Security Approaches for Industrial Internet of Things

Security Approaches for Industrial Internet of Things

GaryThumb14Personal interlude

After leaving the “magazine editor business” a year ago, probably for good as a full-time editor anyway, I turned to just keeping this blog active. Readership has increased slowly but steadily over the past eight months. About as many people will see an article here as on a magazine Website (not as many total as a magazine Website, but they have much more content).

I decided not to pursue advertising as a revenue source. That seems to be the old way. It’ll hang on for a long time, but growth is not there.

Most of my business is consultation of various kinds including messaging and marketing, research, analysis, Web and digital development, and leadership.

It is more fun and insightful than trying to keep sales people and advertisers happy while forging a new message in a crowded field.

However, Manufacturing Connection will continue to bring the latest relevant news along with analysis about why you should care.

OT coming together with IT

I have been fascinated with what we now call the IT/OT divide (information technology professionals versus operations technology professionals) since about 1986. About that time my company was designing, building, and selling automated assembly machines to industry. Our largest customer was General Motors.

General Motors, in a gigantic brain fart, acquired EDS. And, predictably, it succeeded in totally destroying the EDS culture and making it like GM. That is to say, cumbersome, lethargic, bureaucratic.

But one day a senior manager went through the controls engineering department of one of my best customers and said, “You’re EDS,” “You’re GM.” Then they told us, “GM has the wire from the controller to this terminal block, and EDS has the wire from that terminal block to computers.”

Thus began our difficulties with GM and controls on our machines.

Rockwell and Cisco

These days, noted GM (and many others) OT supplier Rockwell Automation and noted IT supplier Cisco have joined forces to provide architectures, technology, and training designed to bring these forces together.

After 30 years, it’s about time.

Previously the two companies tackled training. With this news, they have tackled security for the Industrial Internet of Things. Most of the following is taken from their joint press release (meaning I didn’t delete some of the superlatives).

The two additions to their Converged Plantwide Ethernet (CPwE) architectures are designed to help operations technology (OT) and information technology (IT) professionals address constantly changing security practices. The latest CPwE security expansions, featuring technology from both companies, include design guidance and validated architectures to help build a more secure network across the plant and enterprise.

The Industrial IoT is elevating the need for highly flexible, secure connectivity between things, machines, workflows, databases and people, enabling new models of policy-based plant-floor access. Through these new connections, machine data on the plant floor can be analyzed and applied to determine optimal operation and supply-chain work flows for improved efficiencies and cost savings. A securely connected environment also enables organizations to mitigate risk with policy compliance, and protects intellectual property with secure sharing between global stakeholders.

Core to the new validated architectures is a focus on enabling OT and IT professionals to utilize security policies and procedures by forming multiple layers of defense. A defense-in-depth approach helps manufacturers by establishing processes and policies that identify and contain evolving threats in industrial automation and control systems. The new CPwE architectures leverage open industry standards, such as IEC 62443, and provide recommendations for more securely sharing data across an industrial demilitarized zone, as well as enforcing policies that control access to the plantwide wired or wireless network.

“The key to industrial network security is in how you design and implement your infrastructure and holistically address security for internal and external threats,” said Lee Lane, business director, Rockwell Automation. “The new guidance considers security factors for the industrial zone of the CPwE architectures, leveraging the combined experience of Rockwell Automation and Cisco.”

Rockwell Automation and Cisco have created resources to help manufacturers efficiently deploy security solutions. Each new guide is accompanied by a white paper summarizing the key design principles, as follows:

The Industrial Demilitarized Zone Design and Implementation Guide and white paper provide guidance to users on securely sharing data from the plant floor through the enterprise.

The Identity Services Design and Implementation Guide and white paper introduce an approach to security policy enforcement that tightly controls access by anyone inside the plant, whether they’re trying to connect via wired or wireless access.

“Security can’t be an afterthought in today’s plant environment. As we connect more devices and create more efficient ways of operating, we also create certain vulnerabilities,” said Bryan Tantzen, senior director, Cisco. “Cisco and Rockwell Automation have been teaming for nearly a decade on joint solutions, serving as the standards-based resource for security in industrial environments. These new architectures and guides build on our collaboration by helping organizations recognize and proactively address today’s security concerns.”

Companies can now take advantage of industry-leading solutions from Rockwell Automation and Cisco to address security from a holistic perspective. Together, the two companies provide a common, scalable architecture for ruggedized industrial Ethernet and enterprise networks, along with unique services, such as security assessments and managed security, to help manufacturers define and meet performance metrics and scale in-house resources.

This announcement further extends the commitment by Rockwell Automation and Cisco to be one of the most valuable resources in the industry for helping manufacturers improve business performance by bridging the gap between plant-floor industrial automation and higher-level information systems.

Panduit Acquires Industrial Ethernet Networking Tool

Panduit Acquires Industrial Ethernet Networking Tool

Panduit logoAmong the earliest conversations I had about using Ethernet in industrial control were with Mark Fondl—then vice president with Modicon, now Schneider Electric. He was a strong advocate long before anyone else (other than Benson Hougland at Opto 22) foreseeing the power of Ethernet as the networking medium of choice.

After the Schneider acquisition of Modicon and the subsequent downgrading of that type of automation within the company, Fondl left, founded Network Vision, and developed a handy little tool for managing industrial Ethernet networks called IntraVUE.

In what I hope a success story for an entrepreneur, Fondl has sold the assets of Network Vision and the IntraVUE tool to networking supplier Panduit. That company has been an integral part, along with Cisco and Rockwell Automation in the Industrial IP Advantage project.

Press Release

Here is the news from the press release. Panduit Corp. announced it has completed the acquisition of IntraVUE by Network Vision Inc. This acquisition increases the Panduit Industrial Automation Infrastructure offering to its customer base with a tool for visualization and diagnostics of Industrial Ethernet control networks.

“The Panduit offering and route to market complements IntraVUE by combining our ability to bridge the physical installation of the infrastructure to the applications supported by the network with the world-class developer and provider of physical infrastructure solutions”

Automation networks are susceptible to interruptions which often result in downtime, and lost production. While conventional tools are frequently unable to detect many types of network interruptions, IntraVUE provides the capability to identify and report information critical to improving uptime of the Industrial Ethernet infrastructure.

According to Matthew O’Sullivan, Panduit EVP of Industrial Automation Infrastructure business, “The proven capabilities of IntraVUE and the expertise of the team will provide our customers with the ability to increase the reliability of their network infrastructure and as a result, improve operational uptime.”

“The Panduit offering and route to market complements IntraVUE by combining our ability to bridge the physical installation of the infrastructure to the applications supported by the network with the world-class developer and provider of physical infrastructure solutions,” said Mark Fondl, founder, Network Vision Inc.

Deployed globally, IntraVUE is a tool trusted by industrial controls professionals to assure network uptime for manufacturing plants that use Ethernet technologies as a part of their controls and automation network. This tool provides network diagnostic capabilities in addition to real-time visualization and monitoring of the Industrial Ethernet network, helping manufacturers proactively improve the uptime of their Industrial Ethernet infrastructure.

Cisco IoT System Simplifies, Accelerates Internet of Things Deployments

Cisco IoT System Simplifies, Accelerates Internet of Things Deployments

Cisco IoEThe Internet of Things (IoT) is nothing if not about connectivity. Connecting edge devices to control and information platforms is nothing new to industrial systems, but technology advances attempt to make things easier and faster to deploy.

Cisco’s connectivity products and technologies have long been at the core of enterprise networks. Cisco has also partnered with automation companies such as Rockwell Automation, Emerson Process Management, and Honeywell Process Solutions.

Cisco just announced its latest extensions to the technology. The new Cisco IoT System addresses the complexity of digitization “with an infrastructure that can manage a growing mix of endpoints, platforms and the data deluge.”

Within the new Cisco IoT System framework, Cisco introduced more than 15 new IoT products across six pillars to address the complexities of digitization and help organizations deploy, accelerate and innovate with IoT. Together, the framework supports the infrastructure growth requirements that organizations are facing with IoT by helping raise operational efficiency, create new services, and improve quality and security.

Six­Pillar Approach for Cisco IoT System

The Cisco IoT System integrates six pillars that must come together for a successful IoT solution and deployment:

  1. Network Connectivity: Includes purpose-­‐built routing, switching, and wireless products available in ruggedized and non‐ruggedized form factors.
  2. Fog Computing: Extends cloud connectivity closer to the edge to produce immediate insights and efficiently analyze and manage d Cisco predicts that 40% of IoT ­‐created data will be processed in the fog by 2018. Over 25 of Cisco’s network products are enabled with Cisco’s fog computing or edge data processing platform, IOx.
  3. Security: Connects cyber and physical security for visibility into both physical and digital assets, to increase protection and expand operational benefit Cisco’s IP surveillance portfolio and network products with TrustSec security and cloud/cyber security products allow users to monitor, detect and respond to combined IT and Operational Technology (OT) attacks. Organizations in industries such as manufacturing and energy are increasingly working to integrate proprietary   process control systems with the IP network infrastructure, which requires a multi‐layer security approach to maintain logical separation of business functions.
  4. Data Analytics: The Cisco IoT System provides an optimized infrastructure to implement analytics and harness actionable data for both the Cisco Connected Analytics Portfolio and third party analytics
  5. Management and Automation: The IoT System provides enhanced security, control and support for multiple siloed functions to deliver an easy-­‐to-­‐use system for managing an increasing volume of endpoints and applications, that field operators need an easy-­‐to-­‐use management system
  6. Application Enablement Platform: Offers a set of APIs for industries and cities, ecosystem partners and third-­‐party vendors to design, develop and deploy their own applications on the foundation of IoT System capabilities.

Over 15 new IoT products across the six pillars of the IoT System:

Network Connectivity Highlights:

IE5000: Purpose-­‐built IE switch that brings connectivity to factory-­‐level manufacturing and cities.

IW3702: Wireless access point for connected mass transit systems and city Wi-­‐Fi. IR 809, IR 829 series: Introducing 7 new industrial routers with Wi-­‐Fi and 4G/LTE connectivity, ideal for transportation or IoT application deployments.

4G/LTE module for CGR 1000 for utilities, Mobile IP Gateway (MIG-­2450) for connected rail solutions, and 5921 Embedded Services Routers for defense extend reach of industrial networking into remote environments.

Physical and Cyber Security

360° 5MP & 720p IP cameras: These high-­‐quality cameras cater to versatile environments and can host 3rd party software applications. Features include 360° view for situational awareness and audio and digital sensors.

Physical Security Analytics: Camera applications include audio detection, sensor aggregation, audio message triggers, metadata generation, local video player and video summarization.

Data Analytics

Fog Data Services: Allow operators to create policies that monitor and take actions on data flowing through the IoT environment (data-­‐in-­‐motion). It resides on the IOx platform so users can integrate custom policies with applications.

Management and Automation

IoT Field Network Director: This management software allows operators to monitor and customize IoT network infrastructure for industrial scale.

Fog Director: Allows central management of multiple applications running at the edge. This management platform gives administrators control of application settings and lifecycle, for easier access and visibility into large-­‐scale IoT deployments.

 

Partners support Cisco IoT System and IOx for fog computing

Cisco IoT System enables industry verticals such as manufacturing, oil & gas, utilities, transportation, public safety and smart cities to deploy and accelerate IoT solutions and realize business benefits with targeted solutions. Key industry leaders have already ported their software applications to run on the Cisco Fog Computing system, including GE (Predix), Itron (Riva), OSISoft (PI), smartFOA in Japan, Bitstew, Davra, SK Solutions, Toshiba and more.

Cisco also announced the addition of Covacsis, which is taking advantage of Cisco IOx to provide predictive analytics to manufacturing industries. Cisco also provides comprehensive consulting and professional services for IoT. Our leading networking expertise combined with our technology partners’ expertise helps accelerate transformation and ensures IT and operational technology alignment.

Rockwell Connected Enterprise SlideSujeet Chand, senior vice president and CTO, Rockwell Automation, noted, “Together with Cisco, we are helping customers derive value from the Internet of Things, by simplifying connectivity of assets on the plant floor with the rest of the enterprise and with remote experts. By focusing on the key values of the Cisco approach to IoT, our mutual customers can benefit from improved decision making that can lead to streamlined business and manufacturing processes, reduced network complexities and improved security. Rockwell Automation and Cisco take a collaborative approach to bring OT and IT together to deliver performance-­‐critical information to drive business outcomes across The Connected Enterprise.”

Security Approaches for Industrial Internet of Things

Rockwell Automation, Cisco Partnership Extends Ethernet to Industrial IoT

The Cisco and Rockwell Automation partnership continues its step-by-step extension strengthening Rockwell’s “Connected Enterprise” strategy. This strategy builds on the foundation of EtherNet/IP and CIP (common industrial protocol). Now that all the magazines and newspapers and bloggers are writing about the Internet of Things and the Industrial Internet of Things, supplier communications managers cannot keep themselves from applying IoT to everything their companies do.

The two companies have issued two press releases recently. One concerns enhanced training couched in the strategy of bringing IT and OT together (the once and future kingdom). The other relates to extensions and additions to the partners’ reference architecture.

First, let’s see how many buzz words a marketing manager can fit into one sentence:

“The expansion of the Industrial Internet of Things (IoT) and convergence of operations technology (OT) and information technology (IT) systems into The Connected Enterprise raises questions of who within industrial organizations should design and oversee unified network infrastructures. Rockwell Automation, in collaboration with its Strategic Alliance partner Cisco, is helping address this workforce challenge with the new training and certification offerings.”

Last year, the companies jointly rolled out the Managing Industrial Networks with Cisco Networking Technologies (IMINS) training course and Cisco Industrial Networking Specialist certification. This first-of-its-kind course provided foundational skills needed to manage and administer networked, industrial control systems.

This year, Rockwell Automation and Cisco are unveiling the five-day, hands-on Managing Industrial Networks for Manufacturing with Cisco Technologies (IMINS2) course and CCNA Industrial certification exam. The course offers deeper analysis of EtherNet/IP architectures with industrial protocols, wireless and security technologies implementation, and advanced troubleshooting. The CCNA Industrial certification ensures that OT and IT professionals have the skillset needed to design, manage and operate converged industrial networks.

Pathways to Certification

Students who successfully complete the Industrial Networking Specialist and CCNA Industrial certification exams will earn CCNA Industrial certification. Alternatively, IT and OT professionals that already have their CCNA Routing & Switching or Cisco Certified Entry Networking Technician (CCENT) certification can enroll directly in IMINS2 and take the CCNA Industrial certification exam to receive CCNA Industrial certification. Once completed, the certification is valid for three years.

Participants in the IMINS and IMINS2 courses will receive exam vouchers for the Industrial Networking Specialist and CCNA Industrial certification exams, respectively, as part of course tuition. This offer is only available through courses offered and delivered by Rockwell Automation. The CCNA Industrial certification exam can be taken at one of any Pearson VUE testing centers located in more than 165 countries.

IMINS courses are offered on an ongoing basis. The enrollment schedule for IMINS2 will be posted in June, with classes beginning in July. As the leader in OT/IT skills development, Rockwell Automation will continue to invest in The Connected Enterprise and IoT training curriculum to address emerging skills requirements.

Converged Plantwide Ethernet Architectures (CPwE)

As industrial markets evolve to unlock the promise of the Internet of Things (IoT), Rockwell Automation and Cisco are announcing new additions to their Converged Plantwide Ethernet (CPwE) architectures to help operations technology (OT) and information technology (IT) professionals address constantly changing security practices. The latest CPwE security expansions, featuring technology from both companies, include design guidance and validated architectures to help build a more secure network across the plant and enterprise.

The Industrial IoT is elevating the need for highly flexible, secure connectivity between things, machines, work flows, databases and people, enabling new models of policy-based plant-floor access. Through these new connections, machine data on the plant floor can be analyzed and applied to determine optimal operation and supply-chain work flows for improved efficiencies and cost savings. A securely connected environment also enables organizations to mitigate risk with policy compliance, and protects intellectual property with secure sharing between global stakeholders.

Core to the new validated architectures is a focus on enabling OT and IT professionals to utilize security policies and procedures by forming multiple layers of defense. A defense-in-depth approach helps manufacturers by establishing processes and policies that identify and contain evolving threats in industrial automation and control systems. The new CPwE architectures leverage open industry standards, such as IEC 62443, and provide recommendations for more securely sharing data across an industrial demilitarized zone, as well as enforcing policies that control access to the plantwide wired or wireless network.

Rockwell Automation and Cisco have created resources to help manufacturers efficiently deploy security solutions. Each new guide is accompanied by a white paper summarizing the key design principles, as follows:

The Industrial Demilitarized Zone Design and Implementation Guide and white paper provide guidance to users on securely sharing data from the plant floor through the enterprise.

The Identity Services Design and Implementation Guide and white paper introduce an approach to security policy enforcement that tightly controls access by anyone inside the plant, whether they’re trying to connect via wired or wireless access.

This announcement further extends the commitment by Rockwell Automation and Cisco to be one of the most valuable resources in the industry for helping manufacturers improve business performance by bridging the gap between plant-floor industrial automation and higher-level information systems.

Security Approaches for Industrial Internet of Things

Four Automation Trends Reflected At Rockwell Automation TechED

Some old issues were addressed in new ways by Rockwell people at Rockwell Automation TechED in San Diego Monday (June 1).

  • Workforce
  • IT/OT Convergence (or not)
  • Connected Enterprise
  • Mobility (or the breakdown of silos—finally)

Workforce

We continue to talk about the coming Armageddon of baby boomer retirements and domain expertise walking out the door. This conversation has been ongoing for more than 10 years. We’re still talking.
One proposal here at Rockwell is to increase use of the technology that Millennial generation understands. That suite of technologies and devices are integral to Rockwell’s Connected Enterprise vision.

Another solution comes through the training/workforce development business. That group has begun to provide training and education beyond traditional (to Rockwell) electrical, motor control, and automation. It offers basic math, leadership, mechanical crafts, and more.

IT/OT Convergence

Once again training comes to the front. Partnering with Cisco, Rockwell has developed a specialized class beyond the Cisco CCNA certification—CCNAI. This training goes beyond traditional enterprise networking to include networking crucial for manufacturing and production.

The target market for this training is also non-traditional. It includes those presently working in enterprise IT. The hope is that this training will bring together information technology and operations technology (IT/OT) people and finally move the needle on this sticky organizational problem.

Connected Enterprise

My meeting with a representative of this initiative is set for later this morning. However, I’ve already had many conversations and attended a “Super Session” on the topic.

Connected Enterprise at this point reflects the Internet of Things and is the vision pointing to smart manufacturing. According to an Accenture study about 84% CxO executives see potential revenue streams from IoT, but only about 6% doing something about it

The Rockwell mantra for this conference is Intelligent Assets Controlled by Intelligent Software.

Mobility

Mobility for Rockwell goes far beyond just adding a few visualization tools to smart phones and tablets. It actually reflects the breaking of silos within the company. I’ve seen this developing for several years—especially with the current executive management team.

So, mobility becomes a cross-division effort so that all the various product groups come together so that there is a Rockwell app, not a drives app, a motion app, a control app, and so on.

Mobility also leads to the next age of automation—management by exception. Steve Gillmor of the Gillmor Gang, a popular tech conversation (podcast), talks often about the power of notifications. Notification leads to management by exception. That is where Rockwell is heading.

Follow this blog

Get a weekly email of all new posts.