Designing Secure and Effective Industrial Control Networks

The IT/OT convergence is inescapable in the modern industrial market. Here’s how to optimize performance while maintaining a secure network.

By: Damon Purvis, Alexander Maercz, and Winn Paulk; AutomationDirect

For decades, the operational technology (OT) networks responsible for industrial controls were kept separate from IT networks. The approach protected critical industrial operations from vulnerabilities introduced by the broader enterprise network. No longer. The modern focus on digitalization and data-driven insights means that manufacturers are increasingly connecting machines, drives, remote I/O, and HMIs with SCADA systems, data historians, MES platforms, and cloud services. Making OT data accessible is fast evolving from competitive advantage to table stakes. And the push toward the connected factory has only been accelerated by the emergence of AI. The challenge lies in finding a way to maintain a robust, deterministic, and secure industrial network in the face of this OT/IT convergence. Fortunately, with proper network design and implementation, it’s possible to ensure performance and security while supporting the network access and data-exchange mandates.

Choosing a Protocol

As in all types of engineering, the choice of hardware and software is driven by the needs of the application. Start by determining the communications model:

• Point to point: One device communicates with another.
• Master/slave or client/server: Master or client device polls subsidiary devices or pushes down commands.
• Scanner/adapter: Scanner (e.g., PLC) manages I/O connection to adapters (e.g., field devices) that exchange data with it; the scanner sets the update rate (requested packet interval) for the cyclic I/O data exchange.
• Publish/subscribe: Devices publish data to a broker, while other devices subscribe to receive it.

The next step is to decide which protocol best fits the job. The most common options are real-time Ethernet (e.g., Ethernet/IP, ProfiNET, etc.), Modbus TCP, MQTT/MQTTS, and OPC UA. The table below provides general guidelines for matching application to protocol.

Table: Industrial communications protocols

Optimizing real-time Ethernet for an industrial environment

Although real-time industrial Ethernet protocols can be very effective, they can cause problems with networks running protocols such as Modbus TCP, MQTT, and OPC UA. Issues can be avoided using the following techniques and tools.

Quality of Service

The Ethernet protocol is based on “best effort” transmission, with all connected devices having equal opportunity to send data. In the event of data collision¾two devices transmitting data packets simultaneously¾one randomly selected packet gets delayed by a few milliseconds. This isn’t a problem for print jobs and videos but it’s unacceptable for highly synchronized industrial operations. The solution is to prioritize time-critical commands using a network switch functionality known as Quality of Service (QoS).

In QoS, the switch orders incoming data packets based on criteria like type (e.g., voice calls, video streaming, or file transfers), source, or destination. This prevents data logging, for example, from taking precedence over motion commands. When properly executed, the QoS approach can boost efficiency by reducing latency, jitter, and packet loss for time-critical applications. Take care when applying network prioritization, though. If you designate Ethernet/IP as a high priority protocol, the switch is automatically going to slow down anything that’s designated as lower priority. That could Impact communications with legacy devices and HMIs.

IGMP snooping for multicast-heavy networks

The Internet Group Management Protocol (IGMP) offers a way to prevent multicast traffic from overwhelming the network and devices. Instead of broadcasting traffic to all devices on the network, a switch can be auto configured by IGMP to send only to certain devices/ports. Subscribing a device to a multicast group triggers an IGMP message. Because the switch “snoops” on the IGMP traffic, it is then automatically configured to route traffic on a packet-by-packet basis only to subscribed ports. Ports can be unsubscribed at any time.

Improving performance with network segmentation

For decades, OT networks were “air gapped” from IT networks to prevent unauthorized access and minimize interference and vulnerabilities. In our modern data-driven era, however, it is no longer practical to physically isolate machine networks from the rest of the facility. Instead, they should be logically isolated in virtual local area networks (VLANs).

Switches with VLAN functionality can be used to segment the network into multiple logical subnets by including only designated ports and blocking the others. Segmentation limits port traffic to improve network efficiency and minimizes risk (more on that later).

When implementing network segmentation, don’t stop at simply separating IT and OT networks. In larger OT systems, consider dividing the OT network into smaller logical zones using subnets and VLANs, such as by machine, production line, cell/area zone, or function. This can reduce broadcast traffic, improve troubleshooting, and help keep high-bandwidth systems like machine vision, SCADA, or data collection traffic from competing with time-sensitive control traffic between PLCs, I/O, and drives.

Pay particular attention to isolating real-time Ethernet traffic (e.g., Ethernet/IP) from point-to-point traffic like Modbus TCP. Modbus devices are typically legacy devices and tend to have very limited bandwidth. They can easily be swamped by a multicast message protocol such as Ethernet/IP. Best practices for a secure network

With the convergence of IT and OT, cybersecurity has gone from an option to a necessity. There are a number of techniques and common-sense strategies to improve the organization’s security posture.

Look for “secure-by-design” products

The best way to achieve a secure system is to incorporate cybersecurity from the beginning, rather than following a “bolt on” approach after commissioning. Start with secure-by-design products¾products with built-in cybersecurity features (see “Secure by Design: What It Means When You Buy Industrial Components”). Products like PLCs, switches, and HMIs are already available with integrated security functionality. Expect to see that trend continue as the EU’s Cyber Resilience Act (CRA) nears its enforcement date of December 2027. The CRA mandates that all digital devices marketed in the EU have pre-installed security functionality.

As an example, consider switches with Media Access Control security (MACsec) encryption. Standardized as IEEE 802.1AE, the MACsec protocol is based on the assumption that all ports are inherently trustworthy until proven otherwise. It calls for encrypting an Ethernet frame before it is transmitted from device to device over the physical media. Linked ports on different switches in the network need to exchange and verify matching security keys before any data can be passed. As a result, MACsec encryption can protect against a variety of security threats, such as intrusion, man-in-the-middle, masquerading, and more without adding latency. Implementation may be more complex upfront, but the resulting network is far more robust than if it used only software encryption.

Apply network segmentation and security hardening

The more tightly coupled the OT network is to the IT network, the more important it is to run the most secure protocol feasible. Certain protocols like real-time Ethernet and Modbus TCP provide operational benefits. Because secure versions of these protocols either don’t exist or are rarely supported, however, consider segregating them from the rest of the network in a separate VLAN.

Segmentation makes it possible to have a field network running the fieldbus and intra-machine communications using fast, efficient, and known protocols like Modbus TCP on a VLAN. In this scenario, that VLAN would be logically isolated from other network traffic, while the shop floor would maintain a separate VLAN for external communications using secure protocols such as OPC UA, MQTTS, and HTTPS. .

Follow through with device hardening and system hardening

It’s not enough to buy a device with security functionality or use a protocol that can be secure. None of these measures work unless they’re enabled. During commissioning and troubleshooting, it can be enormously tempting to skip steps like setting port security keys and installing security certificates. The problem arises when the system stays that way after initial tests. Don’t be the reason something gets hacked–take the time to properly configure the available security measures.There needs to be a hard delineation of which ports are allowed to communicate with which other ports. This can take the form of physical indications such as cabling colors and dedicated OT and IT ports that don’t share any internal resources. Don’t stop with hardware; include additional virtual guards like whitelisting MAC addresses, ports and IP addresses.

Switch solutions

There was a time techniques like network segmentation and IGMP snooping could only be implemented with highly managed switches that were expensive, power-hungry, and complex to install and configure. Today, even some enhanced unmanaged switches can do the job (see Figure 1). It’s an efficient, economical approach for networks with limited requirements.

Figure 1: Automation Direct’s STRIDE PRO Unmanaged+ Gigabit switches provide high-functionality features like IGMP snooping and VLAN support for network segmentation. It can be easily configured via DIP switch.

The next step up in functionality is a lean managed Ethernet switch. Fast becoming a preferred IIoT solution, lean managed Ethernet switches are user-friendly enough to be configured without extensive IT knowledge. Bridging the gap between enhanced unmanaged switches and highly managed switches, lean designs offer a stripped-down feature set to reduce configuration overhead (see Figure 2).

Figure 2: The WAGO lean managed Ethernet switch from Automation Direct offers network segmentation and QoS, along with a streamlined web interface and diagnostic toolkit designed for ease of use.

Conclusions

Although the convergence of OT networks and IT networks has its challenges, tools and techniques have evolved to address them. Cybersecurity is essential, but don’t feel threatened– as long as you segment your network properly, you can still use the very efficient and fast fieldbus protocols that you know. The key is using the techniques above to keep those subnets secure. Start at the design phase. Choose products that are secure by design and follow through with implementation. Familiarize yourself with how certificates work and how to use them. Look to ISA/IEC 62443 and NIST cybersecurity frameworks for more practical tips on improving cybersecurity posture today while preparing for the future. Finally, take advantage of the expertise of your vendors during set up.

About the authors

Damon Purvis is DM/DL & Networking Silo – Product Manager, and Alexander Maercz and Winn Paulk are DM/DL & Networking Silo – Product Engineers at Automation Direct.