Cyber Security - a New Challenge for Production · PDF fileAuf der ersten Folie die Autoform...

Hilfslinien:

„Hilfslinien anzeigen:

Wählen Sie Ansicht > Anzeigen

Haken bei Führungslinien setzen“ _________________________________

Reset:

„Folie in Ursprungszustand

versetzen:

Wählen Sie Start > (Folien)

Zurücksetzen“

Kundenlogo:

„Kundenlogo einfügen:

Wählen Sie Ansicht > Folienmaster

Auf der ersten Folie die Autoform links neben dem PSI-Logo (siehe Pfeile oben) auswählen

Wählen Sie Format (Zeichentools) > Fülleffekt > Bild

Mit Format (Bildtools) > Zuschneiden > Einpassen wird die Grafik proportional angepasst“

Cyber Security - a New Challenge for Production (Management)

Heiko Wolf, Manager R&D Program PSImetals FutureLab

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






The Challenge

Complexity of IT-Systems is rising

Landing on the moon with 7.500 lines of code

Today: Boeing 787: 6,5 million

Mercedes S: 20 million

Chevrolet Volt: 100 million

Systems are becoming more interconnected

Internet-of-Things, Industry 4.0, M2M, V2X, etc.

Virtual infrastructures (Cloud, etc.)

Dependency on IT is growing

Smart Grid, Smart Home, Smart City, Smart Phone

eCommerce, Digital Production, etc.

2017 PSI - Software Excellence in Metals 2

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Cybercrime – Ransomware

Source: Symantec Internet Security Threat Report 2016

PSI - Software Excellence in Metals 3 2017

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Motivation for Attacks Is Changing

2017

Cracker / Script Kiddies

Cybercrime

„State-sponsored Attacks“

PSI - Software Excellence in Metals 4

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Yes, It Happens


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






There‘s No Alternative to Digital Transformation

Already today, the steel industry is automated to a degree. A complex and quality-focused production would be impossible without integrated IT systems.


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Industry 4.0 – Turbo-Charging Digital Transformation


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Getting Rid of the Pyramid


Level 4

Level 3

Level 2

Level 1

Sensors / IoT

Process Control ERP / CRM

HMI

Service Bus unicast

broadcast

synchronous

asynchronous

From traditional integration layers To business driven connectivity

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






How Do These Attacks Work?

2017

Internet

IT (Office/Enterprise Network) OT (Industrial Control Systems)

Attacker


Office Users

Administrators

Distributed Control

System (PLC‘s, etc.)

SCADA Systems

Firewall Firewall

Initial attack by phishing

mail or

drive-by download

Accessing the

Process Control

Network

Remote control,

data exfiltration

Lateral

movement

Disrupting

operations

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Social Engineering

Effort to attack a system vs. reaching a goal

If technical attacks are hard

Social engineering

2017 12 PSI - Software Excellence in Metals

Source: Microsoft Security Intelligence Report 2011

Source: XKCD - https://xkcd.com/538/

https://xkcd.com/538/

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Security Has Costs

Setup effort

Reduced comfort

Reduced performance

Money


Level of security

Effort

Pareto principle

∆

∆

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






„Good enough“ – Security Economics

A „perfect“ security system is not necessary!

• Also not feasible/possible/affordable

• Too strong focus on one area risks neglecting others weakest link

„There are no secure systems, only degrees of insecurity“ (Adi Shamir)

„It‘s all about risk“ – first thing should be a risk analysis

A absolutely secure system that‘s not usable any more has the same business value as a system without any security

PSI - Software Excellence in Metals

Comfort Security Functionality Performance

Find the balance that‘s right for you!

2017 14

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Threat

Vulnerability

Impact

IT Security – Definition of Risk

According to ISO 73:2002:

Risk: combination of the probability […] of an event […] and its consequence

2017 15

Risk =

Probability of

occurrence


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Difference Between IACS / Office IT


Priority

Industrial automation

& control system

General purpose

information technology (IT) systems

Availability Integrity Confidentiality

Confidentiality Integrity Availability

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






PSImetals – Integrated Modules & Integrative Solution


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Comprehensive Support of End-To-End Processes


PS

Imeta

ls

Commercial Processes

Delivery Production Planning Scheduling

Production Execution & Material Logistic

Order Dressing Demand & Sales Planning

Sales &

Operations

Planning

Due Date

Quoting

Order Scheduling &

Material Allocation

Caster &

Melt Shop

Scheduling

Hot Mill

Scheduling

Cold Mill &

Finishing

Scheduling

Flow & Order

Planning

Net Demand

Calculation

Transport

Management

(outbound)

Shipping

Planning

Production

Order

Life Cycle

Material &

Stock

Management

Schedule

Execution

Management

Production

Tracking

Quality Control

& Exception

Management

Warehouse &

Transport

Management

Shipping

Execution

Sales Order

Entry Pricing Purchasing …

Plant

Maintenance Costing Billing

Product

Configuration

Sales

Order

Dressing

Production

Order

Elaboration

Demand

Management

Capacity &

Campaign

Management

Plate & Coil

Combination

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Customer Risks from a Production Management System

Confidentially

• Product configuration / steel grades

• Process know-how

• Algorithms / optimizations

Availability

• Disruption of production due to no or limited availability of PMS

Integrity

• Disruption of production due to corrupt data

• Production of sub standard quality metals

• Inaccurate reporting

PSI - Software Excellence in Metals 19 2017

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Security by Design with PSImetals

Authentication

Use safe &

up-to-date

standard protocols

Safe Data Transmission

Information Security Management

System

ISO27k certified

Organization

Use latest standard

to secure sensible data

Encryption

xxxx

Updates & Recovery Create Awareness


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Security by Design: Key Areas We Are Working On

Processes within

PSI Metals

21

IT Technology and

SW Development Process Project Implementation

Methodology


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:







Processes within

PSI Metals

22

IT Technology and


Methodology


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Information Security Management Terms

2017 23

Threat

poses

Vulnerability

Risk

exploits

leads to

Asset

Damage

Safety Measure

may corrupt

causes

can be countered by


Classify and

evaluate

Assess

Improve

processes and

take measures

Create

awareness

Manage and

respond to

incidents

addresses

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:







Processes within

PSI Metals

24

IT Technology and


Methodology


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Secure Software Development Lifecycle

Execute Incident Response Plan

Core Security Training

Establish Security Requirements

Create Quality Gates / Bug Bars

Security & Privacy Risk Assessment

Establish Design Requirements

Analyze Attack Surface

Threat Modeling

Use Approved Tools

Deprecate Unsafe Functions

Static Analysis

Dynamic Analysis

Fuzz Testing

Attack Surface Review

Incident Response Plan

Final Security Review

Release Archive

Design Implementation Verification Requirements Release Training Response

Source: Microsoft SDL


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Data Flow Diagram “Steel Grade Maintenance”


Rich Client Java

Application Server Java

Database Server Oracle

PSImetals GUI Login Screen

PSIauth Authentication/

Authorization

Service

Order Dressing/ Edit Grade Data

Business Logic PL/SQL

PSImetals Factory Model Scheme

Client User/ Password

Web Service

Permissions

DB Client User/

Password

Establish

DB-Connection

JDBC

Oracle Access

Management

Transactions

Grade Data

PSIintegration Communication

Adapter

Oracle Access

Management Oracle Access

Management

Establish

DB-Connection

JDBC

Establish

DB-Connection

JDBC

Grade Data

Send

Grade Data

TCP/IP, Web Services,

…

Third Party Systems

e. g. Level 2

DB-

Session

DB

Server-User/

Password

DB

Server-User/

Password

PSIauth

Database Scheme

Permissions

DB Client User/

Password

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






STRIDE Model


Attack Target Example of an attack Examples of countermeasures

Spoofing Person, Account, Application Impersonation, account take over, man-in-the-middle attack

Authentication with passwords, LDAP/AD, Oracle Wallet, encrypted communications

Tampering Client application, database, configuration

Usage of modified client, manipulation of Data in Database (e.g. grade data)

Access control, digital signatures, integrity check (hashing, etc.), etc.

Repudiation Application, Logs/History Query/manipulate data, manipulate logs

Authentication, log access and actions, undo logs, timestamps, validation of data

Information disclosure

Network, Application, Database, Files

Eavesdropping of data (e.g. passwords), access to sensitive data

Encryption incl. key mgmt., access control (client/server/database)

Denial of service Database, Application, Service

Overload with complex queries, manipulate configuration

Check input data / query parameters, integrity checks, quotas

Elevation of privilege Database, Application, Network

SQL-Injection, manipulated authentication information

Input validation, programming style, integrity validation of authentication data

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:







Processes within

PSI Metals

28

IT Technology and


Methodology


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Maintenance

Product-based Project Methodology

Project Pre-Project

Come Together Meetings – Get to know each other Project Methodology Next Steps

Prime Analysis

Checklists Project Schedule <-> Release Plan

Proposal Scope of Supply Commercial Figures Timeline Terms & Conditions

+

Early Trainings On PSImetals Standard System

Detailed

Analysis

Workshops Use Cases Fit-Gap-Analysis

Specification

Reduced Risks

Shorter Project

Duration

Reduced TCO

Faster ROI

Robust System

Highly

Configurable

Upgrades On PSImetals Release

Basic

Configuration

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Maintenance

Product-based Project Methodology

Project Pre-Project

Come Together Meetings – Get to know each other Project Methodology Next Steps

Prime Analysis

Checklists Project Schedule <-> Release Plan

Proposal Scope of Supply Commercial Figures Timeline Terms & Conditions

+

Early Trainings On PSImetals Standard System

Detailed

Analysis

Workshops Use Cases Fit-Gap-Analysis

Specification

Reduced Risks

Shorter Project

Duration

Reduced TCO

Faster ROI

Robust System

Highly

Configurable

Upgrades On PSImetals Release

Basic

Configuration

Involve customer

security experts

Security fit-gap-analysis and

mapping to customer

security guidelines

Offer different

security options

(tradeoffs)

Setup security

measures

Install latest

security fixes

Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






• but so are systems complexity and security threats!

Importance of IT infrastructure is increasing…

• but technologies and security measures already available to ensure secure operation!

PMS is a part of critical infrastructure…

• and choose the right level of security (and availability, comfort, functionality…)!

Assess your risks…

• but essential part of project methodology and corporate awareness!

Security should not be an afterthought…

Takeaways…


Hilfslinien:




Reset:


versetzen:


Zurücksetzen“

Kundenlogo:






Suddenly everything’s that simple.


Cyber Security - a New Challenge for Production · PDF fileAuf der ersten Folie die Autoform...

Documents

Transcript of Cyber Security - a New Challenge for Production · PDF fileAuf der ersten Folie die Autoform...