Powering Risk-Free OT/IT Communications
The Cybersecurity and Infrastructure Security Agency (CISA) recently released guidance focused on securing Industrial Control Systems (ICS) to help protect U.S. critical infrastructure and maintain national security. The guidance identifies eight focus areas and recommendations on ICS network architecture and perimeter security. Network architecture and perimeter security recommendations establish the need for implementing a segmented, multi-layered network architecture and the establishment of a DMZ to secure the ICS infrastructure. Instead of firewalls, the recommendation specifically calls out the use of one-way communication diodes where possible to prevent external access. Firewalls can play a role in a defense-in-depth strategy, but they should not be your only line of defense.
The Fallibility of Firewalls
Firewalls are prone to misconfiguration and human error, which will compromise your network segmentation strategy and leave your infrastructure prone to attack. As a result, firewalls must be continually monitored and kept up to date, leading to significant recurring operational costs as well as high compliance reporting costs.
Unlike firewalls, data diodes or unidirectional gateways are designed to enforce one-way data flows, which creates a highly secured perimeter around critical assets. Originally designed for military applications and used to secure data transfers between networks of different security classifications, data diodes have gained acceptance in critical infrastructure markets over the past decade. Diodes are used to enforce a secure perimeter between lower ICS layers and the DMZ and are designed to replicate data from the ICS to the DMZ and high layers.
Firewalls can be complex to configure, operate and prone to security vulnerabilities. This is highlighted by the many CVEs continually published by the major firewall vendors, a cumulative number of nearly fifty (50) published security bulletins, several of them critical, including Apache Log4j exposures. To solve these challenges, an entire tech category has arisen dedicated to firewall streamlining and automation of firewall operations, including Algosec, Tufin, Skybox and others. Unidirectional security gateways are thus an important component to enforce one-way communications.
Unidirectional Security Gateway or Data Diode?
While data diodes are designed to provide excellent “air-gap” level security, their architecture results in data reliability issues. The source side of the data diode cannot detect the operational status of the destination side, nor can it know the availability of the destination network or endpoint. If the destination network is less than ideal or the endpoint is not available, the source side of the data diode will continue to transfer data, resulting in data loss and synchronization issues. In an attempt to overcome these issues, data diode vendors have implemented data retransmission, which consumes network bandwidth and doesn’t fully alleviate data loss. As the volume of data shared between OT and IT continues to grow, the operational cost of data diodes due to data loss and synchronization issues will become a growing financial burden to industrial operations.
Reliable and Secure Data Transfers with NetWall
OPSWAT’s NetWall Unidirectional Security Gateway was architected to address these limitations. NetWall enforces unidirectional data flow and uses a non-routable protocol between source and destination servers, complying with NERC CIP and other standards. Through its patent-pending assured delivery architecture, data is reliably transmitted to the destination without requiring retransmission or a periodic data backfill operation. NetWall also supports data throttling, meaning data is reliably delivered even if there are intermittent network issues, this makes NetWall an ideal solution for real-time monitoring of industrial assets and for securely connecting OT data to cloud-based resources.
NetWall is highly scalable, supports a wide range of industrial protocols, and is easy to deploy. Once racked, NetWall can be configured and made operational in under an hour. After it’s configured, NetWall runs headless, further enhancing its security profile. OPSWAT designed NetWall to meet the growing demands of OT/IT convergence, providing more security than a firewall and more reliability and cost effectiveness than a data diode.