Although defined more than 3 decades ago, the Purdue Reference Architecture (PERA) is still a reference model widely used for segmentation of enterprise ICS into levels, ranging from the sensors (level 0, physical process) to the servers and workstations (level 5).
Levels 0-3 are typically managed by OT, while levels 4-5 are traditionally the responsibility of IT. The Secomea Solution is typically deployed at level 2 (Supervisory Control) alongside HMI and SCADA systems, sometimes at level 1 (Basic control), and even as a gateway between these two layers. With the introduction of IIoT, level 3 (Site Control) is undergoing a transformation acknowledging that IoT devices at level 3 may have to communicate directly with level 1 devices and outwards towards the internet, often via level 4 and 5.
The Secomea SiteManager IoT Gateway is by its agent design assuring that communication is restricted to specific IP endpoints and ports rather than an entire network, and such access to endpoints can be controlled centrally for a specific person or role-based group and within certain time slots. Additionally, the SiteManager can be controlled on site by digital ports so that OT or machine operators can control the access locally.
Defense in Depth is a security approach wherein a series of layered security mechanisms and controls protect the Confidentiality Integrity and Availability (aka the “CIA triad”) of the network and the data within. The IEC 62443 series of standards are founded on the DiD principles, combined with the zone principles of the Purdue Model for grouping logical and physical assess with common security requirements. The Security Levels (SL) and Maturity Levels (ML) of the IEC 62443 standard defines the practices and degree of resistance against different classes of attackers.
The Secomea Solution is audited according to IEC 62443-4-2 and IEC 62443-3-3 with a baseline of SL2 but with several capabilities compliant with SL3 and SL4. Secomea development SDL (Secure Development Lifecycle) processes are structured towards IEC 62443-4-1, and we expect formal certification in 2022 at a baseline of minimum ML2. The fact that the Secomea solution is deployable solely on-premises and does not rely on a Cloud service allows an enterprise to take full control of remote access processes and to link it into its own Identity Management systems (IDM), such as Active Directory (AD).
The principle of zero-trust is that all devices (assets) and users must have mutual trust. This requires full visibility of communication leaving and coming into the organization as well as traffic within the organization. For instance, a user should not have access to a certain asset without a clear purpose. The fundamental principles of zone boundaries or network perimeters used by the Purdue Model and which also the Defense in depth is relying on are being challenged by growing attack surfaces introduced by cloud computing and IoT.
A fundamental principle of the Secomea solution is that you can define your access boundary down to a specific device IP and port and a named person. The central administration also allows you to control both authentication and authorization for users by simple drag-and-drop operations.
For device to device (asset to asset) communication, the Secomea LogTunnel technology provides a unique trust layer to a distributed Enterprise network. LogTunnel, by principle, only carries traffic in one direction and only from a given device and to a given device on a predefined IP address and port. The connections are defined centrally in the GateManager Access Management server, and all connections and data are accumulated in centralized usage logs.