 |
 |
 |
 |
 |
 |
 |
The challenge
As more and more industrial equipment is based on LAN technology, more and more equipment from different vendors is attached directly or indirectly to corporate networks.
Naturally, having all sorts of 3rd party equipment and associated control software attached to a corporate network raises concerns with the IT department, and they will want to separate the production environment from the administrative networks, to eliminate the risk of e.g. viruses spreading from or into production networks.
Unfortunately, this separation is seldom possible, as adminstrative processes often need up-to-date information about production status, volume produced, free capacity, downtime, etc.
So we need technology to do the separation, and only allow the needed traffic to flow between the administrative domain and the production domain.
Passive Security
The traditional answer to the separation is by traffic inspection and filtering, where you still allow anyone in the administrative network to communicate with any of the devices in the production environment (and vice versa), but apply various checks to see that the traffic itself obeys certain rules, for example that you only send "well-formed" commands to a PLC, or a PLC only delivers "well-formed" reports to a database server.
However, even a well-formed PLC command may cause great damage. For example, the traffic inspection device cannot know just by looking at the format of the command, whether a "reset PLC" command is from a legal source, or from some malicious origin.
That is why we call this kind of separation passive security.
Active Security
Secomea's answer to the separation challange is based on active security.
With active security, only traffic originating from or destined for trusted and authorized users will ever pass between a device in the production environment and a PC or server in the administrative domain.
Remote Access Security
Since the Active Security approach is also based on Secomea's GateManager, LinkManager and SiteManager components, opening up the production site for secure remote management is trivial.
