Security
In the world of industrial automation and control systems, cybersecurity is a top priority. The integration of IT (Information Technology) and OT (Operational Technology) through SCADA (Supervisory Control and Data Acquisition) systems has significantly improved operational efficiency and data flow. However, this convergence also creates new vulnerabilities, making robust security measures essential. Understanding the importance of cybersecurity in industrial contexts involves recognizing various standards and regulations designed to protect these environments from cyber threats.
Security Standards and Regulations
Several cybersecurity standards and regulations have been established to address these vulnerabilities. These standards provide frameworks and guidelines to enhance the security posture of industrial systems. The NIS2 Directive, the EU Cyber Resilience Act, and IEC 62443 are all key components of the regulatory and standards framework for cybersecurity in industrial environments, but they each serve distinct purposes and have different areas of focus.
NIS2 Directive
The NIS2 Directive is a crucial regulation in the European Union aimed at improving the cybersecurity of essential and important network and information systems (NIS) within the EU. NIS2 is for asset owners of a plant providing essential or critical services in the EU. It sets high-level cybersecurity requirements and mandates compliance across member states. The use of WinCC OA as a software component is an important part for our end customers and WinCC OA integrators to meet the requirements of NIS2. Its overarching impact makes it the top-level regulation. Compliance with NIS2 is mandatory to avoid penalties and ensure secure operations.
EU Cyber Resilience Act (CRA)
The EU Cyber Resilience Act is an upcoming regulatory framework of mandatory cybersecurity requirements for manufacturers and retailers of products and software with a digital component such as WinCC OA. It emphasizes the ability to prepare for, withstand, recover from, and adapt to adverse cyber events and builds on the foundational requirements set by directives like NIS2.
IEC 62443 Standard
IEC 62443 is an international standard set by the International Electrotechnical Commission (IEC), specifically designed for the cybersecurity of industrial automation and control systems (IACS). The standard outlines a comprehensive IT security framework based on a multi-layered "defense-in-depth" approach. Organizations use these standards to meet the technical requirements imposed by higher-level regulations like NIS2 and national standards.
By complying with key standards like NIS2, the EU Cyber Resilience Act and IEC 62443, Siemens ensures that its SCADA systems, such as SIMATIC WinCC OA, provide robust security to safeguard industrial operations. It is acknowledged that while absolute security is unattainable, continuous adaptation and vigilance can provide a robust defense against cyber threats. This mindset is crucial in developing and maintaining effective cybersecurity solutions, especially in the industrial sector where SCADA and IT/OT systems are critical.
This chapter focuses on the security aspects of WinCC OA, exploring the challenges and best practices in safeguarding SCADA systems in an increasingly interconnected landscape. It will also provide references to the corresponding chapters of WinCC OA functionality that allows to secure your plants and projects against outside and inside threats.
Why Security is Important for SCADA & IT/OT Systems?
SCADA (Supervisory Control and Data Acquisition) systems play an essential role in monitoring and controlling critical infrastructure and industrial processes. These systems are often targets for cyber attacks because they manage vital services like power generation, water treatment, and manufacturing operations, where disruptions can have catastrophic consequences. Effective security measures prevent unauthorized access, data breaches, and malicious control, ensuring system integrity, availability, and confidentiality of the system’s data and operations. Additionally, robust security helps in maintaining public safety, protecting sensitive information, and complying with regulatory compliance. All these measures are essential for sustaining trust and operational continuity in critical industrial environments.
Security in WinCC OA
WinCC OA (Open Architecture) by Siemens is a flexible SCADA system designed to monitor and control industrial processes and to serve complex automation tasks. The open architecture of WinCC OA not only allows customization to meet specific industrial needs but also presents unique security challenges.
So how does WinCC OA make your operations safer and more secure? By using software that has been validated by a safety and cybersecurity authority. WinCC OA is the only SIL 3 (Safety Integrity Level 3) rated SCADA software package on the market and has maintained its SIL 3 certification since 2008. Additionally, WinCC OA is IEC 62443 certified for both 4-1 (Development) and for 4-2 (Product). ISA/IEC 62443 standards are a significant contribution to improving cybersecurity in the automation industry and help protect critical infrastructure from cyber attacks.
In summary, WinCC OA combines safety features, certification, compliance, continuous operation, and disaster recovery to create a robust and secure environment for critical industrial systems.
See Video: Top 5 things you need to know about safety and security in WinCC OA
WinCC OA Security Guideline
Our security guideline provides a structured framework for protecting the WinCC OA SCADA system against potential cyber threats. The guideline incorporates best practices, security policies, and procedural recommendations designed to fortify the system's defenses. By adhering to the WinCC OA security guideline, users and administrators of WinCC OA can ensure that their security measures are comprehensive and up-to-date, effectively mitigating risks to system integrity, data confidentiality, and operational continuity. The security guideline serves as an essential resource for maintaining the highest standards of security in the complex and evolving landscape of industrial automation.
See video: WinCC OA Security Guideline
Robust security with IEC 62443 Certification
Stand out in your industrial domain by using WinCC OA, a system compliant with the robust IEC 62443-4 security certification. Certifications are like the superheroes of the cybersecurity world. They’re all about trust and credibility and are earned through rigorous testing and checks. WinCC OA is IEC 62443 certified, for 4-1 (Development) and 4-2 (Product) standards. We make sure to keep up with the highest security standards by having external audits every 3 years. This security certification assures that your SCADA system is built on a foundation of trust and top-notch security, giving you and your stakeholders unparalleled peace of mind.
See video: Security Certification
Start Secure with Security by Default
Security by Default represents a proactive approach to system protection. Our built-in expert knowledge and Secure by Default configuration ensure that security measures are activated right from the installation. With secure defaults, you minimize vulnerabilities and streamline your setup process, avoiding the pitfalls of complicated configurations from day one. Use Security by Default as your starting point to establish a secure base for subsequent security configurations. For a detailed breakdown, we provide our comprehensive Security Guideline which guides you in adjusting your configurations.
See video: Security by Default
The Role of Certificates for Secure Connections
A certificate is a digital document that serves as proof of identity. It enables mutual authentication, ensuring that both client and server are verified, which is crucial for protecting sensitive data. Certificates have a limited validity period and need regular updates to ensure the highest level of security - just as you would renew your passport and change your passwords regularly. In WinCC OA, we provide certificates by default which are easy to work with and will help you to set up your environment quickly. However, in productive environments, customizing certificates is essential to match operational requirements and enhance security against unauthorized access and data breaches.
See video: Certificates
Password Policies and User Management
WinCC OA offers two robust password policy options and a range of integrated features to enhance security across your operational network. You can either use the WinCC OA password policy or work with users existing in an Active Directory. While Active Directory centrally enforces password policies and requires to manage just one single database, WinCC OA provides greater flexibility and is well-suited for smaller, local environments. Further integrated features include the implementation of Multifactor Authentication (MFA) and Single Sign-On (SSO), which contribute to efficient and secure user management.
See video: Password Policy
Enhanced Safety Standards
Safety is an essential aspect of industrial automation systems. Key points include IEC 61508 certification, emphasizing risk assessment and SILs (Safety Integrity Levels). WinCC OA provides safety support functions and can be used alongside safety-related systems up to SIL 3. Discover how safety is implemented in your WinCC OA project and the specific requirements that WinCC OA fulfills to achieve IEC 61508 compliance. Not to forget the benefits that WinCC OA Safety provides, including the elevation of your system’s quality standard and the simplification of certification processes for large systems requiring certification.
See video: Safety
Reduced Risk with Server-Side Authentication (SSA)
Authentication is a critical aspect of cybersecurity, ensuring that only authorized individuals, services, and applications can access company resources. Since version 3.17, SSA (Server-Side Authentication) has been the default authentication method in WinCC OA. This shift minimizes the risk of data breaches and strengthens overall security by centralizing user authentications: With SSA, the authentication process is performed on the server side, which means that not all user credentials need to be transmitted over the network at the beginning. Additionally, SSA offers enhanced scalability, allowing it to keep pace with your growing operational demands.
See video: Server Side Authentication
Multiple Security Layers with Defense in Depth
Defense in Depth is a holistic approach that utilizes multiple security layers to safeguard your WinCC OA projects. Think of it as a series of concentric circles, each reinforcing the other, ensuring that even if one circle or security layer fails, others stand ready to protect your critical operations. A single protection measure isn’t enough against today’s evolving threats. Therefore, we need additional layers by implementing a Defense in Depth strategy. This can be achieved through measures such as an Intrusion Detection System, a de-militarized zone (DMZ), System Hardening, or Access Control, among others. Further details can be found within the Security Guideline.
See video: Defense in Depth
Engaging Workshops and Additional Trainings
Capitalize on our hands-on workshops and additional training offerings to sharpen your skills and deepen your understanding of security configurations within SCADA systems. Watch our Security Videos Series for an overview on the topic.
WinCC OA certified engineers can take a deep dive and deepen their technical expertise on security topics in our WinCC OA Security Workshop. This four-day workshop is perfect to gain the technical expertise and skills needed to use WinCC OA in a secure network environment. The Workshop is your gateway to mastering WinCC OA security methods!
See video: Security Workshop