Access the Data, Not the Network
Part 4 of Data Communication for Industrial IoT
The idea of a client/server relationship where the server is the source of information is ingrained strongly into the typical software available today. As a system design that is very difficult to eliminate. Some companies try to make this into a “secure” mechanism by trying to add a layer of security on top of the client/server connection. That layer of security is generally a VPN or (in rare cases) a point-to-point tunnel like SSH tunneling. Since a VPN is typically the answer, it deserves a little more examination.
The purpose of a VPN is to create a virtual IP subnet that is shared only by computers that are authorized to join that subnet. Packets transmitted on the subnet are automatically encrypted, even if neither the sender nor receiver is consciously using encryption. That definitely makes it harder for an outsider to intercept communication among members of the VPN.
Inside the security perimeter
The big concern with a VPN is that once a computer or device is a member of the VPN, it is effectively like being on a local area network containing all other members of the VPN. If a computer is inside the VPN it is inside the trusted perimeter. This exposes the other VPN members to attack from within, even if they are safe from attack from without. This is similar to what happened in a big box store in 2013, where attackers gained access to the LAN by breaching a third-party company who had “secure” access to the store’s internal network. The larger the number of computers on a VPN, the more points of entry through the secure perimeter you have.
In the Internet of Things, security concerns have been pushing away from VPNs for a while. A blog posting at Microsoft from 2013 takes a look at VPNs and the issues surrounding them. If you haven’t seen it, it’s worth a read.
When we are talking about collections of devices, plant control systems or data acquisition systems on a larger network a VPN might seem like a compelling solution, but it inevitably exposes your network to attack, either due to a compromise in a VPN member, a compromise in the VPN server or simple theft of network credentials. Once you have any of those, every machine on the VPN becomes a sitting duck.
There is no valid reason why you should provide external access to the whole network any more than you should provide external access to an embedded device. In exactly the same way that you protect your devices by having them transmit data outbound to a middleman you can protect any data source, like an industrial control system, using the same mechanism. You can have remote access to your data without exposing your internal network.
In the world of IIoT you should aim to access your data, not the network.
Continue reading, or go back to Table of Contents
