PKI – A known and underestimated Champion
For decades, public key infrastructure (PKI) has been a well-known and effective concept for securing shared information by cryptographic means. There are 3 most important principles:
- Authenticity– the communication partner knows its peer;
- Integrity – data is not manipulated on the way between sender and recipient;
- Confidentiality – where required, data is protected against unauthorized disclosure
PKI provides very good support to these 3 principles. Many software libraries that were already in use more than a decade ago and thus also participated in developing currently used OT solutions already supported at least rudimentary PKI-relevant operations for managing keys and digital certificates. PKI relies on processes and standardization. Its usage is therefore vendor-independent and freely accessible to all.
Challenges for implementing PKI in OT
Where there is light, there is also shadow. There are various reasons why PKI is not used across the board in production and control systems. In our experience, the following reasons are most frequently referred to:
“No demand because no risk”
This argument was used all too often in the past, as the most crucial protective measure was the isolation of production facilities. It is now being increasingly invalidated and turned into the opposite with the progressive networking of plants and components.
“Too complex and expensive”
Here, most critics speak of process costs due to manual lifecycle processes of certificates. Since certificates should be renewed regularly, a certain amount of effort is required to monitor the exact certificates in use and prepare replacements before they expire. While there were limited automation options several years ago, the situation is now different. Lightweight and globally standardized protocols allow a scalable architecture for certificate management without being dependent on individual manufacturers. Intelligent automation of various process steps significantly reduces manual effort.
“Too complicated to operate”
The concept of PKI is characterized by flexibility and interoperability. However, it entails a certain degree of complexity. Nevertheless, complexity and complicatedness should not be mixed. It is indeed possible to develop and implement complex solutions without complicated processes. These well-designed solutions do not disrupt operations or overburden employees. A measured introduction of PKI supports effective risk and effort reduction in operations.
Certificate management is often less of a technical issue and more of a challenge due to a lack of understanding of the processes required to manage keys and certificates effectively. Trying to cover all scenarios in a scattered OT landscape with one throw can quickly frustrate and ultimately lead to failure.
How to address PKI in OT
But how should you approach the topic in order to achieve useful results in a timely manner and with manageable effort? At BxC, we would like to help you set the right priorities with a few tips to make your efforts as efficient and effective as possible.
1. Identify 3-5 essential scenarios
Companies should focus on a few but important scenarios to address the topic of PKI. The scenarios should come from different areas in order to still have a certain degree of diversity of business requirements. However, they should not be focused on an isolated solution. If you define the goal too broadly, you run the risk of getting stopped by too many details. This would thus delay usable solutions for too long.
2. Define requirements and processes universally
One of the strengths of PKI is the solution-agnostic concepts. Rather than focusing on a particular case, processes should be designed with a broader perspective, taking a step back in the process definition. Many administrative processes for certificates can be reused and allow selective re-sharpening of process steps. This makes solutions reusable and thus more cost-efficient.
3. Start with Level 3 scenarios
The most significant risk with increasing connectivity arises in the OT service layer, which interacts strongly with enterprise IT and cloud services. The Purdue model places such services in Level 3, which acts as an intermediary between IT (level 4+5) and the cyber-physical domains (level 0-2). Any information passing through level 3 must be protected against unauthorized access or modification. Since systems primarily used here are less affected by resource restrictions and are based on classic operating systems, most of them support PKI functionalities.
4. Focus on PKI clients
There are many solution providers for PKI services. Most of them have one thing in common: they only want to offer a service. However, how clients bring it into their environment remains the problem of the clients. The success of PKI and, above all, the usability of PKI in the OT stands and falls here. Certificates that expire and make services unusable are poison for OT. This is both a business and security risk. The intelligent design of the integration of certificates on OT systems is one of the most important success factors for the use of digital certificates.
Especially in a brownfield environment of OT, an agile approach is helpful for the evaluation of PKI. Nevertheless, agile does not stand for fast and cheap, as it is misleadingly considered in many companies, but for short development phases and rapid review cycles. These support evaluation of the reusability of technology and processes without long project runtimes and costs before the first visible achievements.
BxC Take Away
We, at BxC, are convinced that PKI is a valuable candidate for establishing minimum security levels in Industry 4.0.
On the way to the digitalization of production processes and the vision of Zero Trust in OT, the consideration of PKI for OT is indispensable. The widespread use of PKI in IT offers many companies the opportunity that PKI know-how and also PKI services are already available in the enterprise. These can be reused to a certain extent, but OT-specific needs must be addressed in order to make a successful contribution to securing your Industry 4.0 activities.
A “Libero” role with PKI know-how and understanding of your OT needs can play a crucial role in success.