An Overview of Cybersecurity Best Practices for Edge Computing

Overview

The paper starts from one premise: many edge sites multiply the number of network-connected endpoints and therefore the attack surface. Those endpoints are not just servers but UPS network cards, rack PDUs, cooling controllers and sensors. The strategy has four elements: device selection criteria, secure network design, device setup and configuration, and operation and maintenance. Physical security and insider threats are explicitly out of scope.

For device selection, vendors are expected to follow a Secure Development Lifecycle with seven phases: Training, Requirements, Design, Implementation, Verification, Release and Response. The reference framework is IEC 62443, organised in four parts; 4-1 specifies the secure product development process and 4-2 the technical security requirements for industrial automation components. Two broad selection criteria apply: support for secure protocols and the ability to implement role-based access control (RBAC).

On the network, the paper argues that air gapping gives a false perception of security and recommends a layered defence-in-depth design with three security zones and check points between the untrusted Internet and the trusted zones. Network-connected rack PDUs, cooling systems and power metering are named as critical infrastructure that must sit inside the same strategy.

In operation, delivered devices get port scans and vulnerability assessments, the vendor hardening guide is applied, unsecure protocols are disabled (for example by using TLS), and patches are tested before deployment. Penetration testing has five stages. The paper also stresses that OT environments put reliability and safety first, so scanning and patching must be coordinated with operators to avoid destabilising embedded devices.

Key points

1. The strategy has four elements: device selection, secure network design, device setup, and operation and maintenance; physical security and insider threats are out of scope.
2. The SDL has seven phases: Training, Requirements, Design, Implementation, Verification, Release, Response.
3. IEC 62443 has four parts; 4-1 covers secure product development and 4-2 the technical security requirements for components.
4. Two broad device criteria: secure protocol support and the ability to implement RBAC.
5. Air gapping is described as giving a false perception of security; layered defence with three zones and check points is recommended.
6. Network-connected rack PDUs, cooling systems and power metering are critical infrastructure inside the same defence strategy.
7. Commissioning: port scans, vulnerability assessment, vendor hardening guide, disable unsecure protocols, patch and test.
8. Penetration testing has five stages: planning and exploration, scanning, acquiring access, sustaining access, report.

Using it in design

• Give every network-managed infrastructure device (UPS card, rack PDU, CRAC/CRAH controller, BMS gateway, sensor) catalogue fields for TLS support, RBAC support, IEC 62443-4-2 certification (SL level) and SDL certification.
• Flag managed devices without secure protocol support on edge and remote sites.
• Model the management network as its own segment (VLAN or firewall zone), separate from the IT production network.
• Add port scan, hardening guide applied, insecure services disabled and firmware patched to the commissioning checklist, and use a cyber layer listing every IP-connected facility device to size the asset inventory.

Who should read it

Engineers designing edge data centres and OT security managers responsible for the network security of infrastructure devices.

Related standards

• IEC 62443-4-1
• IEC 62443-4-2
• IEC 62443-2-4
• IEC 62443-3-3

Publication details

Authors

Daniel Paillet

Publisher

Schneider Electric

Year

2021

Document number

WP 12

Document language

English

Source type

Manufacturer

Access

Free to read

Licence

Copyright retained; citation only — the publisher’s terms apply to the original document

Citation