MyAdvantech Registration

MyAdvantech is a personalized portal for Advantech customers. By becoming an Advantech member, you can receive latest product news, webinar invitations and special eStore offers.

Sign up today to get 24/7 quick access to your account information.

【Interview】Industrial Grade Embedded IoT Security Solutions

Date: 11/15/2018 12:00:00 AM

Interviewer │iThome   
Interviewee│ Jeff Liu, Director, Advantech Embedded IoT Division

Advantech cooperates with McAfee and Acronis to directly integrate active protection and backup recovery into the utilities it provides for industrial customers. Moreover, all OEM bundle software has been fully tested. Once adopted, it can be launched to provide the best possible security protection.

I.           For the semiconductor industry, what are some key aspects of production machinery security? What is your point of view and suggestions for potential improvement? 

The semiconductor industry is not the only industry facing security issues related to production machinery. Other manufacturing industries that are heavily reliant on automation processes also have similar security issues. 

  • If there are not adequate safety protection programs in place, then shutdowns, improper upgrades, or human error related to a single production machine can cause serious malfunctions for the whole factory. 
  • It is recommended that production machinery is regularly backed up when the system is secure and included in centralized management. Additionally, the machines should be actively protected from ransomware.    
II.         What are the basic protection items for machinery security? 

The deployment of active security protection and backup recovery systems are the most obvious ones.Complete security deployment for active machinery protection can be carried out along seven key areas: 

  • Using the application whitelist to prevent execution of unauthorized programs. 
  • Ensuring proper configuration and patch management. 
  • Reducing attack interfaces by shutting down unneeded ports and strictly controlling untrusted network connections. 
  • Building a defensible environment - mainly by using the network gateway for partition isolation to avoid horizontal propagation of intrusion. 
  • Managing user identity and authentication processes. 
  • Monitoring and responding rapidly to any issues that arise. 
  • Deploying secure remote access measures.

For backup and recovery systems, attention should be paid to the following points: 

  • Because machine operators are not IT engineers, basic backup procedures should be fully automated and require no human intervention. 
  • The entire recovery process of a single machine should be achieved by one-click recovery or UI operation. It can even be achieved through automatic reply to reduce human operation. This process effectively reduces system downtime. 
  • Recovery of operational machines for different systems by the same SOP reduces downtime and returns the system to a normal state as soon as possible.
III.           Using an existing situation as an example: Let us assume a semiconductor OEM company wants to provide a complete solution that avoids the same problems faced by TSMC earlier this year. The solution can involve their own products, or other companies' products, as long as it helps the company understand security protection practices as critical to the incident, as well as the corresponding actions before, during, and after the incident. 

  • Virus scan for new machines: If a virus scan is not conducted for new machines before the machines are connected to a network, what inspection operation procedures can a company carry out for new machines without involving supply chain management?  
1.         Ensure correct configuration and patch updates. 

2.         Perform virus scanning and application inventory management.

  • Machine protection: After a new machine is turned on, viruses can automatically infect other hosts. What can a company do to immediately detect or automatically block viruses? 
 1.      Ensure correct configuration and patch updates to avoid vulnerability attacks. 
 2.      Deploy an application whitelist to prevent execution of unauthorized programs and various viruses and malware. 
 3.      Deploy network IPS gateways to achieve instant detection and block the spread of infection.

  • Production intranet security: If a company's factories connect to the same production intranet, how can they best plan for security? By implementing an industrial firewall? Through an application whitelist?    
1.      The application whitelist is the last line of defense for industrial control equipment. 
2.      Network IPS gateways should be deployed between factories or network segments to instantly detect and block the spread of infections. Firewalls cannot detect various advanced threats.   

  • Disaster inventory and recovery: Regarding the inventory and recovery of the affected production machines, do you also have any solutions to help companies? What should companies do for themselves?    

Advantech's WISE-PaaS/EdgeSense edge intelligence and wireless sensing integration management solution provides companies with complete verification testing. Advantech also cooperates with McAfee and Acronis to directly integrate active protection and backup recovery into the utilities it provides for industrial customers. Moreover, all OEM bundle software has been fully tested. Once adopted, it can be launched to provide the best possible security protection. The enterprises do not need to separately purchase software and hardware, or spend time and effort on integration.

IV.           Regarding Windows and other operating systems, how can we find solutions that respond to the lack of computer vulnerability updates in the OT field? In addition, what is the proportion of machinery control computers on the market currently using Windows? What is the proportion using non-standard Windows? And using other programs?   

The WannaCry virus incident happened in August 2018. Microsoft released correction files against this virus for the entire product line right away in March 2017. Correction files for the Embedded version (WES7/WES8) were also released in May of the same year. Regularly maintaining machine security updates can help avoid security threats, especially major information security viruses. Advantech has signed a technical support contract with Microsoft to provide the most complete support, which provides immediate assistance if anything happens. At the same time, companies can avoid threats by turning off SMB1. For the network layer, companies can turn off the necessary ports through the LAYER3 switch and firewall. In addition, built-in Windows Defender is available for the newer versions of Windows. For older version of Windows, you can purchase and install industrial-grade active protection software, like McAfee and backup recovery software Acronis, from Advantech to strengthen machine security.

V.           Regarding problems with the machine main computer operating system, some people have pointed out that computer and network equipment used for semiconductor production is not directly controlled by the IT department. For example, although operating system machine suppliers have released correction files, personnel in charge of OT cannot install it by themselves, thus meaning installation and updating must be done by the machine supplier. Moreover, if suppliers do not provide support for old machines, how can we best ensure machine security?   

Vulnerability updates should be carried out in cooperation with equipment suppliers. For older machines, such as XP/Win 2000, they can be protected by the deployment of an application whitelist. If vulnerability updates cannot be performed on the equipment, whitelist protection should be deployed. Batch backup should also be regularly scheduled. These measures allow quick resumption of production after machine failure and/or an internal malicious attack.

VI.           In the case of handling security incidents caused by machines, taking TSMC as an example, their problem occurred on the evening of August 3rd. TSMC first responded around noon on August 4th (Saturday), made a second announcement at 3 p.m. on the 5th, and then held a press conference concerning the incident the following day. Was the contingency management fast enough? If a company faces the same incident and has to brief the public, what key details should be addressed? How do we evaluate and plan a successful external response? Is there any relevant reference information?   

Whether TSMC responded quickly enough is a matter of debate. However, the external response should focus on the scope of loss and damage control measures to demonstrate competent crisis management ability to the public audience. Effective crisis management measures can turn an incident like this into an opportunity for improved performance in the future.