Technical Sales Slides
Industrial Security Services | April 2018
Unrestricted www.siemens.com/industrial-security-services
Unrestricted © Siemens AG 2018
Challenges
Productivity, Cost Pressure and Regulations
Seite 2
Protect against
• externally caused incidents
through increasing connectivity
• internal misbehavior
• the evolving Threat Landscape
Costs
• for qualified personell
• for essential Security
Technologies
Comply to
• Reporting Requirements
• Minimum Standards
• Security Knowhow
Protect Productivity Reduce cost Comply to
regulations
§
§
§
Unrestricted © Siemens AG 2018
Industrial Security Services
Your way to protect your business in the
digital enterprise
Seite 3
Industrial Security Services
Protecting Productivity with
Industrial Security Services
Detect threats and vulnerabilites
at an early stage
React fast
Get a long-term, holistic
protection
Unrestricted © Siemens AG 2018
Industrial Security Services
Portfolio aligned with Risk Management
methodology
Seite 4
Manage Security
Comprehensive security through
monitoring and proactive protection:
• Monitor to detect indicators of
compromise
• Manage to keep security up-to-date
• React fast upon security relevant
threats
Assess Security
Evaluation of the current security
status of an ICS environment
Implement Security
Risk mitigation through implementation of
security measures for reactive protection
Unrestricted © Siemens AG 2018
Assess Security
following a risk-based approach
Seite 6
Assess Security
covers a holistic analysis
of threats and vulnerabilities,
the identification of risk
and recommendations
of security measures to close
the identified gaps
Unrestricted © Siemens AG 2018
Assess Security
following a risk-based approach
Seite 7
• Industrial Security Assessment
• IEC 62443 Assessment
• ISO 27001 Assessment
• Risk and Vulnerability Assessment*
* upon request
Unrestricted © Siemens AG 2018
Assess Security
How do we figure out which assessment we
need in each case?
Seite 8
Which assessment do I need?
Or do I rather get a
deep, time intensive
analysis of my
industrial environment,
including data
collection?
Would I like to have a
quick check against
the best known
security standard?
Would I like to have a
quick check against the
best known security
standard for Industrial
Control Systems?
Would I like to have a
compact one-day on
site assessment based
on Siemens long tem
experience in
automation security
Unrestricted © Siemens AG 2018
Assess Security
How do we figure out which assessment we
need in each case?
Seite 9
Which assessment do I need?
Risk & Vulnerability
Assessment
IEC 62443
Assessment
ISO 27001
Assessment
Industrial Security
Assessment
Unrestricted © Siemens AG 2018
Industrial Security Assessment
Identify security gaps and define measures to
mitigate risks
Seite 10
Assessment derived from to IEC 62443 standards and based
on
Siemens Industrial Defense in Depth Concept.
• Ad-hoc identification of current security gaps based on the
assessment scope
• Proposal of appropriate mitigation measures
• Available for Siemens and third party systems
• 1 day on-site
• Coordinated by a security consultant
• Questionnaire-based checklist to identify and classify risks
• Compact report containing recommendations for risk mitigation
measures
Unrestricted © Siemens AG 2018
IEC 62443 Assessment
Identify security gaps and define measures to
mitigate risks
Seite 11
Assessment of compliance to IEC 62443 international standard
(Industrial communication networks – Network and system
security)
• Focus on parts 2-1 “Establishing an industrial automation and
control system security program” and 3-3 “Security for
industrial process measurement and control – Network and
system security”
• Available for Siemens and third party systems
• 2 days on-site
• Coordinated by a security consultant and a security engineer
• Questionnaire-based checklist to identify and classify risks
• Up to 30 pages report containing recommendations for risk
mitigation measures
Unrestricted © Siemens AG 2018
ISO 27001 Assessment
Identify security gaps and define measures to
mitigate risks
Seite 12
Quick assessment of plant security according to the ISO 27001
international standard (Information Security Management)
• Onsite workshop incl. questionnaire-based checklist:
• 1 day on-site
• Coordinated by a security consultant and a security engineer
• Typical attendants: Management and customer‘s responsible for
production, IT security and physical security, maintenance staff,
engineering staff, …
• Offline evaluation of the results: Analysis, risk identification and
classification, definition of risk mitigation measures and prioritization of
actions (based on cost/benefit scenario)
• Up to 30 pages report containing recommendations for risk mitigation
measures
Unrestricted © Siemens AG 2018
Risk & Vulnerability Assessment
Identify, classify and evaluate risks for a riskbased security program
Seite 13
• Report (~ 100 pages) including:
• Project documentation:
• Scope description
• Current network topology
• Current system architecture
• Risk analysis and scoring methodology
• Findings:
• Network topology analysis results
• Installed Base data analysis results
• Evaluation of system criticality results (likelihood and
business impact)
• Risk classification and risk level including scoring
• Training needs
• Risk mitigation measures for each finding
• Management presentation as a first step to establish a security
roadmap
Unrestricted © Siemens AG 2018
Implement Security
to mitigate risks
Seite 15
Implement Security
Covers the Implementation
of security measures
to increase the protection level
of shop-floor environments
Unrestricted © Siemens AG 2018
Implement Security
to mitigate risks
Seite 16
• Security Awareness Training
• Industrial Security Consulting
• Automation Firewall *
• Windows Patch Installation
• Application Whitelisting **
• Anti Virus Installation **
• System Back-Up
• Industrial Anomaly Detection
• Industrial Security Monitoring *
* Devices and implementation service
** Software and implementation service
Unrestricted © Siemens AG 2018
Security Awareness Training
Cyber Security knowledge transfer from a
shop-floor perspective
Seite 17
Customer’s challenge
• 91% of the security incidents in 2015 consisted of stolen
credentials by
use of phishing e-mails1
• Only 3% of targeted individuals reported the phishing e-mail1
• 70% of all security incidents are caused by human error 2
Common approach
• No cyber security training at all
• Cyber security training for the office environment focusing on
classic ITsecurity topics
Weak points of common approach
• Increased vulnerability due to human error threats
• Lack of automation perspective when training staff on cyber
security topics
Goal
Increase security
awareness among shopfloor staff to avoid
security incidents
caused by human error
1) Source © Verizon 2016 2) Source © Ponemon Institute Research 2013
?=X
Unrestricted © Siemens AG 2018
Security Awareness Training
Cyber Security knowledge transfer from a
shop-floor perspective
Seite 18
Our Solution Increasing industrial security
awareness
• SITRAIN training
• Web-based, one-hour training
• Generate security awareness for the staff:
• Introduce current threat landscape in industrial
control system environments
• Describe how to handle risks
• Help identifying security incidents
• Includes a final test
• Available in German and English – further languages on
request
• SCORM1) compatibility for simplified integration into
other e-learning software
1) Sharable Content Object Reference Model
Unrestricted © Siemens AG 2018
Security Awareness Training
Knowledge transfer to secure the “weakest
link”
Seite 19
“What would happen if a seemingly
unimportant control device was
manipulated in such a way that a
product recipe was changed and the
resulting product makes people sick.“
Typical daily situations Sample scenarios
Knowledge check
Unrestricted © Siemens AG 2018
Security Awareness Training
Knowledge transfer to secure the “weakest
link”
Seite 20
Potential vulnerabilities Statutory requirements
and
guidelines Statistics
Unrestricted © Siemens AG 2018
Industrial Security Consulting
Provide support for ICS policies and secured
network design
Seite 21
Policy Consulting
• Establish new or review and enhance existing
policies, processes, procedures and work
instructions which influence security in the shopfloor
• Integration with enterprise cyber security practice
• Examples: Patch and backup strategy, handling of
removable media
Security Consulting
• Cell segmentation in security cells support based on
IEC 62443 standard or SIMATIC PCS 7 & WinCC
security concept
• Design and planning of a perimeter protection
network: DMZ network (Demilitarized)
• Perimeter firewall rule establishment / review and
implementation
Protected Zone
DMZ Zone
Unsecure Zone
Industrial Security
Policy
Unrestricted © Siemens AG 2018
Automation Firewall
First line of defense against highly developed
threats
Seite 22
Customer’s challenge
• Shop-floor landscape changed from isolated islands to highly
complex
networks
• Automation networks historically grown and often evolved to huge
flat
networks without any segmentation
Today’s solutions
• Perimeter protection for the office environment or the whole site
• Perimeter protection for the automation network but controlled by
office IT
without automation know-how
Weak points of today’s solution
• Spread of failures due to flat networks
• Inconsistent configuration of protection measures due to lack of
automation expertise (e.g. perimeter firewall configured to protect
the
office against the automation network and not the other way
around)
• No perimeter protection at all
Goal
Support customers by
providing a perimeter
protection solution in
line with security
requirements for
industrial automation
and tested and
approved for usage with
Siemens process control
system
Unrestricted © Siemens AG 2018
Automation Firewall classic
Feature set
Seite 23
Our Solution Feature Overview
First line of defense against highly developed threats:
• Based on Microsoft® Windows Server 2012 R2 and
SecureGUARD Communication Gateway
• Application layer and stateful inspection firewall
• VPN gateway
• Secure web publishing
• Intrusion detection and prevention system (IDS/IPS)
• Antivirus (optional add-on)
• Self-Protection (i.e. against Denial of Service Attacks)
• Standard provider service (1 year included, extendable up
to 5 years in total):
• Updates for Automation Firewall software
• Hardware spare parts (shipment of a replacement
unit on the next business day)
• Hotline support
• Migration for existing Forefront TMG 2010 possible if
standard provider service contract in place
Unrestricted © Siemens AG 2018
Automation Firewall - classic
Included in the Security Concept for SIMATIC
PCS 7
Seite 24
Our Solution Network Integration
Perimeter protection in accordance with the Security
Concept for SIMATIC PCS 7
• Tested and validated in a PCS 7 environment and with
Siemens industrial communication appliances
• Listed in the PCS 7 Addon Catalogue
• It can be used as front-firewall and/or back-firewall in
line with the white paper "Security concept PCS 7 and
WinCC"
• It protects the PCS 7 and WinCC based automation
network from external threats by controlling the access
point to the automation network
• Additional services like Perimeter Firewall Installation
and/or Management support commissioning, continuously
operation and maintenance
Unrestricted © Siemens AG 2018
Automation Firewall - classic
Industrial Wizard for SIMATIC PCS 7 for
installation and configuration
Seite 25
Our Solution Industrial Wizard
The Industrial Wizard simplifies the configuration and
commissioning:
• Preinstalled on the Automation Firewall
• Maintained in accordance with PCS 7 / WinCC
requirements
• Suitable for the initial firewall configuration (can be
executed several times)
• Based on the PCS 7 / WinCC Security concept
• Automatically creates firewall rules based on inserted
network clients
• Migration wizard for existing Forefront TMG 2010
configurations available
Unrestricted © Siemens AG 2018
Automation Firewall NG (Next-Generation)
Feature set
Seite 26
Our Solution Feature Overview
First line of defense against highly developed threats:
• Based on Palo Alto Networks Next-Generation Firewall
Appliances
• Palo Alto Networks is a “Gartner Magic Quadrant Leader” for
Enterprise Network Firewalls for the 6th Consecutive Year
• Application layer and stateful inspection firewall
• IPSec VPN gateway
• Threat Prevention (additional subscription required)
• Advanced Malware Protection (additional WildFire
subscription required)
• File and Data Filtering
• Classifies all applications, on all ports, all the time
• Enforces security policies for any user, at any location
• Prevents against known and unknown threats
• High availability (active/active and active/passive) modes
• Redundant power input for increased reliability (PA-220 and
PA-850)
• Fan-less design (for PA-220 model)
Unrestricted © Siemens AG 2018
Automation Firewall - NG (NextGeneration)
Different options for different needs
Seite 27
PA-220
Firewall throughput
Use cases
Onboard interfaces
(copper)
Optional interfaces
(SFPs)
Redundant power
supply
PA-820
PA-850
PA-3020
500 Mbps
940 Mbps
Mid-size automation
networks
with a small amount of
copper
interfaces (4 + x SFPs),
plus (fiber) SFPs optional
1,9 Gbps
Big automatio
with a
small amoun
interfaces (4
plus (fiber) S
optional
(8) 10/100/1000
(4) 10/100/1000
(4) 10/100/10
-
(8) SFP
(4/8) SFP,
(0/4) 10 SFP
Yes
No
Yes
Small automation
networks with copper
interfaces only
(8 x copper)
Dimensions in inch
(HxDxW)
1.62”H X 6.29”D X
8.07”W
Dimensions in cm
(HxDxW)
4,11H X 15,98 D X 20,50
W
1U, 19” standard rack
(1.75”H x 14”D x
17.125”W)
1U, 19” standard rack
(4,45 H x 35,56 D x 43,50
W)
Unrestricted © Siemens AG 2018
Optional
Automation Firewall - NG (NextGeneration)
Description of mandatory support & optional
subscriptions
Seite 28
• Threat Prevention Subscription (3 or 5 years)
• The Threat Prevention subscription adds integrated protection against
network-borne threats, including
exploits, malware, command and control traffic, and a variety of hacking
tools, through IPS functionality
and stream-based blocking of millions of known malware samples. ->
LINK TO PALO ALTO
• URL Subscription (3 or 5 years)
• URL Filtering provides you with granular, user-based controls over
Web activity through URL categories
and customizable white- and black-lists, as well as protection from Webborne threats through malicious
categories like “malware” and “phishing.” -> LINK TO PALO ALTO
• Wildfire Subscription (3 or 5 years)
• The WildFire™ subscription actively analyzes unknown threats,
including malware, websites, and
command and control traffic, and delivers automatically created
protections and intelligence back to
subscribed firewalls all over the world for proactive global prevention. ->
LINK TO PALO ALTO
Premium Support (3 or 5 years)
• Premium Support provides you with services for maintaining your Palo
Alto Networks deployment.
Premium Support is directly provided by Palo Alto Networks and
includes e.g. following features:
• Premium support hours: 24/7 for all severities, next-business-day
delivery for parts and hardware
1U, 19” stand
(1.75”H x 14.
17.125”W)
1U, 19” stand
(4,45 H x 36,
W)
replacement, feature releases and software updates, subscription
services updates, documentation
and FAQ, online customer-support portal, etc. LINK TO PALO ALTO
Mandatory
TP
UF
WF
Unrestricted © Siemens AG 2018
Anti Virus Installation
Virus protection solution for malware detection
and prevention
Seite 29
Challenges Our Solution Benefits
McAfee VirusScan protects systems and
single files from virus infections, trojans and
other malware by using continuously updated
signature files.
Siemens uses McAfee’s enterprise anti-virus
solution to enhance the protection level of
shop-floor computer systems for an up-todate defense strategy against
malicious
software while not interfering with the
operation mode of a plant.
McAfee VirusScan is approved for use in
different Siemens’ software products like
SIMATIC PCS 7, WinCC or TIA Portal.
By adapting McAfee VirusScan to
industrial security needs:
• Protection against viruses, worms, rootkits,
trojans and other threats and lower impact
of outbreaks caused by malware
• Detected malware can be removed, moved
to quarantine or simply remain at the
system to prevent deletion of files required
for the automation process
• Easy, centralized operation via
management server
The total number of 2015 vulnerabilities
reflects 77% increase compared to 20111
.
Almost one million never-before-seen
malware are being released on a daily
basis2
.
Until now, more than 550 Millions malware
have been released in 20163
.
Information technologies are used in
industrial automation. The number of open
standards and PC-based systems has
increased enormously in the last years.
1) Source © Risk Based Security 2016; 2) Source © Symantec 3) Source © AV-Test
Unrestricted © Siemens AG 2018
Whitelisting Installation
Application control to protect against malware
and unwanted applications
Seite 30
Challenges Our Solution Benefits
With McAfee Application Control, only
trusted applications are allowed to run on the
computer systems. These applications are
maintained in a positive list (whitelist). It
prevents executions of unknown applications
and executables like malware or unwanted
applications.
Siemens uses McAfee Application Control to
enhance the protection level of shop-floor
computer systems.
Application Control is approved for use in
different Siemens’ software products like
SIMATIC PCS 7, WinCC, TIA Portal and
SINUMERIK3.
With the McAfee Application Control
adapted to industrial security needs,
Siemens offers:
• Block known and unknown threats
(new/unknown viruses, zero-day exploits,
system manipulations, ) and allow
approved, trusted applications to run
• Easily protect unsupported legacy /
obsolete systems (e.g. Microsoft XP)
• As it requires few resources, protection
of real-time systems and less powerful
devices
• No pattern/signature updates required
• It allows patching without disabling
whitelist protection
• Easy, centralized operation via
management server
In 90% of attacks in 2014, old
vulnerabilities that already had patches
available were leveraged – some of which
were more than decade old1.
Total zero-day vulnerabilities increased
exponentially in the last years2:
• 2013: 23
• 2014: 24 (+4%)
• 2015: 54 (+125%), more than one per
week
1) Source © CNN Money 2) Source © Symantec 3) Selected SINUMERIK 840D PCU50.X versions
Unrestricted © Siemens AG 2018
Whitelisting Installation
Application control to protect against malware
and unwanted applications
Seite 31
Attempt to
execute a
software
Check
against
whitelist
Granted permission to
run the application
Denied permission to
run the application
Device in automation
environment with whitelist
Application Control tested
and approved for
compatibility
How does Whitelisting work?
Unrestricted © Siemens AG 2018
Transparency over data exchange within the plant
networks provides you continuous & proactive
identification of changes (anomalies) in the system
• Automated asset identification to assist in
risk analysis and mitigation
• Correlation of the current traffic against
your own baseline of normal operation
allows the detection of anomalies in the
network, including advanced deep packet
inspection
Industrial Anomaly Detection
The challenge: transparency of the industrial
network
Unrestricted © Siemens AG 2018
Customer’s challenge
• Shop-floor landscape has changed from isolated islands to highly
complex networks
• Detection capabilities of malicious communication in the shopfloor are
not given
Today’s solutions
• Perimeter protection to the Office IT with deep packet inspection
• Endpoint Firewalls
Weak points of today’s solution
• No transparency about the “normal” communication in OT plants
• Perimeter protection in the direction of the office IT is not detecting
malicious behavior in the plant network itself
• Automation solutions use proprietary protocols
• No detection of new/changed assets
Goal
Support customers by
providing an Industrial
Anomaly Detection
solution delivering
transparency, situational
awareness and
traceability in the shopfloor networks
Industrial Anomaly Detection
Unrestricted © Siemens AG 2018
optional
SIEM Combo
500
Solution Architecture:
• Normal network topology of industrial plants is a ring or star with
industrial components connected (Engineering Systems, PLCs,
HMIs…).
• Switches connect systems and mirror traffic to Span Port.
• Anomaly detection Sensor is connected to span port and
examines all the mirrored traffic
• The Server can be connected to several Sensors and is the
user interface for operators.
• Multiple Servers can be connected to an Enterprise
Management Console for a view across multiple plants.
• Management console integrates with existing SOC tools (SIEM,
Log Management, Analytics…)
• Server, Sensor and the Management Console
are installed on Siemens IPC 427E
• 100% passive monitoring with a one-way network
connection through the span port provides
safe monitoring of industrial networks. Connection
via Span
Port or Tap
Sensor
Central
Console
Industrial Anomaly Detection
Solution Architecture
Unrestricted © Siemens AG 2018
Industrial Anomaly Detection
Communications View
• Automated discovery
• Assets and communication
pathways
• Powerful and easy dashboard
allows oversight and event
mangement with minimal
configuration
• Includes vulnerability information
• Supports 3rd party devices
Unrestricted © Siemens AG 2018
Transparency of communication with your
production assets.
Industrial Anomaly Detection
Benefits
Transparency over data exchange within the plant networks
provides you continuous & proactive identification
of changes (anomalies) in the system
Correlation of the current traffic against your own baseline of
normal operation allows the detection of
anomalies in the network, including advanced deep packet
inspection
Aligned with requirements of standards, regulations and acts to
protect critical infrastructure
100% passive monitoring oversees the plant network without
impact to the monitored systems
Automated asset identification to assist in risk analysis and
mitigation
Page 38
Use of an advanced machine learning system, so the detection
rate will be enhanced over time
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
The challenge: Increasing vulnerability and
more attacks
Seite 39
1) Source: © Booz Allen Hamilton 2015 2) Source: © https://www.datenschutzbeauftragterinfo.de/itforensik-und-incident-response-daten-und-fakten/ 2016 3) Source: © SANS Institute InfoSec
Reading Room March 2016 4) Source: CNN Money
44% of them could not identify
the origin of these incidents1
In a study from 2015, 34% of the operators of
automation and
process control systems responded, that their systems
were
attacked at least twice in the last 12 months1
In 2015 companies needed on average
205 days to detect an attack2
55% of these companies needed more than
3 hours, to get the systems again up and running3
When hackers are successfully breaking into a
company, they use
within 24 hours the same method, in order to attack
another
company of the same vertical4
To be able to react fast to potential security
threats, indicators of compromise need to be
identified fast
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Challenges: Increasing vulnerability,
connectivity & need for fast reaction
Seite 40
Introduction of malware via removable
media and external hardware
Control components
connected to the Internet
Human error and sabotage
Intrusion via remote access
Compromising of smartphones
in the production environment
Compromising of extranet
and cloud components
Malware infection via the
Internet and Intranet
(Distributed) denial-ofservice ((D)DOS) attacks
Technical malfunctions
Source © BSI analysis on cyber security 2016, German Federal Office for Information Security
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Security Information and Event Management
Technology
Seite 41
Security Event Management
(SEM)
• provides near real-time
monitoring, collecting,
correlation of security
events, alarms and console
views
Security Information
Management (SIM)
• provides long-term storage
and reporting of log data to
comply with security policies
and regulations
Security Information Event
Management
• required by standards,
certification and market:
• IEC 62443 / ISA-99
• NERC-CIP
Industry SIEM
• enables proactive detection
of attacks and anomalies
• enhances Defense in Depth
protection of industrial plants
against cyber attacks
++
Motivation Definition
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Most important supported devices
Seite 42
OPERATING SYSTEMS
Windows XP to Windows 8
Windows Server 2003 to 2012
Linux/UNIX systems
NETWORK DEVICES
Automation Firewall
SCALANCE S, M and X
3rd Party (NG and Application Layer FWs, IDS/IPS, Switches)
INDUSTRIAL CONTROL SYSTEMS
SIMATIC S7 with specific application DB
SIMATIC CP with Security Integrated
SINUMERIK PCU
SOFTWARE AND SECURITY APPLICATIONS
McAfee ePO
TrendMicro
Symantec
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Supported mechanisms for security data
collection
Windows Event Logs:
• Windows based computer
• Windows embedded devices
Syslog (UDP, TCP & TLS):
• Network Components
• Firewalls
• Software
Flat Files:
• Software logs
• Via SCP, (S)FTP, CIFS & NFS
• HTTP –Push/Pull XML files
Database Connections:
• Oracle
• MSSQL
Product Specific Log Formats:
• OPSEC LEA
• Checkpoint Firewall
• Qualis
• Nessus
• SDEE
• CISCO IDS Logs
Flow Data (netFlow, sFlow IPFIX):
• Router
• Switches
• Firewalls
Configuration changes
Product Specific
Log Formats
Database Connections
Windows Event Logs
Flat Files
SIEM Syslog
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Typical Customer Use Cases
Seite 44
Configuration changes
New network devices
Network and port scans
Brute force and suspicious
user activities
Unauthorized and
suspicious network
communications
Spread of malware
Unrestricted © Siemens AG 2018
Hardened LINUX with
Siemens own hypervisor to
run separated Virtual
Machines
Ruggedized design
• mounting on DIN rail
• no rotating equipment
• 24V power supply
3 LAN ports to separate different
networks:
• Production network
• Office/ DMZ network
• Remote service
Security receiver supporting
- Syslog, WMI, others
- Special automation data
forwarder from Siemens
Industrial SIEM 1) with local
dashboard to be used with a web
browser
• Correlation of events
• Notifications in case of alerts
1) Security Information and Event Management
Based on proven Siemens
hardware of IPC 427E
outlook: will be based on
Simatic Edgebox
SIEM Combo 500
Industrial Security Monitoring
SIEM Combo 500 – designed for your
industrial space
Unrestricted © Siemens AG 2018
Your way to protect your business in the
digital enterprise
Industrial Security Monitoring
Benefits
Transparency and fast reaction upon security threats
Correlation with OT-specific Threat Intelligence feeds
Real time and historical correlation of data which
enables, amongst others, checking if systems have
already been impacted by recently discovered threats (e.g.
zero-day exploits)
In line with standards and regulations like IEC 62443 and
acts to protect critical infrastructure
Developed for OT environments
Proven security technology and Trusted Site
Infrastructure data center for critical data
Extensive know-how for professional cyber security in
industrial applications
Unrestricted © Siemens AG 2018
Manage Security
for a comprehensive, always up-to-date
industrial security solution
Seite 47
Manage Security
means the continuous monitoring
and renewal
of implemented measures
through our centralized services)
Unrestricted © Siemens AG 2018
Manage Security
for a comprehensive, always up-to-date
industrial security solution
Seite 48
• Patch Management
• Security Vulnerability Information
• Anti Virus Management
• Industrial Security Monitoring*
• Remote Incident Handling
* upon request
Unrestricted © Siemens AG 2018
Patch Management
Managing critical updates in Microsoft
products
Seite 49
Customer’s challenge
• In 90% of attacks in 2014, old vulnerabilities that already had patches
available
were leveraged – some of which were more than decade old1
• Patches contribute toward stable system operation and/or eliminate
known
security vulnerabilities. Regular and prompt installation of patches
represents a
vital element of a comprehensive security concept
• Patching with an incompatible patch can cause unplanned downtimes
Common approach
• Customer has to release the Microsoft patches manually on a WSUS,
based on
Siemens SIMATIC PCS 7 compatibility excel sheet or
• No patching is performed at all or
• No WSUS server is used, but patches are downloaded directly by the
endpoints
• Other customer specific solutions (e.g. usage of 3rd party software) are
possible
Weak points of common approach
• Possibility of system disruption due to missing consideration of
compatibility
• Possibility of security incident due to obsolete patch status
• Possibility of failures due to manual work
• Need to manual check for updated excel sheet on Siemens Website
• Labor intensive process (monthly occurring)
Goal
Support customers by
testing SIMATIC PCS 7
with Microsoft security
and critical patches when
new patches are released
in order to check the
compatibility of the PCS 7
software with these patch
classifications2 and
providing metadata about
approved patches at the
customer site
1) Source © CNN Money 2) Only "Security Patches" and "Critical Patches" are necessary to ensure that
SIMATIC PCS 7 operation is secure and stable
?=X
Unrestricted © Siemens AG 2018
Our Solution Solution Architecture
The patch & vulnerability Management Service will
ease & automate the customers patch process:
1. Monthly patch release by Microsoft (Patch
Tuesday)
2. SIMATIC PCS 7 compatibility test
3. Release of patches on Siemens Master WSUS:
We will provide a central Update Server
(WSUS) that provides metadata about patches
that have been tested and approved for
compatibility with SIMATIC PCS 7
4. Medata information will be transferred to the
customer fully automated
5. Customer gets a notification, when new patches
have been released
6. Customer downloads approved patches directly
from Microsoft. Patch installation will be started
on-site
Patch Management
Managing critical updates in Microsoft
products
Central Siemens
Master WSUS
Distribution of
patch information
(WSUS
replication)
Microsoft
Update
Service
Download of Microsoft
patches
Master WSUS at
customer plant
Internal distribution of
Microsoft patches
Unrestricted © Siemens AG 2018
Solution Scope
Microsoft products:
• Windows 10, 7, Embedded, Server 2003 to 2012
• .NET
• Internet Explorer
• Office
• Office Excel Viewer, Powerpoint Viewer, Word Viewer
• SQL Server
For supported SIMATIC PCS 7 versions (V8.0 or newer)
For more details see SIMATIC PCS 7 compatibility list.
Our Solution
The patch & vulnerability Management Service will
ease & automate the customers patch process:
1. Monthly patch release by Microsoft (Patch
Tuesday)
2. SIMATIC PCS 7 compatibility test
3. Release of patches on Siemens Master WSUS:
We will provide a central Update Server
(WSUS) that provides metadata about patches
that have been tested and approved for
compatibility with SIMATIC PCS 7
4. Medata information will be transferred to the
customer fully automated
5. Customer gets a notification, when new patches
have been released
6. Customer downloads approved patches directly
from Microsoft. Patch installation will be started
on-site
Patch Management
Managing critical updates in Microsoft
products
Unrestricted © Siemens AG 2018
Patch Management
Benefits
Solution designed combining Security know how with
SIMATIC PCS 7 expertise
Reduce probability of wrong implementation of
patches and its consequences that might have
impact on plant availability
Timely release of patches after finishing of tests
(approx. 2 weeks after Microsoft patch day)
Fully automatic release of patch information
(only metadata, no automatic installation to avoid plant
downtime)
Reduction of manual work on-site
Managing vulnerabilities and critical
updates in Microsoft products
Unrestricted © Siemens AG 2018
Security Vulnerability Information
Management
Get transparency on increasing cyber threats
Seite 53
Customer’s challenge
• Every day new software vulnerabilities get reported
• Currently manufacturers and operators of automation technology with a
multitude of different software components struggle to identify if their
manufactured or used automation products are affected
Today’s solutions
• Manual checking of different web pages from providers of automation
technology (e.g. on the Siemens web page
https://www.siemens.com/cert/en/cert-security-advisories.htm)
• Customers need to compare the findings on these web pages against
their lists
of software components in their products or in the automation
environment
Weak points of today’s solution
• High manual effort and consequently neglecting already officially
reported
vulnerabilities
• Customers stay unaware of the real threat and consequently they do
not trigger
proactive measures (e.g. patching). In most cases action is taken after
an event
(e.g. new installation of a system after a ransomware attack).
Goal
Provide relevant security
informationen, to enable
manufacturers and
operators of automation
technology to proactively
manage their cyber risks
?=X
Unrestricted © Siemens AG 2018
Definition what software components to monitor
Notifications in case of detected
vulnerabilities and possible patches
Risk based management of
vulnerabilities
Security Vulnerability Information
Management
Realtime oversight on vulnerabilities and
patch status - realized
as a MindSphere App
Unrestricted © Siemens AG 2018
Anti Virus Management
Continuous virus protection for an up-to-date
defense strategy
Seite 55
Customer’s challenge
• Anti-virus programs protect against disclosed viruses, worms and
trojaner
• Regular and prompt update of virus patterns for the anti-virus program
and
continuous monitoring of the malware protection solutions represent a
vital
element of a comprehensive security concept
• An obsolete virus pattern status reduces enormously the effectiveness
of the
anti virus solution
Common approach
• No installed anti virus solution at all or
• Obsolete anti virus solution or
• Heterogeneous status of the installed anti virus solution in different
systems
Weak points of common approach
• Possibility of system infection due to obsolete virus pattern status
• Possibility of malware spread due to lack of monitoring of the anti virus
solution
• Labor intensive process in case of changes e.g. new systems
Goal
Support customers by
continuously managing
their McAfee anti virus
solution via central
management server ePO
for an up-to-date defense
strategy
?=X
Unrestricted © Siemens AG 2018
Anti Virus Management
Continuous virus protection for an up-to-date
defense strategy
Seite 56
Our Solution Solution Architecture
Anti Virus Management will ease and automate
the customers anti virus management process:
1. Taking care of the installed McAfee anti
virus solution
a) Maintaining the logical groups
b) Maintaining the ruleset
c) Deployment of the actual pattern files
d) Cyclic monitoring of the agent status
2. Adding or removing additional anti-virus
clients
3. In case of an alarm the alarm will be
transferred via e-mail to the customer
contact
4. Monthly report delivery
Management of ePO (central
management server) via cRSP1)
Production systems
with McAfee AV
client installed
ePO manages
AV clients on
production
system
ePO on
customer site
Alarms
via emails
1) cRSP = common Remote Service Platform
Monthly
reports
Siemens
Customer
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Management of a SIEM solution for the
customer…
Seite 57
Correct and protect
Implement Security and
Manage Security
Detect
Industrial Security
Monitoring Entry
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Transparency and fast reaction thanks to proactive security monitoring
Seite 58
• Industrial Security Monitoring uses Security
Information and Event Management
technology from McAfee
• SIEM is a log-file based solution to monitor
security status and identify threats and securityrelevant events
• Industrial Security Monitoring provides
continuous monitoring and analysis of shopfloor security from a local
or remote Cyber
Security Operation Center
• Fast alarming and reaction in case of threat
identification
• Monthly status reports
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Architecture and Components
Seite 59
LOG
Correlation
EVENT
Gathers events via different mechanisms, normalizes and
provides them
to central management console
Distributed as well as central log collection
SIEM Collector (Receiver)
EVENT
EVENT
EVENT EVENT
LOG
LOG
LOG
LOG
LOG LOG
LOG
Storage of all collected raw log data
Central & tamper-proofed archiving of log data
Automatic and manual realization of „retention periods“
Centralized Log Management (optional)
Central management of all gathered
events
Root-cause analysis
Creation of events after filtering logs
Creation of alarms and reports
Centralized Security Management

Analysis and
correlation

Advanced analysis platform
real-time
Historical analysis
Security Event Correlation
Devices to be monitored
LOG
LOG
EVENT
Unrestricted © Siemens AG 2018
Industrial Security Monitoring
Delivery from local SIEM for continuous &
proactive protection
0100010101100011001010011101001010010001
101101011001110101
00100010101100011001010011101001010010001
Discrete Manufacturing Process Industries
Security Correlation
and Management
Security Information
Collector
101101011001110101
Security Information
Collector
!
Unrestricted © Siemens AG 2018
Remote Incident Handling
Fast reaction upon security relevant threats
Seite 61 1) Source © GMI Research, Cebr Analytics 2) Source © Booz Allen Hamilton 2015
59% of companies admit that they suffered a
security incident in the last 5 years1
Manufacturing and Process Industries
estimated the
highest loss in revenue with 27.000 Millions Euro
due to
consequences of security incidents in the last 5
years1
44% of them were unable to identify the
source of the incident2
In a 2015 survey, 34% of Industrial Automation
and Control Systems operators indicated that
their systems were breached more than twice
in the last 12 months2
Unrestricted © Siemens AG 2018
Remote Incident Handling
Fast reaction to security relevant threats
Seite 62
• Root-cause analysis performed by Siemens experts for
industrial security
• Analysis of root-cause and criticality
• Report incl. suggestions how to clean the affected systems
Team of experts
• What shall I do with the system?
• What protects me for the future?
Unrestricted © Siemens AG 2018
Remote Incident Handling
Fast reaction to security relevant threats
Seite 63
• Done remotely
• Applicable for Windows OS (XP and newer)
• Core of the workflow is FERRET, a Siemens-own system for
root-cause analysis
of indicators of compromise in IT and OT environments by: