SECURITY ON THE INDUSTRIAL INTERNET OF THINGS · SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS...

SECURITY ON THE INDUSTRIAL INTERNET OF THINGSHow companies can defend themselves against cyber attacks.

2

CONTENTS

Introduction .............................................................................................................................................................3Industry in Change ................................................................................................................................................4 Automation and Digitization of Industrial Processes .....................................................................................4 The Internet of Things (IoT): local – regional – global ....................................................................................5The Challenge: Secure Machine Communication .........................................................................................6 Risks .......................................................................................................................................................................6 Security Strategies ...............................................................................................................................................6 Defense in Depth ..................................................................................................................................................8 Security by Design ...............................................................................................................................................9 Protection Objectives in Industrial Networks – Confidentiality and Integrity .......................................... 10 Availability .......................................................................................................................................................... 11 Authenticity ........................................................................................................................................................ 12The Essentials of a Secure Network .............................................................................................................. 13 Interplay of modules, terminal devices and networks: a use case … ......................................................... 13 Safety precautions for SIM Cards ................................................................................................................... 14 Attacks on SIM Security ................................................................................................................................... 16 Radio Scanners ................................................................................................................................................. 16Data Platforms for Industry 4.0 Applications – The role of Cloud Computing on the IoT ................. 18 Secure Data Storage and Processing ............................................................................................................ 19 Security in the Cloud – Security at Work ....................................................................................................... 19 Further Requirements, Risks and Protective Mechanisms .......................................... .............................. 19 A Practical Example: Recording and Relaying Machine Data ................................................................... 20 The Basis: Secure Professional Cloud Data Centers .................................................................................. 22Recommendations ............................................................................................................................................. 24Annex ..................................................................................................................................................................... 26

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS CONTENTS

3

INTRODUCTION

More and more objects, sensors and actuators can be connected by means of intelligent soft-ware solutions. Including connected industrial plant, machinery and equipment, they can all be automated further by means of production, manufacturing and logistics processes, leading both to many opportunities and to new security risks.

According to the German electrical engineering industry association VDE, seven out of ten decision makers in industry have misgivings about IT security. They see it as the most serious obstacle to the spread of Industry 4.0 in Germany. Federal Research Minister Johanna Wanka’s view is that “without secure data interchange, Industry 4.0 or the fusion of production and services with the Internet will not be possible”. IT security, she says, is one of the key preconditions for making use of the opportunities that Industry 4.0 offers. Secure communi cation is the only way to create confi-dence in the new networked production processes.

An industrial Internet of Things thus requires comprehensive security management in order to limit access to interfaces, systems, sensors, (remote) maintenance access points and equipment to an authorized group of persons or to authorized processes.

Without laying claim to be complete, this white paper illuminates relevant risks, protection targets, and aspects of security for communication and data traffic in networks. In addition, it points out possible solutions to ensure that connecting machines, and storing and sharing data are largely automated and secure.

The degree of security that a company needs must always be considered in the context of its busi-ness model. There is no patent remedy or 100 percent guarantee of security, but a security solution corresponding to the risks in question can certainly be achieved.

SECURITY WILL MAKE INDUSTRY 4.0 POSSIBLE

IT security is one of the central preconditions for making use of the opportunities of Industry 4.0. On the following pages you will find solutions for connecting machines, and for making data inter-change largely automated and secure.

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS INTRODUCTION

4

INDUSTRY IN CHANGE

AUTOMATION AND DIGITIZATION OF INDUSTRIAL PROCESSES

Comprehensive and cross-enterprise digitization and automation characterize the fourth industrial revolution. They include remote maintenance of plant and machinery by means of an Internet of Things (IoT) solution, and self-controlling, decentralized processes in production facilities, and connection of management software and production systems. Operating resources such as plant and machinery are, along with hardware and software, connected devices and employees, cyber-physical systems (CPS) that can fulfill customers’ requirements swiftly and flexibly in “smart factories”.

Studies and experts forecast a perceptible growth impetus as a result of Industry 4.0. According to a survey by Bitkom and the Fraunhofer IAO Institute of Labor Economics and Organization (IAO), a value-added potential of EUR 78 billion awaits the machinery and plant engineering, electrical engineering, automotive, and chemical industries, agriculture, and information and communication technology by 2025. This corresponds to an average annual growth of 1.7 percent. Experts say that digitization offers small and midrange enterprises in particular opportunities to improve their competitiveness, and hold their own against (international) competition.

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS INDUSTRY IN CHANGE

5

THE INTERNET OF THINGS (IOT): LOCAL – REGIONAL – GLOBAL

Where process automation is concerned, the digital factory is already a reality. The constantly growing deployment of automated production equipment and robots, and their consistent connection in a local area such as a production facility are supported by network technologies like Ethernet, WLAN, Bluetooth, RFID or Low Power Wide Area Networks. In addition, these technologies facilitate to some extent the networking of regional locations, as long as their respective network infrastructures do not differ totally from one another.

Telcos such as Deutsche Telekom provide building blocks for secure supra- regional or global connections in the form of network technologies for Wide Area Networks. Their solutions include, in particular, broadband connections like fiber optic, and cellular or mobile connections. LTE technology delivers performance on a par with that of a fixed-line network. LTE also shortens latencies – with the result that LTE mobile networks provide a sound basis for the Internet of Things and Industry 4.0.

IDC market researchers estimate that by 2020 about 30 billion “things” such as machines, cars, washing machines and refrigerators will be con-nected via the Internet around the world. With the adoption of the IPv6 standard the technical preconditions are in place. Instead of around four billion addresses as in the days of IPv4, about 340 sextillion addresses can be allocated under IPv6. So 30 billion connected “things” are just the beginning – and nowhere near the end of the IoT and Industry 4.0.

In these IoT networks individual components will talk with cyber-physical systems. They will do so on the basis of previously passive devices or things being equipped with microcontrollers, identifiers, sensors and actuators that are known as embedded systems. They serve inter alia to receive and relay data, to identify objects unequivocally, to determine status, and to check and actively control (production) processes. A smart container, for example, can be identified indirectly via an RFID transponder. Depending on how frequently data is recorded and transmitted, the trans-ponder can then relay at any time required information about the container’s most recent position and contents. Standardized interfaces and defined protocols ensure that interaction processes between modules or intelligent systems are executed and can, as required, be adjusted or replaced at any time.

REMOTE MAINTENANCE OF MACHINERY AT DüRKOPP ADLER AG.

The sewing machine manufacturer Dürkopp Adler demonstrates opportunities that can be opened up by means of connected machines. The Bielefeld-based company has connected its in-dustrial sewing machines in collaboration with Deutsche Telekom. If the customer so wishes, the manufacturer can monitor from its head office in Germany the status of machinery at a factory in, say, Bangladesh. If the monitoring system reports problems, the configuration can be adjusted from Bielefeld.

Dürkopp Adler reduces in this way both machine downtimes and the cost of sending service technicians out to rectify faults on site. To check connected sewing machines, Dürkopp Adler uses the Cloud of Things (see also practical example on page 20), a cloud-based software platform that manages, controls and evaluates data from connected devices, and also contains certifi-cated hardware components and SIM cards with a data tariff.

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS INDUSTRY IN CHANGE

6

THE CHALLENGE: SECURE MACHINE COMMUNICATION

RISKS

The large number of active or passive elements in an industrial IoT solution poses in its complexity a major security challenge. Companies must, for one, ensure the security of the software, infrastructures, application and computer systems used. For another, they must deal with the effects of possible cyber attacks on the operational safety of devices and plants that are connected to the Internet. On the IoT, security management goes beyond one’s own company because companies must to some extent open up their networks and systems for customers, suppliers and partners.

In addition, the element of human error comes into play. It includes oper-ating errors, unsafe passwords or simple credulity. According to the Federal Office for Information Security (BSI), in 2014 social engineering and errors/ sabotage ranked third and fourth in the top ten security risks faced by in-dustrial control systems (ICS). The only greater risks are those of malware infection via the Internet and intranet, and via removable storage devices and external hardware. In fifth place come break-ins via remote mainte-nance access points. Compromising or manipulation of data and systems in the production environment, and of cloud components is now another of the top ten risks for systems used to measure, regulate, and control processes in production and process automation.

Effective counter-measures exist to deal with all these sources of danger, however. They include partitioning or sealing off systems, restricting access authorizations, and hardening the ICT components used, or in other words enhancing system security by means of dedicated software, using encryption processes, and – last but not least – creating a security awareness among employees along with strict observance of security guidelines in order to counter the threat of “social engineering”.

Another technique used to attack administrative and user systems con-sists of spreading deeper and deeper into the company. Hackers launch follow-on attacks to target especially sensitive systems in the production area, or attack SCADA systems that monitor and control production systems. These follow-on attacks are aimed at reading out access data, and gaining unauthorized access by means of, for instance, brute force

attacks or dictionary attacks on inadequate authentication mechanisms. Hackers mainly use these methods to identify user account passwords. They test systematically every possible combination of definable alpha-numeric and special characters. This has long been known to be the case, but hackers still use this method because they can make fully automated attacks using software tools. The success of these methods depends to a large extent on the complexity and length of the password. To ward off follow-on attacks of this kind, companies should establish a basic protec-tion, and put in place against primary attacks further measures as part of a so-called defense-in-depth concept.

Other attacks involve reading or manipulating control commands because communication between the control components of industrial plant frequently uses unencrypted protocols. A further target of hackers are network components such as routers or firewalls, the security mecha-nisms of which they lever out in order, say, to redirect network traffic.

The effects of this multi-stage attack technique on which the well-known Stuxnet worm was based can be serious. They range from theft of intel-lectual property and trade secrets via production outages, and physical damage to plant and equipment to falsified sensor data or incorrect display data in control systems leading to a reduction in the quality of end products. How is one to counter Stuxnet & Co.-style ICS attacks and to protect process control systems? Firstly, by developing security profiles specially designed for process control systems at the system and product level, and secondly, by developing technology-specific minimum standards.

SECURITY STRATEGIES

To ward off threats to the industrial Internet of Things and facilitate secure IoT solution communication, a comprehensive, holistic concept based on a defense-in-depth strategy is required. Security aspects should also be taken into consideration at the initial development stage of plant, equipment, systems and networks (Security by Design).

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS THE CHALLENGE: SECURE MACHINE COMMUNICATION

7

RISKS AND COUNTER-MEASURES

Material challenges that pose a threat to the security of industrial IoT solutions: 1. The complexity of a large number of active and passive components 2. Cyber attacks on the operational security of plant and equipment3. Networks and systems partially opened for customers, suppliers,

and partners4. The human element: human error and credulity 5. Manipulation of cloud components

Effective counter-measures: 1. Sealing off systems 2. Limiting access authorizations 3. Hardening ICT components by means of dedicated software 4. Using encryption processes 5. Strengthening security awareness among employees

ORGANIZATIONAL THREATS TO IT SECURITY: THE “ENEMY WITHIN”

In addition to human error and the range of attack techniques used by cyber criminals, inadequate security management from within poses a threat to companies. The BSI lists typical self-inflicted risks of this kind in its ICS Security Compendium. They include inadequate IT security regulations, incomplete documentation, insufficient safeguards for remote maintenance access points, failure to monitor the supporting infrastructure, dependence of the ICS network on IT networks, and, last but not least, a lack of security awareness among employees.

Companies should pay special attention to security in the deployment of standard IT components. These commercial-off-the-shelf (COTS) products often have vulnerabilities that have been identified, are already documented, and are therefore used by cyber criminals who develop customized mal-ware for them. That is why companies should check carefully which of these COTS products are especially under threat. Timely installation of software updates is also very important. These updates fix vulnerabilities that have come to light – vulnerabilities that virus scanners may not be able to recognize and fend off.


8

DEFENSE IN DEPTH

Defense in depth divides a security architecture into different layers or levels, each of which is covered by adequate security measures. Should an attacker succeed in surmounting the barriers of one layer, he will then face the next “door” and need to pick its “lock”. In ICS systems, for exam-ple, there is, for one, a need to make so-called field bus communication between sensors, actuators and automation devices secure, and to pre-vent unauthorized access via an unprotected maintenance access point. For another, additional barriers must prevent the hacker from attacking the ICS’s programmable logic control (PLC). So the technical implemen-tation of a defense-in-depth strategy at this point requires, in addition to field bus firewalls, secure protocols and automated anomaly recognition.

To safeguard industrial and automated control systems in depth, a mix-ture of different products, technologies and methods is advisable. They help to ward off external and internal threats.

They include: • Guidelines and procedures for employees to handle control systems

and the corporate assets they contain. Training should also be pro vided to promote risk awareness among employees.

• Documentation and implementation of all rules and controls designed to ensure physical security, by restricting access to rooms, switch panels, cables and devices to authorized personnel only.

• A framework structure for the security of network infrastructure (hard-ware and software, firewalls, routers, switches, etc.) that blocks com-munication routes and services which are not explicitly authorized.

• Hardening or increasing the security of computers by means of, inter alia, a patch management guideline, using antivirus software, and deinstalling operating system components that are not used.

• Improving application security by implementing change management, and systems to authorize and authenticate the (changing) in-house users, and hardening devices by limiting physical access to authorized personnel, encryption of device communication and authentication in the network before commencing data transmission.

DEFENSE-IN-DEPTH SECURITY – MULTIPLE LAYERS OF DEFENSE

The basis for any security concept should be a risk-based analysis, and inventory that assesses the value of key valuables (corporate assets) such as production processes, patented processes and formulas, and imple-ments appropriate security mechanisms. It must be borne in mind that not every machine or every object must be connected. What is required is a multistage security concept geared to the specific risk situation.

To protect ICS systems all levels must be equipped with end-to-end safeguards.

PHYSICAL

NETWORK

COMPUTER

APPLICATION

DEvICE

POLICIES, PROCEDURES & AWARENESS


9

SECURITY BY DESIGN

To put communication to successful use in IoT solutions, security aspects must be taken into consideration at the development stage. In other words, rather than incorporating security mechanisms retro- and reactively, which until now has usually been the practice, in the future a proactive integrated approach to product and process development will be required that pro-vides for the protection of plant and IT infrastructure. This will also apply to SME engineering and manufacturing companies that frequently use control software developed in-house. Their developers must take security concerns into consideration from the first line of code onward. Firmware for machinery and equipment must also fulfill equally high security require-ments in order to prevent product piracy more effectively.

MULTISTAGE PROTECTION FROM THE OUTSET

Defense in depth, originally a military strategy devised to delay attacks by means of independent lines of defense, and to gain time for counterattacks, serves in information security to ward off follow-on attacks by an intruder who has gained access to the corporate network.

Applied to Industry 4.0, a multistage defense-in-depth concept to protect automatic and control systems consists of the following components:- Guidelines and awareness methods for employees- Physical security - Network security- Computer security- Application security - Terminal device security

Security by design also ensures that the security functions of products and processes are taken into consideration from the development stage, and complemented by prevention, detection and reaction measures.

At the same time, security is a moving target. Attackers are constantly developing their methods further, thereby requiring companies to con-stantly adjust their security strategy. The consequence is a changing, dynamic threat situation that requires one new adaptation after another. Security profiles must be corresponding mobile and, if required, permit swift reconfiguration.

On the one hand, security for the industrial Internet of Things must be ensured proactively as far as possible by means of security by design, while on the other, in the event of a security breach, it must be able to respond swiftly and flexibly in order to limit the extent of the damage. This requires graduated and coordinated prevention, detection and reaction measures. “There can be no such thing as an effective security implementation along ‘set up and forget’ lines,” as the authors of the Industry 4.0 Implementation Strategy put it.


10

PROTECTION OBJECTIvES IN INDUSTRIAL NETWORKSCONFIDENTIALITY AND INTEGRITY

Ways to manipulate or read data on the industrial Internet of Things will increase in number. Increasingly dynamic and cross-enterprise connection steps up the risk of “external attacks” by affiliated companies. An IoT solution is no exception inasmuch as communication is a matter of trust. Machine A in Company A must be able to rely on Machine B in Company B not having been hijacked by an attacker who pretends to be Machine B, and either steals the data sent by Machine A or reads it undetected. In much the same way as in data interchange between humans or between humans and a (Web) service, trust in an IoT solution must be underpinned by security measures such as confidential login data and encryption of communications.

On the IoT, however, constellations of persons, services, plant and sensors involved can change dynamically, and a larger number of digital identities inevitably means a larger number of targets. Machines cannot make flexible ad-hoc decisions; they execute prescribed program steps and commands. That can make security incidents harder to recognize. So companies should consider setting up central surveillance authorities for their industrial net-works to check login data, communication behavior and data quantities shared, and to identify potential identity theft.

Attacks on the integrity of production data can have serious consequences – up to and including manipulation of safety-relevant properties of a product

that goes on to cause damage to persons or property. “A minimal misalign-ment of 0.5 mm can be sufficient to have a painful effect on an entire production plant and its processes. Or an interval is changed, a plant suddenly overheats and a robot does things it is not supposed to do. Attacks of this kind are a serious risk. That is why trustworthy digital iden-tities of components, sensors and services is so important in Industry 4.0,” says Claudia Eckert, Professor of Computer Science at Munich TU and Director of the Fraunhofer AISEC. The integrity of data recorded – data by which production processes are documented for tracking – is no less important. Depending on the industry or product, data can be liability- relevant or must comply with regulatory requirements as, say, in the pharma-ceuticals industry.

In the IoT’s cross-enterprise value chains participating companies will need to make additional contractual provisions on responsibility for data security because data integrity is no longer a matter for a single party. If, say, a contract manufacturer receives sensitive design data, it must be ensured that he can no longer use the information received once the contract is completed. An additional factor with regard to Industry 4.0’s Lot Size 1 objective is that personal information such as name, gender, age or address is processed in connection with an order. So there is a further obligation to treat all customer data in accordance with the strict provisions of the German Data Protection Act.

TRUSTWORTHY DIGITAL IDENTITIES

In Industry 4.0’s cross-enterprise value chains there is a growing number of targets with each participating component. Central surveillance authorities protect industrial networks by monitoring registration data, communication behavior and data quantities shared, and by providing notification of identity theft potential. Trustworthy digital identities are the key to secure communication, and to the integrity and confidentiality of data that is in need of protection.


11

AvAILABILITY

The number of systems and interfaces required to operate cross-enterprise networks on the IoT will tend to increase sharply. Nationwide use of IoT solutions will present fresh challenges on the availability of infrastructures and networks. Existing communication networks will need to be expanded in order to improve fail safety, quality of services and globally available bandwidth, and to keep latencies to a minimum. Compared with classic IT, ICS must run for longer periods, have shorter maintenance windows and will usually face real-time control requirements. Any disruption of production or other services can constitute a critical business risk, such as when a coordinated plant shutdown becomes unavoidable to prevent physical damage.

An attack on availability can also be undertaken indirectly when an attacker targets operational safety components or functions. This can lead to an emergency shutdown of a plant or machine if, for instance, a component or the network is overburdened by too many queries. If an attacker manipu-lates functions of a safety component to change threshold values, functional safety is no longer ensured.

An attack vector very often used to bring functions, services or networks to their knees is a distributed denial of service (DDoS). A Web server, for example, is so overwhelmed with queries that it uses all of the available network bandwidth, and legitimate queries can no longer be handled. On the IoT externally accessible interfaces are especially likely to be the target of DDoS attacks of this kind. The increase in numbers of time-critical processes and services that is to be expected will open up further points of attack.

STRONG NETWORKS AND STRONG PROTECTION

In nationwide use of IoT solutions two factors play a vital role in ensuring the availability of infrastructures and net-works. They are powerful communica-tion networks with the lowest possible latencies and protection DDoS attacks, especially at externally accessible inter-faces.

ISP

ISP

Target Server

User

User

User

User

Attacker

Attacker


12

AUTHENTICITY

Hitherto the focus of protection in production has been mainly on avail-ability and integrity. With the advent of IoT applications the authenticity of systems and components will require a higher weighting. As the number of access points and components connected with the Internet increases, there will be an increasing number of potential targets for attack. The risk of unauthorized access will increase especially at unmanned stations, open network access points and points of communication with other companies, such as for maintenance or contract processing. Authenticity thus counts as an “essential characteristic in a value network, especially when cross-enterprise communication is involved,” according to the Industry 4.0 Platform in its implementation strategy.

That is why, along with encryption on all communication routes, an un-equivocal, forgery-proof identity is an essential prerequisite for every

participant in a value chain on the Internet of Things, be it a plant, a machine, a user or a(n end) product. A forgery-proof identity is a digital certificate that in addition to the authentication keys contains the information required for encryption and decryption. “To store security-relevant infor-mation trustworthy, secure storage is required. Security protocols and applications with built-in security must be securely supplied with the requisite login data. This presupposes an identity infrastructure (with one or more authorities depending on complexity) across the value net-work that ensures unequivocal and consistent identification and allocation of a participant’s identity, and supports authentication and the assignment of permissions on the basis of identities,” as the authors of the Implemen-tation Strategy for Industry 4.0 put it. Identity management of this kind is ensured by trustworthy certification authorities that manage the digital certificates of all participants in an Industry 4.0 value creation network.

AvOID UNAUTHORIZED ACCESS

In the complex value networks of Industry 4.0 trustworthy certifi-cation bodies provide the necessary identity management. They use digital certificates and secure storage to facilitate authenti-cation and assignment of permissions via encrypted communi-cation channels.


13

THE ESSENTIALS OF A SECURE NETWORK

Fundamental network security requirements continue to be required on the industrial Internet of Things. Encrypted data transmission is required on all network channels, and in addition, all interconnection points and terminals along the entire chain up to devices’ actuators and sensors must be protected separately. On an industrial Internet of Things the weakest link in the chain determines the level of end-to-end security. The best network protection is no use if a terminal device is inadequately secured, as was the case in Spain, where two security experts were able in a test to crack smart meters that are widely used there, and to manipu-late them in such a way that they could have both read and falsified billing data, and shut down the electricity supply in entire districts.

There will never be total security of either devices or data traffic, of course. The widest range of attacks is constantly waged on network security. They include software systems that are attached to network nodes to read the traffic or programs to crack the encryption or, last but not least, attempts to exploit human weakness and carelessness (“social engineering”). Yet in every conceivable scenario, a fundamental question must be the cost and benefit. A full-scale attack on fiber optic and wireless networks, net-work nodes and encryption, modules, machines and human requires, in addition to technical know-how, the right equipment. As a rule, only intelli-gence services can afford this enormous expense. In view of the benefit

to be gained, it is unlikely that they will tap or sabotage SME production processes on a large scale.

INTERPLAY OF MODULES, TERMINAL DEvICES AND NETWORKS: A USE CASE

In a project, funded by the Federal Ministry of Education and Research (BMBF), Deutsche Telekom, Infineon Technologies, the Fraunhofer Insti-tute for Secure Information Technology (SIT) and three companies – Wibu-Systems, Trumpf and Hirschmann – demonstrated how a secure connect-ed production solution can function. Sensitive production data is sent to and from two sites via a fully secure network link. Security chips from Infi-neon serve as proof of identity for computers, routers and machines, and permit network access only to persons and devices with permissions that have been checked and found to be valid. In this way hardware and pro-duction control software can be secured by means of encryption and au-thentication processes in such a way that only authenticated machines can issue instructions to other production units over the Net. Data is sent encrypted via a secure remote wireless connection, and access to mo-bile terminal devices is via an authentication dongle with a security chip. Hardware-based authentication of machines and routers is an essential part of the security of cross-location data communication.

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS THE ESSENTIALS OF A SECURE NETWORK

14

SAFETY PRECAUTIONS FOR SIM CARDS

The safest way to send machine data over the mobile network is via a module of which the network access is authorized by a SIM card. With SIM cards too, of course, hardware-based identification and protection play a leading role. With both a built-in and a plugged-in card any modification would lead to the user no longer being authorized to use the network access.

In addition to robust physical protection, SIM cards for communication in IoT solutions can be equipped with further protective mechanisms. Instead of a static password for authentication of two terminals on the IoT, there is a dynamic password that changes constantly and is trans-mitted using 128-bit encryption. After exchanging and confirming the keys, the password, changed yet again, is transmitted so as to ensure that tracing software stands no chance of reading it. IP VPN technology (see Using Mobile IP VPN M2M to Protect Mobile Connections diagram) offers especially effective protection of data transmitted in mobile machine traffic.

Individual authorization concepts can be set up on the basis of known IP addresses. Using private IP addresses of the customer’s own ensures not only a higher level of protection but also simplifies the swift and unequivo-cal identification of M2M modules in the corporate network (LAN) by allocating fixed, static IP addresses.

IP connections via GPRS/EDGE, UMTS/HSPA and LTE are routed without port blocking or address/port implementation between M2M modules and corporate LAN. By means of these transparent IP connection, further savings can be achieved in respect of programming work and the costs that it involves. In addition, all applications can be used without restriction within the scope of the bandwidths and runtimes provided. Bidirectional communication between mobile devices is ensured because connections in the Deutsche Telekom network are permanently established.


15

USING MOBILE IP vPN M2M TO PROTECT MOBILE CONNECTIONS

To ensure best possible security of M2M communication, Deutsche Telekom has expanded its M2M Service Portal 2.0. In its standard version the portal provides M2M modules with a public access point (Access Point Name, APN) to the Internet via the SIM card. For the secure transmission of M2M files from the module to the server, however, private access points and additional precautions are required for protection from unauthorized access and misuse. These consist, as part of the additional Mobile IP VPN M2M offering, of the following:

• The security of a private APN and a closed user group; only authorized SIM cards can establish a connection with the corporate network or intranet

• The security of an IPsec-encrypted (AES 256) VPN tunnel between the mobile network and the customer’s network

• The use of private, customer’s own IP addresses • Optional blocking access to the public APN/Internet

by means of self-administration • Monitoring data traffic on the M2M Service Portal • Administration of all connections on the M2M Service Portal

Users

Closed user group via SIM card

Employees of your company

Closed user group via SIM card

Mobile network

Private APN and network transmission

Telekom

Private APN and network transmission

Internet

IPSec tunnel

Secure data transfer via the Internet

Customer’s network

At the company

IPSec-enabled routers via data in your company’s network

Router

Internet

IPSec-Tunnel


16

ATTACKS ON SIM SECURITY

As the hack at Dutch SIM card manufacturer Gemalto, that came to light at the beginning of 2015, shows, card integrity cannot be fully guaranteed if, say, the attacker is an intelligence service like the U.S. National Security Agency (NSA) or the UK’s Government Communications Headquarters (GCHQ) and both have the resources and are interested in the hack. According to media reports both services had gained access to the keys used for the encryption of mobile connections. In addition, they had hacked the so-called OTA keys used to install updates on mobile devices over the air (OTA). If an attacker with the right OTA key sends a message to the SIM card, the attached (mal)ware is installed automatically. Attacks of this kind require comprehensive technical capabilities, and nearly un-limited server and storage resources that next to nobody other than intelli-gence services is likely to possess.

RADIO SCANNERS

Another kind of attack is to use radio scanners to read data traffic. To spy on a logistics company, you can hack into the IoT solution’s communica-tion and quickly read a telephone or address book, but to gain access to genuine corporate assets an attacker would need to read all of the data traffic, and evaluate the geodata, status reports and other data that the mobile terminal sends to the central server. That would require the use of significant technical and financial resources. Radio scanners with evalu-ation tools, for example, cost between € 50,000 and € 100,000. As with all IoT threat scenarios, the question is for which attacker or attackers the effort and expense would be worthwhile.


17

USING REGENERATIvE ENERGIES WITH TELEKOM M2M SIM CARDS

In the Bavarian village of Wildpoldsried, local utility Allgäuer Überlandwerk (AÜW) has jointly with partners set up a smart grid for renewable energies. Regional solar, wind and biomass power stations were equipped with measurement technology and wire-less routers. As measurement data was transmitted via the Inter-net, the companies involved had only a limited influence on how it was routed from the wind turbine to the server. In the end, the utility consulted the experts at Telekom IT partner ID.KOM.

As part of the new solution, industrial wireless routers connect the measurement devices at the power stations with Telekom’s wireless network. Via a private access point (APN) the measure-ment data is sent to ID.KOM’s backbone network. As the AÜW also uses a leased line of the Telekom IT partner, the data traffic can simply be routed to the utility’s network. Thanks to the private access point (APN) the SIM cards are allocated a fixed private IP address. That not only makes data transfer especially secure; it is also faster because the data traffic is not routed via the Internet.


18

DATA PLATFORMS FOR INDUSTRY 4.0 APPLICATIONS – THE ROLE OF CLOUD COMPUTING ON THE IOT

€

%

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS DATA PLATFORMS FOR INDUSTRY 4.0 APPLICATIONS – THE ROLE OF CLOUD COMPUTING ON THE IOT

19

SECURE DATA STORAGE AND PROCESSING

Connecting devices, objects and (production) processes over the Internet means that new masses of data will hit systems, servers and storage facilities. For storing and processing this data, and executing applications, cloud computing is a suitable platform. Its high level of scalability makes possible a flexible use of computing capacities that in theory can be ex-tended indefinitely, and as a rule significantly exceeds the processing capacity of in-house solutions (in-house server systems).

Smart things and systems can be connected with a cloud platform via communication networks and programming interfaces (APIs). In the cloud, the link between the IT world and physical devices is provided by applications that evaluate and store data, or send it on to systems like CRM or data mining for further processing and interpretation. There are also applications that control devices and processes by means of sensors and actuators. A secure basis for all traffic to and from the cloud platform is the Transport Layer Security (TLS) encryption protocol, a further develop-ment of the Secure Socket Layer (SSL). In principle, end-to-end (E2E) encryption is considered to be the most suitable security precaution for all devices on the IoT.

SECURITY IN THE CLOUD – SECURITY AT WORK

Each provider is responsible for the security of its own network routes and cloud platforms. In addition, all cloud service providers are responsible for providing secure and standardized interaction options between clouds. The Internet of Things will consist of many different control circuits and (sub)processes that must remain capable of communicating with each other in constantly changing constellations.

In cloud computing mode, responsibility for the physical (operating) security of machines and devices continues to lie with the companies. Machines and handover points to the Net can both become attack targets. Not in every case will it be possible to improve security by positioning connected devices in factory areas that are hard to access for unauthorized persons. Attack vectors are multilayered and can include the firmware or embedded software systems of a machine. At this neuralgic point in IoT communication a further security line must therefore be drawn that en-capsulates actuators, sensors and microcontrollers, etc.

FURTHER REQUIREMENTS, RISKS AND PROTECTIvE MECHANISMS

With cloud programming interfaces (APIs) usually being open access points, special attention must be paid to authentication and integrity. At these points hackers often try to gain access to access and user data by means of brute force and dictionary attacks. Suitable countermeasures are those that are used for authentication by Web applications, such as automatic blocking after a certain number of failed attempts to log in. A variation on this approach ensures that after a failure to log in time elapses before the next attempt can be undertaken, and this interval in-creases with each new failed bid to log in. This solution slows down auto-mated brute force and dictionary attacks most effectively. In setting the intervals or tolerance thresholds to ward off automated attacks care, must be undertaken to ensure, however, that legitimate access to the cloud interface must not be hindered.

Furthermore, cloud operators must absolutely ensure that individual clients (tenants) are strictly separated on their IoT platforms and their data is stored in separate virtual databases. If, for example, a customer has sustained a computer worm infection via an unprotected access point, any possibility of further infection must be ruled out. In much the same way as the defense-in-depth concept at individual companies, cloud platforms must prevent an intruder from finding his way from one gateway to the next.

Providers that market their cloud-based IoT solutions globally should be very careful in their choice of roaming partners so as to ensure friction-free interaction with their networks and backbones. By no means all net-work operators have the same security standards. In addition, country-specific compliance and data protection provisions must be observed.

Regardless whether companies connect within or outside a cloud plat-form, as participant numbers increase in a value creation network, the question arises as to whether a central surveillance authority is required to define and monitor a security policy with user authorizations and au-thentication mechanisms that is binding on all participating companies. Security management of this kind leads to longer response times that can clash with the real-time requirements of automated Industry 4.0 applica-tions. As a rule the largest member of a value creation network will need to assume responsibility for security, and thereby also be the contact for any liability and recourse claims.


20

A PRACTICAL EXAMPLE: RECORDING AND RELAYING MACHINE DATA IN THE CLOUD OF THINGS

The Cloud of Things is a Deutsche Telekom platform for data processing and control of machines, devices and automated processes such as remote maintenance. It records sensor data, visualizes it and then compares it with predefined thresholds, and sounds the alarm if the thresholds are ex-ceeded. In addition, the Cloud of Things can be adapted to the user’s needs by configuration or, in the case of more complex tasks, by programming. It can also send sensor data for more complex analysis to systems such as a data analytics program or a customer relationship management system, where the data can be interpreted and processed specifically.

On the M2M Service Portal, users can view all connection information at a glance at any time. Security features such as a private APN can be booked swiftly and easily as required.


21

It is based on the Telekom network and its M2M Service Portal, which is coupled to the Cloud of Things. Both mobile wireless and fixed-line con-nections are available for secure data transport. For the mobile transmission route, companies receive SIM cards with a data tariff, and use the M2M Service Portal inter alia to manage (activate/deactivate) their SIM cards themselves, to choose or switch tariffs and, if required, to order new cards. Monitoring of data usage and SIM card misuse is also available. In addition, all customers receive secure access to their billing data via a dedicated administrator account on the platform.

To enable companies to deploy processes and devices via this cloud solution, Telekom provides them with TLS-secured programming interfaces (APIs). In this way, inter alia, functions of the automation tolls used by the compa-nies in question can be executed in the Cloud of Things and on the M2M Service Portal.

Via the Cloud of Things users can, inter alia, view the location of their connected devices, and install firmware updates.

For legacy devices or server systems that don’t “speak” SSL/TLS or trans-mit their data in clear text, VPN access to the Cloud of Things is in prepa-ration. The device opens up via the mobile wireless connection a VPN tunnel to the cloud, thereby ensuring secure encrypted communication along the entire route for which Telekom is responsible. And if the devices use proprietary protocols there is an option to “translate” their communi-cation by means of protocol adapters (wrappers), so that they can never-theless transmit data securely to the Cloud of Things.

For TLS-enabled hardware (gateways, routers, etc.) Telekom conducts a basic compatibility test of a number of technical parameters before con-necting it to the Cloud of Things. In a quick test that does not map any customer use cases, Telekom checks, inter alia, whether measurement data and events can be sent and written via https to the standard API.


22

THE BASIS: SECURE PROFESSIONAL CLOUD DATA CENTERS

Without powerful and highly secure data centers, cloud computing is not feasible on the Internet of Things. To prove the security of information at data centers, there is a large number of certifications that are recognized nationally and internationally.

The most important international information safety management system (ISMS) certificate testifies to the fulfillment of ISO/IEC 27001 requirements. ISO/IEC 27001 defines, inter alia, the requirements for the manufacture, implementation, operation, monitoring, review, maintenance and improve-ment of a documented ISMS. It shows whether a data center operator implements the standard’s requirements, and specifies the risks within the entire organization. The ISMS thus forms the basis for selecting suit-able and appropriate security controls. It specifies the instruments and methods with which the management comprehensibly directs, plans, deploys, implements, monitors and improves tasks and activities aimed at ensuring information security.

The Federal Office for Information Security (BSI) has based its “IT-Grund-schutz” on this standard since 2005. It offers ISO 27001 certification based on this basic IT protection. In the German-speaking region it is one of the most trustworthy certificates in the IT sector. It counts as proof of compliance with IT-Grundschutz as defined by the BSI. IT-Grundschutz requirements are much more detailed than those of ISO/IEC 27001 and thus constitute a good best practice collection for implementing the international standard.

In its benchmark paper the BSI recommends at least the international ISO/IEC 27001 standard as a basic requirement for eve ry cloud provider. The standard is important wherever protection of confidential data must be ensured, and that includes cloud computing. Other certificates include EuroCloud Deutschland_eco e.V.’s EuroCloud SaaS Star Audit and the SAS 70 of the American Institute of Certified Public Accountants (AICPA), or corresponding certificates issued by the Cloud Security Alliance. Even though companies can prove with these certificates that their data centers achieve a high level of security, they are not stand ards explicitly designed for cloud computing, and do not cover the special risks that result from the cloud architecture. So it remains to be said that to this day, no de facto standard exists that fulfills the special data security and data protection provisions in the cloud that German law requires.

If data center operators want to achieve ISO 27001 certification, they must have their business processes audited by an auditor who is qualified to undertake ISO 27001 audits. That applies to both the international ISO/IEC 27001 certificate and the ISO 27001 certificate that is based on IT-Grundschutz. The audit is conducted in two phases on the basis of a specified verification schedule. The auditor checks reference documents, carr ies out on-site checks, and compiles a final audit report and corre-sponding certification recommendation. The certification body checks the audit report, releases it, and if the result is positive, a certificate is issued.


23

The auditor bases his report on a catalog of criteria that includes security guideline issues, and deals with security requirements and risks. His find-ings must exceed a certain threshold. This certification is recognized worldwide as a standard and a must for all cloud providers. If a data center operator has an ISO 27001 certificate, customers can be sure that the company fulfills the security standards required, and that their data is safe from third-party access.

Telekom cloud data centers and product development processes are all certificated to the international ISO/IEC 27001 standard, and certifications are reviewed at regular intervals.

TELEKOM’S BIERE DATA CENTER

Germany’s largest cloud data center is taking shape in Biere near Magdeburg. The twin site of Biere and Magdeburg is set to become a significant hub of the IT and telco provider’s global data center infra-structure. On completion the newbuild in Biere will be the largest cloud data center in Germany and one of the largest in Europe. The twin site’s present IT production area of 5,400 square meters can hold around 30,000 servers, and can be expanded to a total of nearly 40,000 square meters. With this data center Telekom is ready to meet the burgeoning demand for secure cloud services from Germany. The building complexes are sealed off and maximum security protects data from unauthorized access. The combination of high-performance data centers and swift, secure networks is essential to take forward technological developments such as Industry 4.0, the Internet of Things or Big Data analytics.


24

RECOMMENDATIONS

Organizing security on the industrial Internet of Things is a complex task. As the contents of this white paper show, there is no one-size-fits-all solution. Total security is just as unrealistic as the desire to implement security measures once and for all, and then to shelve the issue. Security remains a moving target, and IT security strategies and measures require constant further development.

Even though no approach exists that solves all internal and external problems at one fell swoop, a number of effective safeguards involving encryption and authentication have emerged. The greatest possible security, it appears, is achieved by a combination of methods, technologies and products. At the same time plant and equipment manufacturers, net-work operators, software and ICT service providers must join forces to take forward the establishment of common standards for data traffic on the IoT.

In detail, Deutsche Telekom recommends bearing the following points in mind:

• Most companies have ground to make good in securing IT infrastructures. At present only around one in four has an IT security strategy of its own that it regularly reviews and updates. At the beginning of the age of Industry 4.0, the introduction of a binding cross-company security strategy that covers both IT security and operational safety is indispensable.

• The implementation of any security strategy should be based on a risk analysis of the company’s infrastructure and corporate assets. On the basis of the actual and target positions as regards acceptable risks, a realistic assessment can be made of which methods, technologies and products the individual company should implement.

• Security on the IoT should be preventive and proactive in alignment, and follow an integrated Security by Design approach to product and pro-cess development that keeps an eye on the protection of plant and of IT infrastructure in equal measure. In software development, IT security starts with the first line of code, and in the procurement of hardware and software purchasing certificated products is advisable.

• An Industry 4.0 security architecture should take to heart the principles of the defense-in-depth approach, and be multistage in structure. Gen-erating awareness among employees, guidelines for the physical security of plant and machinery, a security framework for the corporate network “hardening” of computers and equipment, and binding regulations on authentication of people and machines are all among the basics of any defense-in-depth strategy.

• In industrial networks external interfaces, and handover and access points are increasingly targeted by hackers who, by attacking IT security, trigger follow-on attacks on operational safety, and often go unnoticed for longer period. To prevent this from happening, prevention, detection and reaction capabilities must be established or extended at companies.

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS RECOMMENDATIONS

25

• Encryption of data traffic, combined with unequivocal authentication of people and machines, ensures a high level of security. That is why developing trustworthy certification bodies and clear, forgery-proof identities along the value chain is a fundamental prerequisite for col-laboration in industrial networks.

• Industry 4.0 applications bring with them fresh storage challenges for companies. Smart sensors generating enormous amounts of data to be processed by data analytics programs (predictive analytics, data mining) in many cases make the involvement of external special ser-vice providers indispensable – providers who need to be connected to the networks via secure interfaces. To cope with the requisite storage and security requirements, data platforms like the Cloud of Things are suitable because they can also take over the control of machines and automated processes.

• Industry 4.0 eliminates the distinction between office IT and production IT with its automated processes. To ensure security from sensors to Office applications it is advisable to merge responsibilities for both in a central security management department. With the increasing fusion of corporate networks and entire value creation networks, each with their different protection requirements, the importance of coordinating secu-rity measures not only in one’s own company but also in dealings with Industry 4.0 partners and service providers is on the increase.

• Industry 4.0 ushers in cross-enterprise connection and integration in value networks. To shape cooperation of this kind, the development of uniform common standards is necessary, as is a reference architecture for describing and implementing them.

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS RECOMMENDATIONS

26

ANNEX

GLOSSARY AND ABBREvIATIONS IN ALPHABETICAL ORDER

AES – Advanced Encryption Standard: an encryption process that guarantees a very high level of security.API – Application Programming Interface: is provided by a software system for other programs and serves to connect them to the system. APN – Access Point Name: the name of the (entry and exit) gateway between the backbone (the basic network with high transmission rates) of a mobile network, and an external packet-based data network like the public Internet. APT – Advanced Persistent Threat: a complex, sophisticated, long-lasting attack on critical IT infrastructures and confidential data held by govern-ment institutions and companies of all sizes and in all industries. The aim is to penetrate deeply into the target’s IT infrastructure and to remain undetected for a long time in order to spy out important information and/or cause maximum damage such as business downtimes. Bluetooth – a wireless standard for data transmission between devices in close range such as PCs and peripherals.BSI – (Germany’s) Federal Office for Information Security.CERT – Computer Emergency Response Team: IT security experts who work on the resolution of specific incidents such as new security vulnera-bilities in applications or operating systems, or on viruses or targeted attacks, and issue security warnings or assess security risks. CPS – Cyber-physical System: software components, sensors and actuators create with mechanical and electronic parts a system and communicate (wirelessly and by wire) via a data infrastructure such as the Internet. CPSs serve to monitor and control production and business processes, value chains, factories and traffic routes, etc. DDoS – Distributed Denial of Service: unavailability of a service due to a targeted attack by a large number of other systems on a server or other network components. E2E – End to End: covering an entire data transmission route from one end to the other; frequently used in connection with encryption and other security issues. Ethernet: a network technology that specifies software and hardware such as cables, network cards and the like for wired data networks, and enables data transmission rates of between 10 megabits and 100 gigabits per second. ICS/IACS – Industrial Control Systems, aka Industrial Automation and Control Systems: generic term for automated control and surveillance systems at industrial plants and so-called critical infrastructures (such as those of power utilities). ICT – Information and Communication Technology.IoT – Internet of Things (also known as the Internet of Everything).IP – Internet Protocol: a standardized procedure for the transmission of data in packet-switched computer networks. Version IPv6 complements Version IPv4, which has run out of addresses. IPv6 permits the allocation of 340 sextillion addresses (a sextillion is a 1 followed by 36 zeros). LAN – Local Area Network: a local network at a company or a public authority.

LPWA – Low Power Wide Area networks or the Cellular Internet of Things (CIoT) are new technologies aimed at providing a publicly available wireless com-munication network for M2M applications or the Internet of Things (IoT). LTE – Long Term Evolution: the fourth-generation (4G) mobile network standard, the successor to UMTS. With LTE download rates of up to 300 megabits per second are possible. M2M – Machine-to-Machine Communication: automated data and information exchange between machines, vending machines, vehicles, containers and other terminal devices, or with a central switchboard that runs on the Internet, the mobile network or other access networks. OTA – Over the Air: an OTA update is a wireless system update (or embedded firmware update) via a wireless interface such as a smartphone or tablet. PLC – Programmable Logic Control: a device that is used in industry for control or regulation and is connected to plant or machinery with sensors and actuators. PLCs are increasingly replacing built-in wired programmed controllers. RFID – Radio-Frequency Identification: a technology that uses electromagnetic waves for automatic, contactless recording and identification of physical objects.RZ – Abbreviation of the German word for data center: Rechenzentrum.SCADA – Supervisory Control and Data Acquisition: SCADA systems collect and analyze real-time data, monitor and control technical processes, and thereby optimize industrial facilities. They are used, inter alia, at power generation and distribution plants (smart grids), telecommunications facilities, chemical plants or in vehicle production. TLS – Transport Layer Security: an encryption protocol for data transmission and further development of Secure Socket Layers (SSLs).VPN – Virtual Private Network: a closed communication network that uses another communication network as a transport medium, such as in the form of a VPN tunnel through the public Internet. WAN – Wide Area Network: a supra-regional network that can extend across countries and entire continents. WANs serve, inter alia, to connect LANs with one another.WLAN – Wireless Local Area Network: a wireless local radio network.

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS ANNEX

27

SOURCES AND FURTHER LITERATURE IN ALPHABETICAL ORDER

acatech Deutsche Akademie der Technikwissenschaften: Deutschlands Zukunft als Produktionsstandort sichern. Umsetzungsempfehlungen für das Zukunftsprojekt Industrie 4.0. Abschlussbericht des Arbeitskreises Industrie 4.0Accenture technology: Driving Unconventional Growth through the Industrial Internet of Things. Amine M. Houyou et al.: Agile Manufacturing General Challenges and an IoT@Work PerspectiveAuf dem Weg ins vierte industrielle Zeitalter, Bekanntmachung des Bundesministeriums für Bildung und Forschung von Richtlinien zur Förderung im Themenfeld Industrie 4.0:http://www.bmbf.de/foerderungen/24078.phpBitkom/Fraunhofer IAO: Industrie 4.0 – Volkswirtschaftliches Potenzial für Deutschland. Studie Bitkom/VDMA/ZVEI: Plattform Industrie 4.0. Industrie 4.0 – White Paper F&U-Themen Bitkom/VDMA/ZVEI: Umsetzungsstrategie Industrie 4.0. Ergebnisbericht der Plattform Industrie 4.0 Bitkom: Spionage, Sabotage und Datendiebstahl – Wirtschaftsschutz im digitalen Zeitalter. Studienbericht. Bundesamt für Sicherheit in der Informationstechnik (BSI): Industrial Control System Security. Top-10-Bedrohungen und Gegenmaßnahmen 2014 BSI: Abwehr von DDoS-Angriffen v1.0, https://www.allianz-fuer- cybersicherheit.de/ACS/DE/_downloads/sofortmassnahmen/BSI-CS_002.htmlBSI: Die Lage der IT-Sicherheit in Deutschland 2014BSI: ICS-Security-Kompendium 2013BSI: ICS-Security-Kompendium. Testempfehlungen und Anforderungen für Hersteller von Komponenten, Stand 19.11.2014.BSI: M 4.396 Schutz vor unerlaubter automatisierter Nutzung von Webanwendungen, https://www.bsi.bund.de/DE/Themen/ITGrundschutz/ITGrundschutzKataloge/Inhalt/_content/m/m04/m04396.htmlCeBIT 2015: Industrie-4.0-Lösungen für die vernetzte Produktion:https://www.telekom.com/medien/konzern/271942Cesar Cerrudo: An Emerging US (and World) Threat: Cities Wide Open to Cyber AttacksCisco/Rockwell Automation: Design Considerations for Securing Industrial Automation and Control System Networks. Synopsis.Deutsche Telekom: Datenschutz und Datensicherheit. Bericht 2014.Digitale Erneuerung: Harvard Business Manager Dezember 2014, S.63 ff. EY: Cybersecurity and the Internet of ThingsFinding Success in the New IoT Ecosystem: Market to Reach $ 3.04 Trillion and 30 Billion Connected “Things” in 2020, IDC Says: http://www.businesswire.com/news/home/20141107005028/en/Finding-Success-IoT-Ecosystem-Market-Reach-3.04 Fraunhofer-Institut für Arbeitswirtschaft und Organisation (IAO): Produktionsarbeit der Zukunft – Industrie 4.0 Studie Gehackte Smart Meter machen Lichter aus. http://www.golem.de/news/intelligente-stromzaehler-gehackte-smart-meter-machen-lichter-aus-1410-109923.html

Gemeinsame Plattform Industrie 4.0 startet: http://www.bmwi.de/DE/Presse/pressemitteilungen,did=701050.htmlHandelsblatt Research Institut: Industrie 4.0. und Digitalisierung im Mittelstand. Einstellung der KMU zum Thema und ihre Hürden bei der Umsetzung.HP: Internet of Things Security Study: Home Security Systems ReportIDC: Grundlage für das Internet der Dinge und die Industrie 4.0: Der M2M-Markt in Deutschland 2012–2017. Marktanalyse Industrie-4.0- Paket, https://geschaeftskunden.telekom.de/startseite/loesungen/ sicherheit/185534/industrie-4-0-paket.htmlInfrastrukturen und Industrie im Kreuzfeuer:http://www.security-insider.de/themenbereiche/plattformsicherheit/schwachstellen-management/articles/487572/Inhyok Cha et al.: Security and Trust for M2M Communications, Interview mit Prof. Dr. Claudia Eckert. Internet der Dinge und Industrie 4.0 benötigen mehr IT-Security: „Gezielte Manipulationen durch Fernzugriffe sind ein großes Risiko“, https://wegweisend-digital.t-systems-mms.com/interviews/Claudia-Eckert-Internet-der-Dinge?wt_mc=osm_3:15:15Magnus Sundell et al.: White Paper on Industrial Automation Security in Fieldbus and Field Device LevelMit der Cloud ins Internet der Dinge – aber wie? http://ikt.nrw.de/cyber-physical-nrw-profilieren/news/einzelmeldung/article/mit-der-cloud-ins-internet-der-dinge-aber-wie/Mobile IP VPN. Die Daten-U-Bahn. https://geschaeftskunden.telekom.de/startseite/loesungen/sicherheit/185534/industrie-4-0-paket.htmlNCC Group: Security of Things: An Implementers’ Guide to Cyber- Security for Internet of Things Devices and BeyondSicheres Netz für das Netz: http://www.telekom.com/innovation/ archiv/280466Sicherheitstechnik zum Schutz der Industrie 4.0, http://www.security-insider.de/themenbereiche/applikationssicherheit/kommunikations- sicherheit/articles/463959So trickst der geniale deutsche Datenbunker die USA aus, http://www.welt.de/wirtschaft/webwelt/article147483300/So-trickst-der- geniale-deutsche-Datenbunker-die-USA-aus.htmStrategy Analytics Industrie 4.0: “The Driving Force behind Europe’s Industrial Internet”TecChannel Compact: IT im Mittelstand. Praxis, Ratgeber, Trends.techconsult: Industrie 4.0 – Vernetzung braucht IT-SicherheitTelekom Deutschland: mittelstand Die Macher Ausgabe 01, März 2015The Great SIM Heist. How Spies Stole the Keys to the Encryption Castle. https://theintercept.com/2015/02/19/great-sim-heist/The Internet of Things will be a $3 trillion industry by 2020, http://www.techradar.com/news/internet/cloud-services/the-internet-of-things-will-be-a-3-trillion-industry-by-2020-1272263 Tobias Heer et al.: Security Challenges in the IP-based Internet of Things

SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS ANNEX

SECURITY ON THE INDUSTRIAL INTERNET OF THINGS · SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS...

Documents

Transcript of SECURITY ON THE INDUSTRIAL INTERNET OF THINGS · SEcURITy ON THE INDUSTRIAL INTERNET OF THINGS...