1.6.11 ICS network architecture When designing a network architecture, it is generally worth separating ICS networks from the wider corporate network. There is a difference in the type of data traffic that these two networks carry: internet access, FTP, email and remote access are generally permitted within the corporate network, but not within the ICS network. ICS data that is carried via the corporate network could be intercepted or exposed to DDoS or man-in-the-middle attacks. Separating the corporate network and the ICS network, or severely restricting connectivity, can minimise security and performance problems with the ICS network. 1.6.12 ICS network perimeter security The costs of installing an ICS and the need to maintain a homogeneous network infrastructure often mean that a connection is required between the ICS and the corporate network. This connection presents a considerable security risk, and should be protected by technical means. If the networks have to be connected, it is urgently recommended that only minimal connections are permitted (single ones, if possible) and that the connection is made via a firewall and DMZ (a separate network segment). ICS servers which receive data from the corporate network must be placed in a DMZ. External connections must be known, and limited to minimal access via the firewall. Data exchange can be monitored and subject to plausibility testing by means of additional systems which are able to detect anomalies. 1.6.13 Host security A further layer of security must be implemented at host or workstation level. Firewalls protect most devices against intrusion from outside. That said, a good security model requires multiple layers of defence. For the network to be comprehensively secured, all hosts must also be secured. This type of host security layer should allow a user to use a variety of operating systems and applications, while also affording the devices themselves suitable protection. Organisations should implement the following general recommendations for each ICS host and each device that has access to the corporate network. These apply irrespective of operating system: • Install and configure a host-based firewall • Use screen savers with short intervals and with a password requirement to log in, if possible • Operating systems must be patched and firmware kept up to date • Configure logs on all devices • Deactivate services and accounts that are not used • Insecure services, such as telnet, remote shell and rlogin must be replaced by secure alternatives such as SSH • Users should not be able to disable services • Make and test system backups, especially if they are not controlled centrally • Security modules provided by the operating system, such as security scanners, should be activated or replaced by suitable software • The same policy applies to laptops and other mobile devices which are not continuously connected to the corporate network. In addition, the hard disks of mobile devices should be encrypted. 1.6.14 Security monitoring The use of monitoring systems and network components which detect anomalous behaviours and attack signatures add further complexity to an IT or ICS environment. These monitoring and detection functions are vital to a defence-in-depth concept of protecting critical assets. An electronic boundary around an ICS network is not enough to protect those critical assets from unauthorised access. According to the defence-in-depth concept, a monitoring system should give an organisation an early warning of any security incident. Most organisations have a certain standard form of monitoring for their IT environment – but most do not have the same for their ICS networks. The following are essential: A set of password rules must be drawn up for all users on a system, and known accounts (such as ‘Administrator’) must be renamed. Users may circumvent restrictive password rules by keeping their passwords in a non-secure way (e.g. noting them down), or by repeatedly using similar passwords. The complexity of how passwords are determined should reflect the particular user’s level of authority. Password change cycles are another option here. • Conduct regular, thorough and independent audits of security status (critical business environments, processes, applications and supporting systems and networks) • Monitor information risks, comply with the security-related elements of legal, regulatory and contractual requirements, and report regularly to senior management about information security Minimum ICT standard 2018 11