Refine
Document Type
- Article (7)
- Conference Proceeding (5)
- Report (4)
- Working Paper (2)
- Bachelor Thesis (1)
- Book (1)
- Part of a Book (1)
Has Fulltext
- yes (21) (remove)
Is part of the Bibliography
- no (21)
Keywords
- Computersicherheit (21) (remove)
The PROFINET protocol has been extended in the current version to include security functions. This allows flexible network architectures with the consideration of OT security requirements to be designed for PROFINET, which were not possible due to the network segmentation previously required. In addition to the manufacturers of the protocol stacks, component manufacturers are also required to provide a secure implementation in their devices. The necessary measures go beyond the use of a secure protocol stack. Using the example of an Ethernet-APL transmitter with PROFINET communication, this article shows which technical and organizational conditions will have to be considered by PROFINET device manufacturers in the future.
Das PROFINET Protokoll wurde in der aktuellen Version um Security-Funktionen erweitert. Damit können für PROFINET flexible Netzwerkarchitekturen unter Berücksichtigung von OT-Security Anforderungen entworfen werden, die durch die bisher erforderliche Netzwerksegmentierung nicht möglich waren. Neben den Herstellern der Protokollstacks sind nachfolgend auch die Komponentenhersteller gefordert, eine sichere Implementierung in ihren Geräten umzusetzen. Die erforderlichen Maßnahmen gehen dabei über die Nutzung eines sicheren Protokollstacks hinaus. Der Beitrag zeigt am Beispiel eines Ethernet-APL Messumformers mit PROFINET-Kommunikation die künftig von PROFINET-Geräteherstellern zu berücksichtigenden technischen und organisatorischen Rahmenbedingungen.
Kleine und mittlere Unternehmen (KMU), die dem Bereich der Automatisierungstechnik zuliefern, stehen vor der wachsenden Herausforderung, dass Kundinnen und Kunden vermehrt Produkte fordern, die im Sinne der IT-Sicherheit „sicher“ entwickelt werden. Die Norm IEC 62443-4-1 beschreibt einen solchen sichereren Produkt-Entwicklungslebenszyklus. Derartige Standards stellen hohe Anforderungen an die Organisation der Prozesse. Um die Umsetzung dieses Prozesses auch KMU zu ermöglichen, werden im folgenden Dokument Musterprozesse beschrieben, die Unternehmen befähigen die Anforderungen zu verstehen und im eigenen Unternehmen ein-, bzw. fortzuführen.
Even for the more traditional insurance industry, the Microservices Architecture (MSA) style plays an increasingly important role in provisioning insurance services. However, insurance businesses must operate legacy applications, enterprise software, and service-based applications in parallel for a more extended transition period. The ultimate goal of our ongoing research is to design a microservice reference architecture in cooperation with our industry partners from the insurance domain that provides an approach for the integration of applications from different architecture paradigms. In Germany, individual insurance services are classified as part of the critical infrastructure. Therefore, German insurance companies must comply with the Federal Office for Information Security requirements, which the Federal Supervisory Authority enforces. Additionally, insurance companies must comply with relevant laws, regulations, and standards as part of the business’s compliance requirements. Note: Since Germany is seen as relatively ’tough’ with respect to privacy and security demands, fullfilling those demands might well be suitable (if not even ’over-achieving’) for insurances in other countries as well. The question raises thus, of how insurance services can be secured in an application landscape shaped by the MSA style to comply with the architectural and security requirements depicted above. This article highlights the specific regulations, laws, and standards the insurance industry must comply with. We present initial architectural patterns to address authentication and authorization in an MSA tailored to the requirements of our insurance industry partners.
Big-Data-Datenplattformen werden immer beliebter, um große Datenmengen bei Bedarf analysieren zu können. Zu den fünf gängigsten Big-Data-Verarbeitungsframeworks gehören Apache Hadoop, Apache Storm, Apache Samza, Apache Spark, und Apache Flink. Zwar unterstützen alle fünf Plattformen die Verarbeitung großer Datenmengen, doch unterscheiden sich diese Frameworks in ihren Anwendungsbereichen und der zugrunde liegenden Architektur. Eine Reihe von Studien hat sich bereits mit dem Vergleich dieser Big-Data-Frameworks befasst, indem sie sie anhand eines bestimmten Leistungsindikators bewertet haben. Die IT-Sicherheit dieser Frameworks wurde dabei jedoch nicht betrachtet. In diesem Beitrag werden zunächst allgemeine Anforderungen und Anforderungen an die IT-Sicherheit der Datenplattformen definiert. Anschließend werden die Datenplattform-Konzepte unter Berücksichtigung der aufgestellten Anforderungen analysiert und gegenübergestellt.
Dramatic increases in the number of cyber security attacks and breaches toward businesses and organizations have been experienced in recent years. The negative impacts of these breaches not only cause the stealing and compromising of sensitive information, malfunctioning of network devices, disruption of everyday operations, financial damage to the attacked business or organization itself, but also may navigate to peer businesses/organizations in the same industry. Therefore, prevention and early detection of these attacks play a significant role in the continuity of operations in IT-dependent organizations. At the same time detection of various types of attacks has become extremely difficult as attacks get more sophisticated, distributed and enabled by Artificial Intelligence (AI). Detection and handling of these attacks require sophisticated intrusion detection systems which run on powerful hardware and are administered by highly experienced security staff. Yet, these resources are costly to employ, especially for small and medium-sized enterprises (SMEs). To address these issues, we developed an architecture -within the GLACIER project- that can be realized as an in-house operated Security Information Event Management (SIEM) system for SMEs. It is affordable for SMEs as it is solely based on free and open-source components and thus does not require any licensing fees. Moreover, it is a Self-Contained System (SCS) and does not require too much management effort. It requires short configuration and learning phases after which it can be self-contained as long as the monitored infrastructure is stable (apart from a reaction to the generated alerts which may be outsourced to a service provider in SMEs, if necessary). Another main benefit of this system is to supply data to advanced detection algorithms, such as multidimensional analysis algorithms, in addition to traditional SIEMspecific tasks like data collection, normalization, enrichment, and storage. It supports the application of novel methods to detect security-related anomalies. The most distinct feature of this system that differentiates it from similar solutions in the market is its user feedback capability. Detected anomalies are displayed in a Graphical User Interface (GUI) to the security staff who are allowed to give feedback for anomalies. Subsequently, this feedback is utilized to fine-tune the anomaly detection algorithm. In addition, this GUI also provides access to network actors for quick incident responses. The system in general is suitable for both Information Technology (IT) and Operational Technology (OT) environments, while the detection algorithm must be specifically trained for each of these environments individually.
Die Konvergenz von Netzwerken ist ein zunehmender Trend im Bereich der Automatisierung. Immer mehr Anlagenbetreiber streben eine Vereinheitlichung der Netzwerke in ihren Anlagen an. Dies führt zu einer nahtlosen Netzwerkstruktur, einer vereinfachten Überwachung und einem geringeren Schulungsaufwand für das Personal, da nur eine einheitliche Netzwerktechnologie gehandhabt werden muss. Ethernet-APL ist ein Teil des Puzzles für ein solches konvergentes Netzwerk und unterstützt verschiedene Echtzeitprotokolle wie PROFINET, EtherNet, HART-IP sowie das Middleware-Protokoll OPC UA. Dieses Papier gibt einen Überblick über die Auswirkungen von Ethernet-APL-Feldgeräten auf die OT-Sicherheit und schlägt vor, wie die OT-Sicherheit für diese Geräte gewährleistet werden kann.
Network convergence is an increasing trend in the automation domain. More and more plant owners strive for a unification of networks in their plants. This yields a seamless network structure, simplified supervision, and reduced training effort for the personnel, as only one unified network technology needs to be handled. Ethernet-APL is one piece of the puzzle for such a converged network, supporting various real time protocols like PROFINET, EtherNet, HART-IP as well as the middleware protocol OPC UA. This paper gives an overview on the impact of Ethernet-APL field devices to OT security and proposes how to ensure OT security for them.
The impact of vertical and horizontal integration in the context of Industry 4.0 requires new concepts for the security of industrial Ethernet protocols. The defense in depth concept, basing on the combination of several measures, especially separation and segmentation, needs to be complimented by integrated protection measures for industrial real-time protocols. To cover this challenge, existing protocols need to be equipped with additional functionality to ensure the integrity and availability of the network communication, even in environments, where possible attackers can be present. In order to show a possible way to upgrade an existing protocol, this paper describes a security concept for the industrial Ethernet protocol PROFINET.
For anomaly-based intrusion detection in computer networks, data cubes can be used for building a model of the normal behavior of each cell. During inference an anomaly score is calculated based on the deviation of cell metrics from the corresponding normality model. A visualization approach is shown that combines different types of diagrams and charts with linked user interaction for filtering of data.