Posts

Secure IoT Gateway Architecture

/by

An enhanced, secure-by-design OPC UA to MQTT gateway can pass data through a DMZ or IT department, keeping all inbound firewall ports on the plant closed.

Read more

Think Big, Start Small, Scale Up

/by

Every so often we get reports of how things are going with Industrial IoT and digital transformation projects. Although our customers keep us informed, it’s also interesting to hear from the rest of the world, through trade shows, conferences, industry publications and the like. In a recent event in Singapore hosted by ARC Advisory Group, executives and technical experts shared their experiences with colleagues, suppliers, and industry gurus. A summary of three of these presentations was published in a blog titled Lessons from the Industry of Things.

Funnily enough, among those three presentations, two of them had an almost identical approach to implementing Industrial IoT. They even had similar terminology, which is essentially: Think Big, Start Small, Scale Up Fast. The idea is to keep your thinking about IoT as broad as possible at the beginning, with no idea left off the table. Then start with small, inexpensive, easily-managed pilot implementations. As soon as something starts working well, scale up quickly.

“Prototype small is about telling people to stop writing business plans and give it a go―quickly and at low cost,” said the Executive VP and CTO of Australia’s largest producer of natural gas, Shaun Gregory. “And because you lower the consequence of getting things wrong, as long as you’ve learned something, I don’t really care if you fail. Once you have a working prototype, if you do not scale this into your business, you won’t reap the benefits you anticipated.”

The challenge: Scale Up

It all sounds very good. But there is more to the story. There seems to be a challenge in moving from step 2 to step 3, the “Scale Up” step. The article goes on to say, “Mr. Gregory admitted that scaling solutions is the aspect the company has struggled with the most.”

He’s not alone. User surveys from industry analysts show that there is a significant drop in IoT project completion and success compared to the number of working pilots and prototypes. There are probably several factors at work here, including:

  1. Industrial IoT is very different from consumer IoT. In production-level implementations data volumes are much higher, real-time performance is typically a must, and security requirements are much more stringent.
  1. Industrial IoT is very different from in-plant industrial data communication. Again, security is a big issue, as well as protocol translation, gateway technologies, and the need to integrate with IT.
  1. Human factors, like adapting to new ways of thinking, a need for retraining, and new approaches to security, are often overlooked.

All of these factors can be addressed―the first two with the right technology, and the third by appropriate human resource development. Our focus is on the first two. Skkynet technology works equally well on turn-key projects as it does for pilots. For hundreds of connections, or just one. For thousands of data points or just a handful.

The DataHub technology, with its secure-by-design architecture and ability to seamlessly integrate the most important industrial protocols, meets the most stringent requirements for security, throughput, and ease of use that the world’s top engineering and system integration companies value.

Just last month we announced a new partnership with Siemens to use the DataHub with their DCU (Data Capture Unit) to offer “Bulletproof IIoT”. This partnership came after extensive testing of the DataHub to ensure that it meets Siemens’ high standards for security, robust performance, and ease of use that Industry 4.0 and Industrial IoT demand. Customers installing the DCU, or any other DataHub connected system, can rest assured that when it comes time to scale up, they will be fully-equipped and ready.

Security by Design

/by

“Security by Design is strongly needed to reduce risk,” said Maximillian G. Koń, CEO at WisePlant, in a recent article in Advancing Automation: Industrial Cybersecurity. He tells how so many industrial automation and control systems were created decades ago, long before the idea of sending plant data to IT or the cloud was ever dreamed of. He says that security weaknesses were generated “during system design, engineering, construction, installation, commissioning, operation, maintenance, and retirement.” And he warns that security must be inherent in the system, not simply added as an afterthought.

Wake-Up Call

To illustrate his point, Koń tells the story of the S.S. Eastland, a passenger ship that sailed the Great Lakes at the beginning of the last century. The ship was not well-designed to start with, having problems with stability. After the sinking of the Titanic, new safety regulations required installing enough lifeboats on any ship to hold all the passengers it was rated for. The owner of the S.S. Eastland complied, and soon the vessel had a full set of new lifeboats, mounted above the upper decks.

However, the ship was not designed for this additional weight so high above the center of gravity. One tragic day as several thousand people were boarding for a pleasure cruise, the Eastland began listing heavily, and then suddenly rolled over and sank, right next to the pier, in 20 feet of water. Over 800 people were lost.

To avoid such tragedies in the industrial realm, Koń lays out an Industrial Cybersecurity Program that follows a security by design approach in three phases: Assess, Implement, and Maintain. When discussing the Implement phase, Koń talks about “bolt-on security vs. built-in security.” He says that existing systems must use bolt-on security, while new systems can be designed with built-in security. Although this principle makes sense, it begs the question: Why should existing systems have to settle for bolt-on security?

A New Approach

Most traditional technologies do require bolt-on security. But a new approach to data communication, Skkynet’s DHTP protocol, supports software and services that are secure by design and ideal for Industrial IoT and IT-to-OT applications. This security-by-design implementation works equally well for new or existing systems, providing the best of both worlds. Rather than adding security to an existing system, it connects that system to a complete, stand-alone, secure-by-design IoT implementation.  It’s almost like enveloping a ship in some kind of new, sink-proof technology, rather than simply adding lifeboats.

With Skkynet’s technology, the enterprise can keep its legacy equipment and SCADA systems as long as needed, and yet provide secure access to live production data for authorized parties―on-premise or in the cloud. Whenever new hardware is acquired, it can be phased in as necessary, with no disruption to data links between shop floor and top floor.

The important thing is the principle: Security by Design. Security is not something that can be bolted on at the end. It needs to be an integral, built-in part of the design of hardware, software, and industrial control systems. Let’s take to heart the lesson of the S.S. Eastland, and keep our systems on an even keel. With the right technology and approach, Industrial IoT and IT-to-OT data communication can be as secure as the air-gapped systems of yesteryear.

Ransomware Attacks – Choosing an Easy Way Out?

/by

What would you do—right now—if your computer screen locked up and a message appeared, “Your files and data have been encrypted with a strong military algorithm. You have 3 days to pay for our decoder to get your data back.” What if it wasn’t your personal computer at all, but a company computer? What if you owned the company?

In a recent BBC video, reporter Joe Tidy describes the bold response that Norsk Hydro of Sweden made to that kind of a ransomware attack. Rather than succumbing to the hackers’ demands, the 35,000 employees at the company switched over to paper-based operations for days and weeks until the computers could come back online. Salespeople had to work on the factory floor and finance staff made sandwiches, but production in the 170 plants worldwide continued almost unabated.

“I think in general it’s a very bad idea to pay,” Jo De Vliegher, a company spokesperson, told the BBC. “It fuels an industry. It’s probably financing other sorts of crimes.”

Much as we may admire Norsk Hydro’s strong response, the attack and its after-effects cost the company over 50 million dollars. Small wonder that ransomware attacks on businesses have increased by 500% in the past year, according to some sources, and that ransom demands can be in seven figures.

Pay or Perish?

Unfortunately, these circumstances leave some companies with little choice—it’s pay or perish. A survey conducted by Small Business Trends shows that 55% of all SMBs would pay the ransom. It is hard to blame them when another recent report shows that 60% of small companies that sustain a cyber attack go out of business within six months. On the other hand, experts point out that paying the ransom may not solve the problem, since the attacker still may not release the data, or may release part of it and demand more money for the rest.

A Better Solution

Of course, a better solution is to secure your system against ransomware attacks. For a company’s IT department, all of the standard security guidelines apply, as well as ensuring backups of any data needed to run the company. OT (Operations Technology) systems that are increasingly being accessed from outside need to pay special attention. Threats like ransomware attacks that may have seemed irrelevant to an air-gapped system years ago take center stage when OT gets connected to IT. Even with a VPN, any virus that can propagate within IT can make its way into OT.

Strong, closed firewalls are essential, and DMZs can be very useful. In this environment, Skkynet’s secure-by-design software and services allow companies to access their production data without compromising on security. Rather than waiting until after an attack has occurred, the easiest and most cost-effective way to deal with a ransomware attack is to prevent it from happening in the first place.

IoT for All

/by

With each passing year the IoT (Internet of Things) becomes more familiar, more of a household word. What once seemed a futuristic dream—having billions of devices connected and chattering over the Internet—is now almost taken for granted. Case in point is the IoT For All website whose very name speaks volumes. It seems that everyone is using or at least touched by IoT in one way or another.

At the beginning of the year, IoT For All published an article Where Is IoT Headed in 2019? that collects and distills the thoughts of industry experts regarding the near future for the IoT. Although not specific to Industrial IoT, there was significant discussion on several themes that are of interest to us here at Skkynet:

Secure by Design

Several experts have predicted that the rapid development of the IoT with little attention being paid to security will lead to widespread attacks in the coming year—often directed at industrial and infrastructure targets. At the same time, they lament the lack of robust security solutions built into hardware, software, and services. James Goepel, CEO and General Counsel for Fathom Cyber mentioned new regulations in California that mandate a secure-by-design approach to the IoT. “I think we’re going to see many more states, and possibly the federal government, following California’s lead and creating legislation that imposes new cybersecurity-by-design requirements on IoT manufacturers,” he said. Skkynet’s customers will be ready, as they have been employing our secure-by-design approach to the IoT for years.

Edge and Hybrid Computing

This year “will be a defining year for edge and hybrid computing strategies as IoT and the global network of sensors pile on more data than the average cloud has had to handle in the past,” according to Alan Conboy, working in the Office of the CTO at Scale Computing. “This transition will officially crown edge computing as the next big thing.” This has certainly been our experience. As interest in edge computing grows, we are seeing a corresponding demand for Skkynet’s edge computing and hybrid cloud solutions.

Remote Access

“Experienced engineers are hard to find and those they do have can only visit so many remote sites in a year. Enabled by 5G and the speed with which data can travel through the air, AR (augmented reality) will enable engineers-in-training to be able to have instant intelligence about a device on which they may be working just by pointing their tablet towards it,” said Jeff Travers, Head of IoT Connectivity Management at Ericsson. Much of this remote connectivity will depend on secure, real-time, two-way data flow. Again, Skkynet’s unique approach to Industrial IoT solves problems that many managers and executives are only now beginning to realize exist.

In short, the future continues to brighten for IoT in general, and Industrial IoT in particular. At least part of our mission is to make the move to IoT as smooth and easy as possible. We want it to become the logical choice for anyone who considers it—so that it really does become IoT for all.

The Kaspersky Report: It’s Not Really About OPC UA

/by

Automation.com, a leading online publisher of automation-related content, recently ran a commentary on a new report from Kaspersky Labs about OPC UA. The Kaspersky report identified 17 critical security flaws in OPC UA software. But although the Kaspersky methodology may be sound, the commentary in Automation.com suggested caution in drawing conclusions.

It turns out that the flaws noted by Kaspersky were simply because an OPC UA must listen for connections on a network, just like any other server on a TCP/IP network. The real problem is deeper, according to the commentary. Put simply, the standard approach to industrial data communications is not suitable for untrusted networks like the Internet. A better solution is not to allow any inbound connections at all.

Click here for full article