How To Sign Louisiana Banking PDF

How to industry sign banking louisiana pdf later

good morning everyone thank you for joining us as we wrap up our Tech Talk series on industrial networking this is part six we will be discussing securing the industrial control systems network with SIP security so I'm Brandon Singh I will be your presenter today on the line with me I do have some panelists who will be monitoring the chat and Q&A trend questions or comments yes I want to throw in there floors I have drove Valesky who's an automation specialist network specialist with the Reynolds company out of Houston mark McGinnis who's been automation specialist out of the DFW area with the Reynolds company and I have complained welke who is a automation specialist with the Ranas company out of New Orleans so just some upcoming events that we have coming up online with the Reynolds Burt Reynolds company we have our users group in July July 16th are you just root for a little bit longer than our Tech Talks or Tech Talks your designed to be 25 to 30 minutes our users group sure use about 45 minutes to an hour to go a little bit more in depth and our next one coming up is in July on the 16th we'll be discussing the my rockwell automation portal and the software portal some upcoming tech talks we have coming up we have tomorrow we have interesting safety barriers with a 931 and then the following Wednesday on the first we will be discussing automatic device configurations with power flip drives and then we have also started a podcast that you can find on all your major streaming services Apple music iTunes Spotify Google music play music will we need discuss different data and automation topics and in the industrial plant floor we have a new one dropping this week so today we'll be discussing a security protocol defense-in-depth agenda that we'll be running through specifically why do we care why do we need security what does it do how are we implementing it how to approach it in phases and then we'll wrap up with the Q&A at the end so why do we care for several years we have been talking about the value provided by a defense in depth architecture of the CPWD and this is still a very good recommendation we've won on everybody to implement it as best they can but it's no longer good enough securing security researchers have found that critical that criticized industrial control system communication protocols of the past profie net Modbus Ethernet IP for their lack of several key security prior priorities the most important one is sensitive authentication on messaging and security giving a very integral part of data and if you know we don't have proper identification that it can't be changed it also sip security offers the advantage of being confidential and it solves the problem by adding these priorities to Ethernet IP and allowed to solve allow the automated automation devices to defend themselves so these are the three different ways that a hacker would attempt to steal some data from the plant floor direct connection they directly connect to an oak port or that they find on the device floor whether it be inadvertently someone just plugs in their phone our you know or they inadvertently plug in their laptop not or they're doing it on purpose or we have what we have call man-in-the-middle attacks where someone attempts to hack into the network and steal the messaging as it's being transferred back and forth or we have the last one for the monitor in the data where somebody is just active looking at your data as a traffic's being sent across so secure communications what sips sip security protocol actually provides is a severe secured transported messaging across your Ethernet IP network it was developed by OD VA formerly known as the open device that vendors association and specifically what it does is it rejects messages that are sent by untrusted people are untrusted devices or an untrusted source it helps prevent viewing of ethernet/ip data by unauthorized parties keeping everything confidential and then it reinforces the defense-in-depth strategy by providing multiple layers of security against a more resilient attack and each layer adds upon the one before it so here are basically that that layer security that the SIP protocol puts in place a device identity their digital certificates that are provided to security of each device so you know the specific device is supposed to be sending you messages you have device with medication this is done through transport layer security TLS and it's also done through Datagram transport layer security DTLS these protocols are used to help secure the the message as it's being moved across the network dating integrity that's done through key hashed message authentication code also known as H Mac again that's another method of providing data integrity and securing the message that it's only being authorized to be opened by specific devices and that also goes on to the next layer data confidentiality again that's encrypting the data encoding the messages with specific codes that your that is tagged to the message to that when it's received by the end device it knows specifically this was sent by the correct party and it's allowed to open it because it knows the code that it's looking for and if it doesn't see that code it's not allowed to open it doesn't open the message so how you know leveraging technology to provide how this is done it is almost identical as you see on the graph after the right to when you're going to banking websites or any trusted secure website where you have to log into that website you always get that little lock on your web browser bar at the top of your address bar so we put that on to the right to show you that you know all your major internet platforms you're using it and how it works is you the client device it sends out a message that says hey I need to set up an encrypted session whatever it's reaching out to sends back a code key which is the access the code in the messaging it sends a response back saying I would like to see your certificate and and again it's a commute secure communication back and forth to establish and create that code for authentication to read the messaging before the messaging is already sent and you see that that's explained in the diagram on the left with all the different errors going on so here on the bottom security protocol is enabled and something can be used on the current devices factory talk links control logics 5580 1756 and 40 our power flex of 55 t drives kinetics 57 drive-in 700 and security proxy which is something we would use and for secure applications such as your frederick talk activation manager that reaches out to Rockville's website to get product lifecycle updates and see if something needs to be updated with that we've discussed in earlier type talks as for our securing via the cloud and all those devices again go into protecting identity integrity confidentiality through the SIP protocols so identity authentication so specifically here what we're looking at is we're looking at factory talk links and the communication to the seventeen fifty six and forty are as I communication and sent back across as I said it it looks to establish the connection and the key so both parties know the code and the key to unlock that code so we can actually read the encrypted messaging and it's through secured a lot of traffic so one way attack that a hacker might be looking to retrieve that information that's being sent across as we said earlier directly connect to your 17:56 however when he connects to it he's unable to actually look at the messaging being sent across because he doesn't have the appropriate certificate code keys to look across so he sees the traffic being sent but there's nothing he can do about that traffic so when the hacker tries to send a command to the controller it wouldn't work he wouldn't be able to send in traffic any type of command to the controller or send false messaging back to your factory top links because it doesn't have the appropriate identification codes and that was established between factory talk links and your 17:56 in 4tr so another way this is established as I said with that messaging is through H Mac or hash hash message authentication code the message is first hashed as I said to provide integrity it's a secure key that is established added to the message before it's hashed to provide the authentic authentic ation of who was sent from you can't validate the message unless you know the secret so unless you know the specific key to decrypt the message exactly be able excuse me second do you any good it's very fast it's an efficient with only minor very very minor performance implications to set this up another way that's it protocol to help secure the plant floor is through integrity now you have a hacker who's not able to modify data however it can still view the data which is why we put in the integrity please peace so it helps prevent tampering or modifying the communications as I said you know the first part helps from changing any of the data but he's still able to see it the integrity portion helps with that the encryption by encrypting the message that way it's encoded messaging information to help prevent the reading or reviewing it so now with the integrity portion of it he can't alter the message anyone be able to view it now it's completely optional not all CS not all ICS traffic contains secrets that need to be safeguarded dagger data integrity and authenticity is typically the goal but this is an added encryption that will impact data throughout the input performance and the last one is confidentiality it helps prevent the snooping and disclosure of the data so with implementing all three of these pieces that hacker is then rendered useless and not able to get to the information on the plant floor that's being sent as messages across so what exactly am i securing was it security protocol oh you're securing the Ethernet IP port itself dual IP ports can contain different security configurations as you see you have on that diagram is showing the 170 to 300 IP address on that port is secure which is why it's green and you have your lock just as you would on your internet browser but your other port your one 92168 port and this diagram is rendered unsecure which is why it's showing red so just an overview of security protocol as I said it provides authentication helps prevent unauthorized devices integrity helps prevent tampering and modification of communications confidentiality helps prevent the snooping and disclosure of data it is system management it's easily be easily to create and deploy security practices to many devices its micro segmentation your automation appliance application to just smaller difference to smaller zones so if it's a specific zone where it has that it needs to be more confidential in a different zone you can implement that differently in the different zones it's a device based firewall so you're able to enable it disable it on different ports and protocols very similar to setting up a firewall and to go out to the Internet making sure you can't go to a website that requires HTTPS which is where you get the lock on your web browser and then a regular web browser where you get your HTTP where your web browser doesn't have a lock it does have likely legacy system supports so trusted IP authorized specific communications and IP addresses and we can retrofit 17:56 based on systems with the new 1756 in 40 our so configuration how would you configure sip security so we're going to manage sub security configuration from a central authority point in this picture you can see the authority Authority is responsible providing device with secure identity and its policy in this example the policies is a simple way to tell the devices who they should trust and who they shouldn't so in specifically we're using factory talk policy manager software at your computer at the top of the diagram and then do the factory talk system services platform policy you're able to push that down to your workstation on the plant floor your switch all the way down to your drive and your HMI and you can break this off in two zones so you know that this zone of your plant is connected in secure ending and encrypted and all security changes our first configured using a security configuration tool and then distributed from a central authority to the affected devices this dramatically reduces the chance for human error by allowing this concern really security configuration to be modeled or molded and deployed consistently to all devices without any changes and once it has been deployed your factory Park policy manager and the factory talk system search platform are no longer required so once it's deployed you no longer need to have those continuing to run unless you're adding more changes to be made but if you're not if you're not adding anything then you no longer need those things to run in place it'll continue to run itself with the secure setup that you put in place so this is a sample deployment this will follow the same this follows the same setup as we just discussed where you your factory talk policy manager software and your system services platform at the top and you use those to push out to the trusted nones at once done these are three zones that you would set up on this deployment ring off to the right you would then have your PC zone where you have your studio 5000 software your factory talk view software and then you have your two zones down on the plant floor for the different areas they're calling it conduit one in conduit to but you have different security implementations in place for each zone or line or in this cases are labeled convert one in conduit to that you put place specifically for what could communicate with what and it's secure traffic as well as that segmentation that we're all looking for and some things to be aware of on the initial release sip does not support protocol bridging so you can't configure subsidiary through a sip bridge it does not support high availability it does not support net network address translation or NAT unless the map is used Matt to a public IP address that does not just support automatic device replacement or ADR and supports only one Nick if multiple Nick's are available and the factory talk links software so some use case scenarios it's a secure configuration controller computers to controller to computer secure the inbound connection via 1756 and 4tr module or control logics 5580 controller itself again at the top you have you have all the locks of top between your factory tog review studio software in your studio 5000 and then as you move down again it's all secure communication to the controllers into the HMI as it's why it's all in green and you see the green box so as far as the release schedule available now is your factory talk policy manager software and your factory talk Services Platform version 6.0 or later your control logics 2580 controller is available now your 17:56 in 40 our control logic communication modules available now as is for kinetics 5700 turbo drive upcoming as a sip security proxy original target was 443 2020 I believe that's been pushed back a little bit through covin and the powerflex 755 T Drive was targeted for q3 of 2028 this year so here are some white papers and design guides that were recently released regarding sub security with within the last month by Rockwell that goes over everything more in depth on design implementations and white papers on how the best architects of security and to see pwe architectures do we have any questions in the chat how do you not see any questions in chat Thank You Marc thank you all for joining us for this and if you have any questions regarding security please reach out to any of your automation specialist or network specialist in your area whether that be southern Louisiana or in Texas whether it be Wayne Joe Marc or myself we look forward to helping you and thank you for joining us