Siemens Industrial Security

Name
Siemens Industrial Security
Short description

Industrial cybersecurity laboratory composed of 4 scenarios: - Discrete industry - Process industry - Telecontrol - Secure remote access system

Photos of the laboratory
Description

The mission of the Siemens Cybersecurity Laboratory is to provide a holistic Cybersecurity concept by offering comprehensive protection based on our "Defense in Depth" model, to help our clients face new challenges and to stay safe while protecting their productivity.

The concept is based on three pillars: plant safety, network safety and system integrity, according to the recommendations of ISA 99 / IEC 62443, the main safety standard in industrial automation.

For Siemens as a great expert in the OT world, Cybersecurity means protecting the systems and machines that are used in production.
This means that, on the one hand, what the authorities demand must be done, but on the other hand we must take into account and be aware that we are exposed to real threats in our business. Threats to which we must face and of which we must defend trying to get cyber-resilient systems.

There are four main reasons to provide protection for production systems and machines:

  • Protection of availability and productivity
  • Protect the integrity of finished products in itself
  • Protection of intellectual property implemented in these systems and machines
  • Protect the reputation

In the laboratory is composed of four well differentiated scenarios:

  • Scenario of a Discrete Industry - based on PLC's and SCADA
  • Scenario of a Process Industry - Based on a distributed control
  • Telecontrol scenario - with SINAUT protocols, IEC 60870-5-104, DNP3, IEC 61850, ...
  • Secure remote access system

In all of them, we provide these scenarios with the corresponding Patching, User Management and Backup Management systems, for the servers and the network infrastructure necessary for the correct implementation of the highest levels of industrial security, without forgetting the installation of DMZ's , for the interconnection of the OT network with the IT network of the factory.

Legal Status
Private
Economic condition
Payment service
Address
C/ Ronda de Europa nº 5 28.760 Tres Cantos (MADRID)
Location
Tres Cantos
District
Madrid
Sector - Subsector
Chemical IndustryStorage
EnergyElectricity
EnergyGas
EnergyHydrocarbons
Food
Other
Research Installations
TransportAir
TransportMaritime
TransportRailway
TransportRoad
WaterReservoirs and dams
WaterWater treatment
Otro sector
Automotive, Pharmaceutical, Fiber and Paper, Cement, Metallurgical, Logistic, Aeronautical and Naval
Services

There is a physical laboratory where the cybersecurity solutions applicable to different industrial environments are implemented for analysis.

Consultancies are carried out to solve the real problems of automation, communications and industrial cybersecurity following the applicable policies in each of the countries of destination and according to the best practices.

Among them we can highlight:

  • Guidelines - High-level statements that show concern for cybersecurity and provide a charter for organizations and individuals.
    • OECD Safety Guidelines, etc.
  • National Strategies - Often based on guidelines, these documents articulate an approach to cybersecurity adapted to a specific national or legal context.
  • Frameworks - Bringing national strategies one step further, frames of reference bring together a catalogue of prioritized or evaluated resources that help organizations compare their maturity and the progress made in addressing cybersecurity risks.
    • Cybersecurity framework of the NIST (National Institute of Standards and Technology).
    • DHS: Department of Homeland Security including USCERT and ICS-CERT.
  • Codes of good practices
    • Documents that guide or govern the organization processes to ensure a robust and consistent operation of the best cybersecurity practices.
    • Roadmap to guarantee control systems in the energy sector: document outlines a plan to improve cybersecurity in the energy sector (https://www.energy.gov/sites/prod/files/oeprod/DocumentsandMedia/roadmap.pdf).
    • Roadmap to guarantee control systems in the chemical sector: document outlines a plan to improve cybersecurity in the chemical sector. 
  • Regulations - Detailed specifications for the implementation of cybersecurity that meet certain types of interoperability requirements
  • Standards:
    • ISO/IEC serie 27000 (27001, 27002, 27032)
    • ISO/IEC serie 15408
    • IEC TS serie TS 62351
    • NERC CIP: NERC Standards CIP-002-3 through CIP-009-3 provides a cybersecurity framework for the identification and protection of cyber critical assets to support reliable operation of the electrical system.
    • WIB Report: M 2784 - X-10, version 2.0: This document specifies the requirements and gives recommendations for the safety to be met by the suppliers of control systems and process automation which are to be used in process control domains ( process control domains "PCDs").
    • IEC 62443 / ISA-99: Reports on a series of standards and techniques on the subject of industrial automation and control system security.

The laboratory offers our clients the possibility to test and train with the concepts and configurations that we teach in our special courses of Industrial Networks and Security (CEIN and CPIN certification programs) as well as in the industrial systems training.

For more information, consult:

Industrial Networks and Security:

https://www.siemens.com/industrial-networks-education

Industrial systems:

www.siemens.es/sitrain

 

From Siemens, we offer three types of Cybersecurity assessments:

  • Audits based on ISO 27001
  • Audits based on IEC 62443
  • Risk and vulnerability audits

For the laboratory, we have chosen to use the audit linked to the IEC 62443 industrial standard as a basis, the tasks to be performed are:

Definition of the level of maturity you want to reach in the laboratory. Based on the level of maturity, we will perform an audit based on IEC 62443 3-3 "Security for industrial process measurement and control - Network and system security". Derived from the results obtained, we will apply the necessary measures to comply with the regulations.

In the laboratory, cybersecurity solutions are developed in response to real threats detected by our customers, verifying the viability of the different systems and ensuring the availability of industrial facilities.

The solutions are adapted to different sectors fulfilling the necessary requirements for each type of industry.

Physical components available

Didactic panels based on 4 scenarios:

  • Scenario of a Discrete Industry - based on PLC's and SCADA
  • Scenario of a Process Industry - Based on a distributed control
  • Telecontrol scenario - with SINAUT protocols, IEC 60870-5-104, DNP3, IEC 61850, ...
  • Secure remote access system - based on our SINEMA Remote Connect software

We have not only SCADA (WinCC, WinCC OA and PCS7), but also different service panels, as the first human-machine interface when interacting with the industrial process.

  • PLCs: S7-1200, S7-300, S7-400 y S7-1500
  • Distributed control:  PCS7
  • Distributed peripheries: ET200SP, ET200MP
  • RTUs: RTU30x0C and RTU’s based on PLC’s
  • Industrial PCs
  • Industrial switches: SCALANCE X (XC200, XM400, XR500 …) and RuggedCom
  • Firewalls: SCALANCE S and SC y NGFirewall
  • Routers: SCALANCE M (ADSL, GPRS, 3G y 4G).
  • Industrial Wireless: SCALANCE W
  • Industrial TAPs: SCALANCE TAP 104
  • Wireless in Industrial passive components: cables, RJ45 / M12 connectors, …
Software components available
  • SIMIT
  • PROFINET traffic generators (Simulation Unit)
  • COMOS Walkinside
  • SINETPLAN – Network traffic load scheduler
  • Win CC
  • Win CC OA
  • PCS7
  • SINEMA Server – Network monitoring and management system and automation system

TIA Portal.

SINEMA Remote Connect – remote VPN connection management software.

  • Anti Virus - Installing antivirus through a console on industrial PCs
  • Windows Patch Server - Installing WSUS with the patches applied to PCS7 and WinCC systems
  • Management of antimalware console - Update of .DAT, alert management, deployment of new agents, …
  • Windows automatic patch management - Siemens validated patched for PCS7 and WinCC solutions
  • Application Whitelisting - Installation of whitelisting tool through a console in industrial PCs
  • System back-up - Storage of the back-ups
  • System for the acquisition of security status files (SIEM) - Solution for the future implementation of SIEM
  • Hardening of devices - Bastion functions of systems and software. (PLC, CP, industrial PCs, communication elements, ...)
  • Industrial anomaly detection - Implementation of and anomaly detection tool in industrial networks
  • Vulnerability management (mindsphere) - Vulnerability notification of systems installed in the laboratory through the SVI mindsphere tool