SECURITY CONCEPTS

SECOMEA AND THE PURDUE MODEL (PERA)

Although defined more than 3 decades ago, the Purdue Reference Architecture (PERA) is still a reference model widely used for segmentation of enterprise ICS into levels, ranging from the sensors (level 0, physical process) to the servers and workstations (level 5).

Levels 0-3 are typically managed by OT, while levels 4-5 are traditionally the responsibility of IT. The Secomea Solution is typically deployed at level 2 (Supervisory Control) alongside HMI and SCADA systems, sometimes at level 1 (Basic control), and even as a gateway between these two layers. With the introduction of IIoT, level 3 (Site Control) is undergoing a transformation acknowledging that IoT devices at level 3 may have to communicate directly with level 1 devices and outwards towards the internet, often via level 4 and 5.

Restricted communication to specific IP endpoints and ports  

The Secomea SiteManager IoT Gateway is by its agent design assuring that communication is restricted to specific IP endpoints and ports rather than an entire network, and such access to endpoints can be controlled centrally for a specific person or role-based group and within certain time slots. Additionally, the SiteManager can be controlled on site by digital ports so that OT or machine operators can control the access locally.

SECOMEA AND ZERO TRUST SECURITY

The principle of zero-trust is that all devices (assets) and users must have mutual trust. This requires full visibility of communication leaving and coming into the organization as well as traffic within the organization. For instance, a user should not have access to a certain asset without a clear purpose. The fundamental principles of zone boundaries or network perimeters used by the Purdue Model and which also the Defense in depth is relying on are being challenged by growing attack surfaces introduced by cloud computing and IoT.   

Define access boundary down to a specific device and port  

A fundamental principle of the Secomea solution is that you can define your access boundary down to a specific device IP and port and a named person. The central administration also allows you to control both authentication and authorization for users by simple drag-and-drop operations.  

For device to device (asset to asset) communication, the Secomea LogTunnel technology provides a unique trust layer to a distributed Enterprise network. LogTunnel, by principle, only carries traffic in one direction and only from a given device and to a given device on a predefined IP address and port. The connections are defined centrally in the GateManager Access Management server, and all connections and data are accumulated in centralized usage logs.