{"id":1528,"date":"2017-09-26T09:03:13","date_gmt":"2017-09-26T08:03:13","guid":{"rendered":"https:\/\/netcloudengineering.com\/?p=1528"},"modified":"2019-09-19T08:41:08","modified_gmt":"2019-09-19T07:41:08","slug":"seguridad-protocolos-comunicacion-industrial","status":"publish","type":"post","link":"https:\/\/netcloudengineering.com\/en\/seguridad-protocolos-comunicacion-industrial\/","title":{"rendered":"Protocol Security in Industrial Communications"},"content":{"rendered":"

The protection of systems is key to maintain the security of protocols in industrial communications,,es,, so that our information and our exchanges of data are always safe. We tell you today how to improve that security.,,es,What resources do we have to maintain the security of protocols in industrial communications?,,es,We can divide into 5 blocks the types of tools and resources that can be used to,,es,maintain security in an industrial communication,,es,Simulation of master \/ slave environments,,es,The master \/ slave architecture is the most common in industrial communications,,es,. There are tools that:,,es<\/b>, so that our information and data exchanges are always secure. Today, we'll show you how to improve that security.<\/p>\n

What resources do we have to ensure the security of protocols in industrial communications?<\/h2>\n

We can divide the types of tools and resources that can be used to into 5 categories: maintaining security in industrial communications<\/strong>.<\/span><\/p>\n

Simulation of master\/slave environments<\/h3>\n

The master\/slave architecture is the most common in industrial communications<\/strong>. Hay herramientas que:<\/span><\/p>\n

They allow to simulate slave devices with the OPC protocol functionalities. Its functionalities allow load tests and even tests of OPC servers to find the best configuration.,,es,You can also modify the values \u200b\u200bthat the Modbus variables have between RTU and SCADA \/ HMI.,,es,Some allow to incorporate noise to the transmissions.,,es,There are also tools that work exclusively as teachers. There are some to do simulations and others that work directly as applications.,,es,For zero simulations, you must have access to software that works on both ends that allows tests to be carried out with the same group of tools.,,es,Tools that analyze traffic,,es<\/span><\/p>\n

You can also modify the values of the Modbus variables between the RTU and the SCADA\/HMI.\u00a0<\/span>Some allow you to add noise to transmissions.<\/span><\/p>\n

\"Protocolos<\/p>\n

There are also tools that function exclusively as teachers. Some are designed for simulations, while others function directly as applications.<\/span><\/p>\n

For zero simulations, you must have access to software that works at both ends, allowing tests to be performed using the same set of tools.<\/span><\/p>\n

Tools that analyze traffic<\/h3>\n

When you simulate an environment or you have access to traffic captures, you have to analyze it.,,es,The analysis is important when it comes to observing how global behavior is in complete environments, so that we can consider the,,es,integration of industrial network security mechanisms,,es,such as IDSs, firewalls ...,,es,With the tools of this type, data collection is obtained, such as the DCOM settings, the operating system version used, the DEP configuration or information about the network settings that allow checking problematic areas.,,es,There are also those that register the client-server activity, so that certain interoperability problems are isolated.,,es<\/span><\/p>\n

Analysis is important for observing overall behavior in complete environments, so that we can consider the Integration of Industrial Network Security Mechanisms<\/em><\/a> such as IDSs, firewalls\u2026<\/span><\/p>\n

Tools of this type allow you to collect data such as DCOM settings, the version of the operating system in use, DEP configuration, and information about network settings, which can help identify problem areas.<\/span><\/p>\n

There are also systems that log client-server activity, thereby isolating certain interoperability issues.<\/span><\/p>\n

Information gathering,,es,It is also interesting to get information about discoveries of devices and that obtained from network scanners.,,es,Of course, it is very important to monitor how a general tool of this type is working because, since it is not designed for a system, it can interact negatively with it.,,es,Tools that protect systems,,es,Physical security is as important as everything else,,es,, therefore, some tools for the protection of systems and devices must also be included.,,es,Linux,,en,we have Modbusfw, an iptables module that filters the traffic at the application layer level in a way that protects the systems that use Modbus \/ TCP protocol.,,es<\/h3>\n

It is also interesting to gather information about device discoveries and the information obtained from network scanners.<\/span><\/p>\n

That said, it's very important to monitor how a general-purpose tool like this performs, since\u2014because it wasn't designed for a specific system\u2014it may interfere with it.<\/span><\/p>\n

\"Ciberseguridad<\/p>\n

Tools That Protect Systems<\/h3>\n

Physical security is just as important as everything else<\/strong>, therefore, certain tools for protecting systems and devices should also be included.<\/span><\/p>\n

In Linux<\/a> We have Modbusfw, an iptables module that filters traffic at the application layer to protect systems that use the Modbus\/TCP protocol.<\/span><\/p>\n

The IDS \/ IPS supervises the Modbus \/ TCP, EthernetIP, DNP3 and similar protocols. Thus, they allow the sending of data packets in uncontrolled IPs or the use of non-permitted functions to be recognized.,,es,For networks with wireless communications,,es,, a set of tools that perform various security tests such as traffic decoding, identification of devices or reinjection of frames.,,es,More security tools,,es,To complete a good,,es,security audit of communication networks,,es,, other generic but effective resources that work the intrusion tests are used. Some are:,,es,Metasploid,,en<\/span><\/p>\n

For networks with wireless communications<\/strong>, a set of tools that perform various security tests, such as traffic decoding, device identification, or frame re-injection. <\/span><\/p>\n

More security tools<\/h3>\n

To complete a good communication network security audit<\/a>, other generic but effective resources are used that focus on penetration testing. Some of these are:<\/span><\/p>\n