and step-by-step implementation strategies."Optional"It is, however, an essential part of the construction of industrial network security, especially in the context of the growing spread of industrial Internet and intellectual manufacturing, where the protection of production network safety is the protection of enterprise lifelines.