Select Page
Security Approaches for Industrial Internet of Things

Security Approaches for Industrial Internet of Things

GaryThumb14Personal interlude

After leaving the “magazine editor business” a year ago, probably for good as a full-time editor anyway, I turned to just keeping this blog active. Readership has increased slowly but steadily over the past eight months. About as many people will see an article here as on a magazine Website (not as many total as a magazine Website, but they have much more content).

I decided not to pursue advertising as a revenue source. That seems to be the old way. It’ll hang on for a long time, but growth is not there.

Most of my business is consultation of various kinds including messaging and marketing, research, analysis, Web and digital development, and leadership.

It is more fun and insightful than trying to keep sales people and advertisers happy while forging a new message in a crowded field.

However, Manufacturing Connection will continue to bring the latest relevant news along with analysis about why you should care.

OT coming together with IT

I have been fascinated with what we now call the IT/OT divide (information technology professionals versus operations technology professionals) since about 1986. About that time my company was designing, building, and selling automated assembly machines to industry. Our largest customer was General Motors.

General Motors, in a gigantic brain fart, acquired EDS. And, predictably, it succeeded in totally destroying the EDS culture and making it like GM. That is to say, cumbersome, lethargic, bureaucratic.

But one day a senior manager went through the controls engineering department of one of my best customers and said, “You’re EDS,” “You’re GM.” Then they told us, “GM has the wire from the controller to this terminal block, and EDS has the wire from that terminal block to computers.”

Thus began our difficulties with GM and controls on our machines.

Rockwell and Cisco

These days, noted GM (and many others) OT supplier Rockwell Automation and noted IT supplier Cisco have joined forces to provide architectures, technology, and training designed to bring these forces together.

After 30 years, it’s about time.

Previously the two companies tackled training. With this news, they have tackled security for the Industrial Internet of Things. Most of the following is taken from their joint press release (meaning I didn’t delete some of the superlatives).

The two additions to their Converged Plantwide Ethernet (CPwE) architectures are designed to help operations technology (OT) and information technology (IT) professionals address constantly changing security practices. The latest CPwE security expansions, featuring technology from both companies, include design guidance and validated architectures to help build a more secure network across the plant and enterprise.

The Industrial IoT is elevating the need for highly flexible, secure connectivity between things, machines, workflows, databases and people, enabling new models of policy-based plant-floor access. Through these new connections, machine data on the plant floor can be analyzed and applied to determine optimal operation and supply-chain work flows for improved efficiencies and cost savings. A securely connected environment also enables organizations to mitigate risk with policy compliance, and protects intellectual property with secure sharing between global stakeholders.

Core to the new validated architectures is a focus on enabling OT and IT professionals to utilize security policies and procedures by forming multiple layers of defense. A defense-in-depth approach helps manufacturers by establishing processes and policies that identify and contain evolving threats in industrial automation and control systems. The new CPwE architectures leverage open industry standards, such as IEC 62443, and provide recommendations for more securely sharing data across an industrial demilitarized zone, as well as enforcing policies that control access to the plantwide wired or wireless network.

“The key to industrial network security is in how you design and implement your infrastructure and holistically address security for internal and external threats,” said Lee Lane, business director, Rockwell Automation. “The new guidance considers security factors for the industrial zone of the CPwE architectures, leveraging the combined experience of Rockwell Automation and Cisco.”

Rockwell Automation and Cisco have created resources to help manufacturers efficiently deploy security solutions. Each new guide is accompanied by a white paper summarizing the key design principles, as follows:

The Industrial Demilitarized Zone Design and Implementation Guide and white paper provide guidance to users on securely sharing data from the plant floor through the enterprise.

The Identity Services Design and Implementation Guide and white paper introduce an approach to security policy enforcement that tightly controls access by anyone inside the plant, whether they’re trying to connect via wired or wireless access.

“Security can’t be an afterthought in today’s plant environment. As we connect more devices and create more efficient ways of operating, we also create certain vulnerabilities,” said Bryan Tantzen, senior director, Cisco. “Cisco and Rockwell Automation have been teaming for nearly a decade on joint solutions, serving as the standards-based resource for security in industrial environments. These new architectures and guides build on our collaboration by helping organizations recognize and proactively address today’s security concerns.”

Companies can now take advantage of industry-leading solutions from Rockwell Automation and Cisco to address security from a holistic perspective. Together, the two companies provide a common, scalable architecture for ruggedized industrial Ethernet and enterprise networks, along with unique services, such as security assessments and managed security, to help manufacturers define and meet performance metrics and scale in-house resources.

This announcement further extends the commitment by Rockwell Automation and Cisco to be one of the most valuable resources in the industry for helping manufacturers improve business performance by bridging the gap between plant-floor industrial automation and higher-level information systems.

Security Approaches for Industrial Internet of Things

IoT Testbed For Condition Monitoring to Predictive Maintenance

IBM_NI_Test BedRepresentatives of National Instruments (NI) and IBM recently discussed their collaboration on a test bed demonstrating the possibilities for using Internet of Things (IoT) technologies for taking companies from Condition Monitoring to Predictive Maintenance.

Chris O’Connor, IBM General Manager of IoT who works with divisions such as Maximo told me this is a new business unit that is built around IoT. There are about 6,000 clients. The explosion of data coming from devices means that industry must change from data centers to IoT. “For us, this entails the analysis of sensors information, aggregating the information, then constructing lifecycles. This will help world adopt IoT.”

The collaboration from condition monitoring and analytics changes questions manufacturers can answer such as, can I gain competitive advantage, can I offer better warranty, change frequency of maintenance.

Jamie Smith, NI’s Director of Embedded Systems, said the test bed project will roll out in multiple phases. It demonstrates the interoperability between two industry leaders including edge computing capability from NI to IBM’s cloud technology and analytics. Therefore, users can progress from condition monitoring to predictive maintenance.

The test bed consists of a motor and a couple of fans. Various failure modes are introduced. The first go consists of NI CompactRIO communicating via MQTT to IBM. Now that the proof has been completed, other companies in the Industrial Internet Consortium have been invited to join the collaboration. “All they need to do is contribute time and resources to it,” added Smith.

The next step according to Smith is insuring that it’s end to end secure. They are working with IIC to do security assessment. They will then look at more robust assets—most likely power generation assets—hoping to work with someone with large turbines or pumps to continue to demonstrate the technology and benefits.

Following is a description from the statement on the Web.

The Condition Monitoring and Predictive Maintenance Testbed (CM/PM) will demonstrate the value and benefits of continuously monitoring industrial equipment to detect early signs of performance degradation or failure. CM/PM will also use modern analytical technologies to allow organizations to not only detect problems but proactively recommend actions for operations and maintenance personnel to correct the problem.

Condition Monitoring (CM) is the use of sensors in equipment to gather data and enable users to centrally monitor the data in real-time. Predictive Maintenance (PM) applies analytical models and rules against the data to proactively predict an impending issue; then deliver recommendations to operations, maintenance and IT departments to address the issue.

These capabilities enable new ways to monitor the operation of the equipment – such as turbines and generators – and processes and to adopt proactive maintenance and repair procedures rather than fixed schedule-based procedures, potentially saving money on maintenance and repair, and saving cost and lost productivity of downtime caused by equipment failures.

Furthermore, combining sensor data from multiple pieces of equipment and/or multiple processes can provide deeper insight into the overall impact of faulty or sub-optimal equipment, allowing organizations to identify and resolve problems before they impact operations and improve the quality and efficiency of industrial processes.

Through this testbed, the testbed leaders IBM and National Instruments will explore the application of a variety of analytics technologies for condition monitoring and predictive maintenance. The testbed application will initially be deployed to a power plant facility where performance and progress will be reported on, additional energy equipment will be added and new models will be developed. It will then be expanded to adjacent, as yet to be determined, industries.

Cyber Secure Industrial Control System Available for Purchase

Cyber Secure Industrial Control System Available for Purchase

Bedrock Automation ControllerPotentially viable start-ups are rare in the industrial automation space. Recently Russ Fadel, Rick Bullotta, and John Richardson did it with ThinkWorx an Internet of Things oriented software they sold to PTC. That was their second effort having previously sold Lighthammer to SAP.

Now we have Albert Rooyakkers, CTO and inventor, and Bob Honor, president and former VP at Rockwell Automation and GE Intelligent Platforms, releasing a new industrial control system and company—Bedrock Automation. This company was introduced to Manufacturing Connection readers last December.

This is a tough area for an entrant. I’ve watched the rise and fall of PC-based control from back in the late 90s. Rockwell Automation and Siemens are so entrenched in the market. The next tier is solid with AutomationDirect, B+R Automation, Beckhoff Automation, Mitsubishi, and Schneider Electric.

When you develop a product for a crowded market, you basically have to execute one of two strategies. Either you think that the products have reached commodity status and that you can make them better, faster, cheaper (at least the last two). Or, you totally disrupt the industry by bringing out something that does what others do better—and adds some significant new features and benefits.

Disruptive?

Bedrock Automation executives believe they have accomplished the latter. The design begins with built-in cyber security. Its patented architecture features a pin-less, electromagnetic backplane. It addresses “virtually all control applications with fewer than a dozen part numbers, reducing cyber attack vectors, cutting lifecycle costs, and simplifying engineering, commissioning and maintenance.”

“Starting from a blank sheet of paper while inventing and deploying advanced semiconductor, mechanical design, cyber computing and communication technologies has resulted in a completely new automation platform. The future is now,” said Bedrock Automation CTO and Engineering VP, Albert Rooyakkers.

Commitment to simple, elegant design is a core tenet of the system. Bedrock delivers I/O, power and communications across the pin-less electromagnetic backplane with a parallel architecture that supports ultra fast scan times regardless of I/O count. The removal of I/O pins improves reliability and increases cyber security while forming a galvanic isolation barrier for every I/O channel. This innovative backplane also allows installation of I/O modules in any orientation and location for “unprecedented” flexibility in I/O and cable management.

Secure I/O modules use layers of advanced technology to deliver software-defined I/O for universal analog, discrete, Ethernet and Fieldbus signal types. A secure power module is functionally and physically coupled to the backplane to deliver single and dual redundant cyber secure power for the control system. A secure universal controller can run virtually every application independent of size or control task: discrete, batch, continuous, or multivariable control from one device that supports as few as ten, to as many as thousands of I/O points. No longer are separate programmable logic controllers (PLC) and distributed control systems (DCS) required.

“As cyber threats to all industries grow, traditional control system vendors respond by adding cost and complexity to their legacy technology. With deep roots in both automation and semiconductors, and unburdened by legacy, Bedrock Automation has created not only the most cyber secure system available today but we have also established new benchmarks for performance, scalability and affordability,” said Bedrock Automation President, Bob Honor.

Layers of protection

Replacing pins with an electromagnetic backplane is one of many layers of cyber security protection that Bedrock Automation has implemented. Additional cyber security layers include:

  • A real time operating system with the highest safety (SIL 4) and security (EAL6+) rating of any RTOS available today
  • Cyber secure microcontrollers with encrypted keys and TRNG embedded in all system modules including the controller, power supply and I/O
  • All modules encased in anti-tamper metal that is impenetrable without metal cutting tools
  • Authentication extending throughout the supply chain, including third party software and applications

Adding so many layers of protection to a conventional DCS, SCADA RTU, PAC or PLC would add cost and complexity and degrade performance. With Bedrock, they were built in from the start.

“Brown Engineers is excited to join the Bedrock revolution. Clients in our focus markets of electric, water, and sewer utilities, are increasingly concerned about cyber security and are confident that installing Bedrock will give them peace of mind to tell their ratepayers and their board members that they are taking every precaution to protect their processes. Brown Engineers demonstrates its continued commitment to keeping clients on the forefront of technical innovation,” said Dee Brown of Brown Engineers, an industrial systems integration firm based in Little Rock, Arkansas.

Open, flexible engineering

Bedrock delivers an Integrated Development Environment (IDE) based on an open IEC 61131 software toolset that supports embedded OPC UA. The IDE enables users to develop, operate and authenticate control for a vast array of PLC, SCADA and DCS applications. Fewer components means fewer panel layouts and wiring diagrams to contend with. Software configurable I/O can be changed in the field with the click of a mouse. Ninety percent fewer I/O module types means fewer spare parts to keep and manage. Such innovations contribute to reducing overall engineering design costs by up to 33 percent.

“Bedrock is the first unique platform to enter the control market in the last 15 years. It diverges radically from the typical platforms and is superior in terms of processing power, redundancy, scalability, security and cost efficiency. We plan to use it as a point of differentiation for our business,” said Chris McLaughlin of Vertech, a Phoenix-based industrial systems integrator.

Pricing and availability

The Bedrock control system is available now in baseline configuration starting at $20,000 MSRP. A growing network of world-class system integrators and automation solution providers is available to provide local sales and support.

For more information about the Bedrock revolution, download the first white paper in the series: Revolution – Chapter One: The Backplane.

Partnership Said To Fulfill Industry 4.0 Vision for Smart Manufacturing

Partnership Said To Fulfill Industry 4.0 Vision for Smart Manufacturing

Exor HMIHere is one of those press releases that attempts to use every current buzz word. Regardless, this business partnership shows how technology suppliers are partnering in order to move to the next level of manufacturing strategy.

EXOR International S.p.A. and NEXCOM International Co. announced a technology and business partnership to “enhance their worldwide presence in the automation and IT market by developing new HMI functions to fulfill the vision of Industry 4.0. Based on close cooperation between the two companies, NEXCOM has investing in EXOR International for 19.99% of the company.”

To achieve Industry 4.0‘s vision for smart manufacturing, NEXCOM has proposed PC-based IoT Automation Solutions consisting of intelligent controllers, IoT automation gateways, and big data collectors. Under the partnership, NEXCOM expands its product portfolio to EXOR’s virtualized human machine interface (HMI), a key element to Industry 4.0, offering all-around IoT Automation Solutions. Further, EXOR will extend its presence into the Asian market and grow JMobile platform to ensure global offering.

EXOR, with headquarters in Verona, Italy, is an international HMI supplier. EXOR HMI solutions span over industrial automation with an expertise in satisfying vertical markets and embedded design solutions.

NEXCOM, headquartered in Taipei, Taiwan, is a leading international manufacturer of IoT Automation Solutions that offers comprehensive industrial computing solutions.

The partnership will leverage the synergy of EXOR and NEXCOM to enlarge and improve the quality of global offerings to the market, strengthen production capability, and enhance post-sales service with general maintenance and repair centers in Europe and Asia.

Co-development of new products will meet global demand of “ready-to-use products” with a stronger platform and exceptional time to market. Global service will be provided 24/7 to the needs of the market and customers.

Security Approaches for Industrial Internet of Things

OpenStack Network and IoT

Manufacturing Connection Logo webA couple of weeks ago I wrote about an open source hardware project for networked small controllers. Filament Tap began life as Pinoccio. The makers discovered a latent demand for these small, networked devices among manufacturers and decided to pivot away from the intended “maker” market to the industrial market.

Given networking as a core feature of Filament Tap, tying in with the Internet of Things is the natural next step. And that is just what Eric Jennings, co-founder and CEO did in this interview on the O’Reilly Radar podcast. Here he describes an openstack concept for connecting the Internet of Things.

As an aside, Tim O’Reilly is founder of the highly influential tech publishing house and conference organizer. The podcast highlights O’Reilly authors or speakers at one of its conferences.

Digital communication

Let’s go back 20 years or so. Engineers and executives saw the need for a solid method for connecting digitally all the industrial “things” out there. Maybe a network; maybe a fieldbus.

Then commenced the “fieldbus wars.” The net result came down to Foundation Fieldbus, HART, Profibus (and its derivatives), DeviceNet (and its offspring), and Ethernet (unfortunately with a variety of custom protocols stacked on the open TCP/IP stack.

Jennings comes to the industrial world from the Internet/Web world. He is just as amazed as others I have talked with who venture into our esoteric area of technology. Like his industrial network/fieldbus predecessors, he dreams of an openstack, standard method of connecting the Internet of Things—the decentralized Internet.

In the podcast he answers, “What would a decentralized Internet for the IoT look like and how would it work?” He likened it to the Web:

“We actually take a large portion of our model, our mental model, about a decentralized IoT from the early Web. If you imagine back in the early Web days — way back, mid-80s, early 90s — HTTP and websites had just started coming around, and they were originally focused and designed for academic research papers to link to each other.”

Jennings described the current landscape as “a death by a thousand paper cuts.” He said the situation isn’t ideal and that it “feels very much like a feudalist mentality of getting the largest number of people on your side for your consortium to get people to use yours versus others.”

Asked what the IoT would look like in 10 years if we continue down the path we’re on now:

“If we go on the same trajectory, it will end up probably looking a lot like what the industrial Internet looks like today. You’ve got companies that make their own proprietary solutions and their proprietary protocols — even if they’re not proprietary, they’re not open or standardized. If you buy a product from one company, you have to use all of the products that go along with that company in order to make that solution work. You can’t bring in another product from another company and have them inter-operate very well.”

The decentralized IoT stack, Jennings said, is really about creating a reality where devices don’t require a central authority to operate.

If a decentralized IoT openstack is fully realized and done right, we’ll see all sorts of things occurring that we can’t even imagine now: “I could see companies within an industry working together … the Caterpillars of the world and the John Deeres of the world letting their machines pay each other for data about loads a tractor is holding, or about how much capacity is left. … I have no idea what the future is going to look like, but it’s going to be pretty amazing if we can pull this off.”

Check out the entire podcast. It’s only about 30 minutes, but worth it.

If you are curious about the impact of the IoT or Industry 4.0 on your business, contact me. I have been advising clients on how they can adapt.

Security Approaches for Industrial Internet of Things

IoT Ready Automation Controller and Process Performance

Schneider Electric LogoThere were two other announcements at the Schneider Electric Global Automation Conference last week. One ties to the Industrial Internet of Things and the other to helping process control systems work better, longer.

PAC for IoT

First is a high-end Modicon M580 Ethernet programmable automation controller (ePAC). It features hot standby functionality (HSBY), native Ethernet, and embedded cybersecurity in its core. Schneider claims it as the first PAC built for the Industrial Internet of Things, but there have been many controllers with built-in Ethernet released over many years.

The built-in cyber security is interesting since that is the claim to fame for the recently announced Bedrock Automation controller. Obviously, this is a trend worth noting. And a future comparison of how each of those achieves its goal should become a to do item for follow up.

“We’re excited to introduce major innovation in automation with the new Modicon M580 ePAC,” said Jose Bonomo, vice president, offer management, Hybrid Systems, Schneider Electric Industry Business. “Cutting-edge functionality allows us to drive true customer benefit with a future-proof solution designed to meet the most pressing industry challenges.”

Additional features include reinforced cyber security through the AchillesTM Level 2 and ISA Certifications; native time stamping solutions; extension of architecture change during the run; and new topology capabilities.

Advanced system management

The company also has acquired LimeWare, a provider of system analysis and auditing software for Schneider Electric‟s Foxboro Evo process automation and I/A Series distributed control systems. The acquisition provides foxray software to help customers pinpoint and address critical industry challenges.

“Acquiring LimeWare and its foxray software is an integral part of our strategy to help our customers improve their operational integrity and operational insight, while future-proofing their operations,” said Gary Freburger, president of Schneider Electric‟s process automation business. “With additional investment in our flagship process automation offerings, we have even more power to address critical challenges around safety, reliability and efficiency. The ability to more easily tackle pain points, while driving value across the entire process automation chain, is one of the big ideas we are discussing with our customers in Dallas this week, and it remains a major differentiator for our process automation business.”

LimeWare was founded in 2006 and is headquartered in Porto Alegre, Brazil. Its foxray system management software complements the functionality of Schneider Electric‟s Foxboro Evo and I/A Series process automation systems. The solution offers additional capability for configuration management, alarm management, operator action analysis and overall documentation. It includes:

  • Change tracking with a complete change management workflow process;
  • Graphics visualization of the control block loops;
  • Integrity checks to solve all DCS configuration issues;
  • Scheduled reports;
  • Alarms and operator action management and tracking;
  • I/O and FBM spare reserve and tracking;
  • An advance query engine that can quickly fetch any DCS information.

“foxray software is the go-to tool for working with our control system database on a daily basis,” said Scott McWaters, process control engineer, Hunt Refining Company. “From easily locating and reserving spare I/O to improved troubleshooting and insight with the „where used‟ function, system health reporting, operator action reports, alarm history, inhibited alarm tracking and many other functions, foxray has greatly increased our efficiency. The software has been instrumental in our recent alarm rationalization efforts, and the alarm shelving tool will be used to help cut down on the number of call outs to our on-call engineers for nuisance alarm silencing. This contributes to our overall confidence in the integrity of our operation.”

LimeWare and its offerings will be fully integrated into Schneider Electric‟s process automation business and will continue to be managed by its existing executive team.

Follow this blog

Get a weekly email of all new posts.