Security Approaches for Industrial Internet of Things

Security Approaches for Industrial Internet of Things

GaryThumb14Personal interlude

After leaving the “magazine editor business” a year ago, probably for good as a full-time editor anyway, I turned to just keeping this blog active. Readership has increased slowly but steadily over the past eight months. About as many people will see an article here as on a magazine Website (not as many total as a magazine Website, but they have much more content).

I decided not to pursue advertising as a revenue source. That seems to be the old way. It’ll hang on for a long time, but growth is not there.

Most of my business is consultation of various kinds including messaging and marketing, research, analysis, Web and digital development, and leadership.

It is more fun and insightful than trying to keep sales people and advertisers happy while forging a new message in a crowded field.

However, Manufacturing Connection will continue to bring the latest relevant news along with analysis about why you should care.

OT coming together with IT

I have been fascinated with what we now call the IT/OT divide (information technology professionals versus operations technology professionals) since about 1986. About that time my company was designing, building, and selling automated assembly machines to industry. Our largest customer was General Motors.

General Motors, in a gigantic brain fart, acquired EDS. And, predictably, it succeeded in totally destroying the EDS culture and making it like GM. That is to say, cumbersome, lethargic, bureaucratic.

But one day a senior manager went through the controls engineering department of one of my best customers and said, “You’re EDS,” “You’re GM.” Then they told us, “GM has the wire from the controller to this terminal block, and EDS has the wire from that terminal block to computers.”

Thus began our difficulties with GM and controls on our machines.

Rockwell and Cisco

These days, noted GM (and many others) OT supplier Rockwell Automation and noted IT supplier Cisco have joined forces to provide architectures, technology, and training designed to bring these forces together.

After 30 years, it’s about time.

Previously the two companies tackled training. With this news, they have tackled security for the Industrial Internet of Things. Most of the following is taken from their joint press release (meaning I didn’t delete some of the superlatives).

The two additions to their Converged Plantwide Ethernet (CPwE) architectures are designed to help operations technology (OT) and information technology (IT) professionals address constantly changing security practices. The latest CPwE security expansions, featuring technology from both companies, include design guidance and validated architectures to help build a more secure network across the plant and enterprise.

The Industrial IoT is elevating the need for highly flexible, secure connectivity between things, machines, workflows, databases and people, enabling new models of policy-based plant-floor access. Through these new connections, machine data on the plant floor can be analyzed and applied to determine optimal operation and supply-chain work flows for improved efficiencies and cost savings. A securely connected environment also enables organizations to mitigate risk with policy compliance, and protects intellectual property with secure sharing between global stakeholders.

Core to the new validated architectures is a focus on enabling OT and IT professionals to utilize security policies and procedures by forming multiple layers of defense. A defense-in-depth approach helps manufacturers by establishing processes and policies that identify and contain evolving threats in industrial automation and control systems. The new CPwE architectures leverage open industry standards, such as IEC 62443, and provide recommendations for more securely sharing data across an industrial demilitarized zone, as well as enforcing policies that control access to the plantwide wired or wireless network.

“The key to industrial network security is in how you design and implement your infrastructure and holistically address security for internal and external threats,” said Lee Lane, business director, Rockwell Automation. “The new guidance considers security factors for the industrial zone of the CPwE architectures, leveraging the combined experience of Rockwell Automation and Cisco.”

Rockwell Automation and Cisco have created resources to help manufacturers efficiently deploy security solutions. Each new guide is accompanied by a white paper summarizing the key design principles, as follows:

The Industrial Demilitarized Zone Design and Implementation Guide and white paper provide guidance to users on securely sharing data from the plant floor through the enterprise.

The Identity Services Design and Implementation Guide and white paper introduce an approach to security policy enforcement that tightly controls access by anyone inside the plant, whether they’re trying to connect via wired or wireless access.

“Security can’t be an afterthought in today’s plant environment. As we connect more devices and create more efficient ways of operating, we also create certain vulnerabilities,” said Bryan Tantzen, senior director, Cisco. “Cisco and Rockwell Automation have been teaming for nearly a decade on joint solutions, serving as the standards-based resource for security in industrial environments. These new architectures and guides build on our collaboration by helping organizations recognize and proactively address today’s security concerns.”

Companies can now take advantage of industry-leading solutions from Rockwell Automation and Cisco to address security from a holistic perspective. Together, the two companies provide a common, scalable architecture for ruggedized industrial Ethernet and enterprise networks, along with unique services, such as security assessments and managed security, to help manufacturers define and meet performance metrics and scale in-house resources.

This announcement further extends the commitment by Rockwell Automation and Cisco to be one of the most valuable resources in the industry for helping manufacturers improve business performance by bridging the gap between plant-floor industrial automation and higher-level information systems.

Panduit Acquires Industrial Ethernet Networking Tool

Panduit Acquires Industrial Ethernet Networking Tool

Panduit logoAmong the earliest conversations I had about using Ethernet in industrial control were with Mark Fondl—then vice president with Modicon, now Schneider Electric. He was a strong advocate long before anyone else (other than Benson Hougland at Opto 22) foreseeing the power of Ethernet as the networking medium of choice.

After the Schneider acquisition of Modicon and the subsequent downgrading of that type of automation within the company, Fondl left, founded Network Vision, and developed a handy little tool for managing industrial Ethernet networks called IntraVUE.

In what I hope a success story for an entrepreneur, Fondl has sold the assets of Network Vision and the IntraVUE tool to networking supplier Panduit. That company has been an integral part, along with Cisco and Rockwell Automation in the Industrial IP Advantage project.

Press Release

Here is the news from the press release. Panduit Corp. announced it has completed the acquisition of IntraVUE by Network Vision Inc. This acquisition increases the Panduit Industrial Automation Infrastructure offering to its customer base with a tool for visualization and diagnostics of Industrial Ethernet control networks.

“The Panduit offering and route to market complements IntraVUE by combining our ability to bridge the physical installation of the infrastructure to the applications supported by the network with the world-class developer and provider of physical infrastructure solutions”

Automation networks are susceptible to interruptions which often result in downtime, and lost production. While conventional tools are frequently unable to detect many types of network interruptions, IntraVUE provides the capability to identify and report information critical to improving uptime of the Industrial Ethernet infrastructure.

According to Matthew O’Sullivan, Panduit EVP of Industrial Automation Infrastructure business, “The proven capabilities of IntraVUE and the expertise of the team will provide our customers with the ability to increase the reliability of their network infrastructure and as a result, improve operational uptime.”

“The Panduit offering and route to market complements IntraVUE by combining our ability to bridge the physical installation of the infrastructure to the applications supported by the network with the world-class developer and provider of physical infrastructure solutions,” said Mark Fondl, founder, Network Vision Inc.

Deployed globally, IntraVUE is a tool trusted by industrial controls professionals to assure network uptime for manufacturing plants that use Ethernet technologies as a part of their controls and automation network. This tool provides network diagnostic capabilities in addition to real-time visualization and monitoring of the Industrial Ethernet network, helping manufacturers proactively improve the uptime of their Industrial Ethernet infrastructure.

Security Approaches for Industrial Internet of Things

ODVA Process Industry Initiative for EtherNet/IP

I have business related to an angel investment and too much other travel to attend this week’s Honeywell User Group in San Antonio and Siemens Summit in Las Vegas. Trying to get to both events was both expensive and too exhausting to attempt. I had one friend, at least, who was going to both. More power to Greg. 

I’ll analyze from reports I see from those there and from press releases. I know that Honeywell Process Solutions anticipated one major security announcement at HUG, but I would have been gone had I decided to attend anyway.

Meanwhile, I’ve been writing about the Internet of Things, fieldbuses, and networks for some time. The ODVA reached out asking if I’d like an update on its process industry work with EtherNet/IP. Of course, was the reply. It has a stand at ACHEMA in Frankfurt (another place I could have gone…) and sent me this update that would be the centerpiece of its press conference there.

Along with Rockwell Automation’s entry into the process industry automation market, EtherNet/IP usage now must incorporate process industry standards to go along with factory automation (discrete industry) usage. Partner Endress + Hauser has been building out devices that are EtherNet/IP enabled. This is an interesting addition to process industry “fieldbus” market (I know, perhaps EtherNet/IP is not a “real” fieldbus, but it will be used like one).

This was ODVA’s first appearance at ACHEMA, where ODVA members and EtherNet/IP suppliers Endress+Hauser, Hirschmann, Krone, Rockwell Automation, Rosemount, Schneider Electric and Yokogawa have assembled a demonstration of EtherNet/IP to explain to visitors ODVA’s approach to the optimization of process integration. Illustrating typical process applications, such as clean-in-place, highlights of the demonstration include:

  1. Use of EtherNet/IP to connect best-in-class solutions and devices for process applications;
  2. Integration of traditional process networks, such as HART, Profibus PA and Fieldbus Foundation, into an EtherNet/IP network; and
  3. Movement of data between field devices, such as pressure sensors and flow meter, and plant asset management systems.

ODVA’s process initiative, launched in 2013, is intended to proliferate the adoption of EtherNet/IP in the process industries. Initial focus has been on the integration of field devices with industrial control systems and related diagnostic services, leading to a road map for adapting the technology to the full spectrum of process automation needs, including safety, explosion protection, long distances and comprehensive device management.

“EtherNet/IP is at the forefront of trends in convergence of information and communication technologies used in industrial automation. Although industrial Ethernet was first adopted in the discrete industries, today EtherNet/IP is widely adopted in hybrid industries and is spreading into process industries, said Katherine Voss, president and executive director of ODVA. “Because ACHEMA is an international forum for users in chemical engineering and the process industries as a whole, ODVA felt it would be helpful to the ACHEMA’s audience to broadly showcase to process users the opportunities for integration improvements, optimized network architecture and increased ROI that EtherNet/IP can afford.”

Internet of Things, Fieldbus, and Politicians

Internet of Things, Fieldbus, and Politicians

There are a couple of interesting notes I’ve picked up recently.

Before I get to the first one, I took a long weekend and attended a conference on developing small businesses in developing nations. I met some successful business people who have a passion for helping others survive and thrive in difficult places.

We have learned (or should have) that sending huge chunks of aid money to developing countries has had little effect on changing people’s lives. A significant number of people engage in going to these areas and starting businesses, employing local people, treating all of them ethically, and making a profit for all involved.

If you wish to use your business and/or engineering talents to directly impact people, send me a note. I will get you in touch with the right people.

Are Democrats Throwing In the Towel On Manufacturing

Bill Waddell writes about Lean manufacturing. He is a practitioner and an evangelist. About the only place where he and I part ways relates to accounting. He is a Lean accounting follower. I follow Resource Consumption accounting.

At any rate, Industry Week ran an article authored by the Alliance of American Manufacturing asking if the Democratic Party had thrown in the towel regarding the importance of manufacturing in America.

Waddell responded with his typical acerbic wit by taking political leaders in America (both parties) to task for misunderstanding economics and manufacturing’s place at the table.

If you are a manufacturing professional, I dare you to put aside your party preference blinders for a second and just look at what politicians have to say about manufacturing. Comments are by-and-large ignorant (in the sense of not knowing something).

Where do they get it? Try reading articles about manufacturing in The New York Times or The Wall Street Journal. They also have trouble really understanding what’s going on in manufacturing. Those are two sources of information for politicians.

Drones And Internet of Things

Interesting article in Uptime magazine poses the idea of drones as a part of the infrastructure for the Internet of Things. At the time I write this, the article has not made it from print to Web, so I cannot link to it. Hey Terry, try “Web first” journalism 😉

Expanding our thinking about what constitutes “sensing” and how we get the information is a great service to the industry. As we move past the buzz of IoT and start to look for innovative ways to get the information we need, these ideas are needed.

Modbus as Fieldbus?

John Rezebek, a Foundation Fieldbus evangelist and process control engineer writing in Control magazine takes Grant Le Sueur of Schneider Electric (Foxboro) to task for making a comment about Modbus as a fieldbus.

Schneider Electric became the owner (or leader) of Modbus when it acquired Modicon almost 20 years ago. And Modbus was long in the tooth then. So it was an interesting comment.

However, Foundation is difficult to use. It perhaps tried to solve too many problems in one package. Modbus is too slow and lacking bandwidth for much of what we do in process control and in the Internet of Things for industrial/manufacturing use.

One thing I find surprising about trying to reinvigorate Modbus is that Schneider (again from absorbing Modicon an early Ethernet supporter) became an ODVA member supposedly to support the CIP protocol and EtherNet/IP. Wonder what’s going on there? I’m writing a post for next week about that protocol’s growth in process.

Check out John’s comments and let us know what you think. Is there a third way? Are we still lacking an adequate fieldbus? (OK, Carl, open mic night 😉 ).

Security Approaches for Industrial Internet of Things

Rockwell Automation, Cisco Partnership Extends Ethernet to Industrial IoT

The Cisco and Rockwell Automation partnership continues its step-by-step extension strengthening Rockwell’s “Connected Enterprise” strategy. This strategy builds on the foundation of EtherNet/IP and CIP (common industrial protocol). Now that all the magazines and newspapers and bloggers are writing about the Internet of Things and the Industrial Internet of Things, supplier communications managers cannot keep themselves from applying IoT to everything their companies do.

The two companies have issued two press releases recently. One concerns enhanced training couched in the strategy of bringing IT and OT together (the once and future kingdom). The other relates to extensions and additions to the partners’ reference architecture.

First, let’s see how many buzz words a marketing manager can fit into one sentence:

“The expansion of the Industrial Internet of Things (IoT) and convergence of operations technology (OT) and information technology (IT) systems into The Connected Enterprise raises questions of who within industrial organizations should design and oversee unified network infrastructures. Rockwell Automation, in collaboration with its Strategic Alliance partner Cisco, is helping address this workforce challenge with the new training and certification offerings.”

Last year, the companies jointly rolled out the Managing Industrial Networks with Cisco Networking Technologies (IMINS) training course and Cisco Industrial Networking Specialist certification. This first-of-its-kind course provided foundational skills needed to manage and administer networked, industrial control systems.

This year, Rockwell Automation and Cisco are unveiling the five-day, hands-on Managing Industrial Networks for Manufacturing with Cisco Technologies (IMINS2) course and CCNA Industrial certification exam. The course offers deeper analysis of EtherNet/IP architectures with industrial protocols, wireless and security technologies implementation, and advanced troubleshooting. The CCNA Industrial certification ensures that OT and IT professionals have the skillset needed to design, manage and operate converged industrial networks.

Pathways to Certification

Students who successfully complete the Industrial Networking Specialist and CCNA Industrial certification exams will earn CCNA Industrial certification. Alternatively, IT and OT professionals that already have their CCNA Routing & Switching or Cisco Certified Entry Networking Technician (CCENT) certification can enroll directly in IMINS2 and take the CCNA Industrial certification exam to receive CCNA Industrial certification. Once completed, the certification is valid for three years.

Participants in the IMINS and IMINS2 courses will receive exam vouchers for the Industrial Networking Specialist and CCNA Industrial certification exams, respectively, as part of course tuition. This offer is only available through courses offered and delivered by Rockwell Automation. The CCNA Industrial certification exam can be taken at one of any Pearson VUE testing centers located in more than 165 countries.

IMINS courses are offered on an ongoing basis. The enrollment schedule for IMINS2 will be posted in June, with classes beginning in July. As the leader in OT/IT skills development, Rockwell Automation will continue to invest in The Connected Enterprise and IoT training curriculum to address emerging skills requirements.

Converged Plantwide Ethernet Architectures (CPwE)

As industrial markets evolve to unlock the promise of the Internet of Things (IoT), Rockwell Automation and Cisco are announcing new additions to their Converged Plantwide Ethernet (CPwE) architectures to help operations technology (OT) and information technology (IT) professionals address constantly changing security practices. The latest CPwE security expansions, featuring technology from both companies, include design guidance and validated architectures to help build a more secure network across the plant and enterprise.

The Industrial IoT is elevating the need for highly flexible, secure connectivity between things, machines, work flows, databases and people, enabling new models of policy-based plant-floor access. Through these new connections, machine data on the plant floor can be analyzed and applied to determine optimal operation and supply-chain work flows for improved efficiencies and cost savings. A securely connected environment also enables organizations to mitigate risk with policy compliance, and protects intellectual property with secure sharing between global stakeholders.

Core to the new validated architectures is a focus on enabling OT and IT professionals to utilize security policies and procedures by forming multiple layers of defense. A defense-in-depth approach helps manufacturers by establishing processes and policies that identify and contain evolving threats in industrial automation and control systems. The new CPwE architectures leverage open industry standards, such as IEC 62443, and provide recommendations for more securely sharing data across an industrial demilitarized zone, as well as enforcing policies that control access to the plantwide wired or wireless network.

Rockwell Automation and Cisco have created resources to help manufacturers efficiently deploy security solutions. Each new guide is accompanied by a white paper summarizing the key design principles, as follows:

The Industrial Demilitarized Zone Design and Implementation Guide and white paper provide guidance to users on securely sharing data from the plant floor through the enterprise.

The Identity Services Design and Implementation Guide and white paper introduce an approach to security policy enforcement that tightly controls access by anyone inside the plant, whether they’re trying to connect via wired or wireless access.

This announcement further extends the commitment by Rockwell Automation and Cisco to be one of the most valuable resources in the industry for helping manufacturers improve business performance by bridging the gap between plant-floor industrial automation and higher-level information systems.

Follow this blog

Get a weekly email of all new posts.