Securing OPC DA With Unidirectional Gateways

Alternatively, if industrial engineers wanted to secure OPC DA communication but without a unidirectional gateway, this is a breakdown of what they’d need to do, which still wouldn’t provide the gateway’s “unbreachable” level of security:

Network Firewall Segmentation: Segment the network to try to isolate the OPC DA servers and clients from other parts of the network. Making OPC-DA available to IT users through a firewall, however, is difficult. OPC-DA uses DCOM under the hood, and accessing DCOM through a firewall means opening over 1000 ports on the firewall.

>>The downside here is that firewalls are software-based security and are routinely defeated, for example when ransomware attacks pass through IT-Internet firewalls into IT networks.

DCOM Access Control Lists (ACLs): Use DCOM access control lists to restrict access to OPC DA servers and data based on user roles and permissions. Implement role-based access control (RBAC) to ensure that only authorized users can access OPC DA outputs.

>>One downside here is that DCOM servers regularly suffer zero-day exploits, sometimes in parts of the servers that must be accessed even before access control lists are consulted.

Intrusion Detection and Prevention Systems (IDPS): Deploy IDS and IPS solutions to monitor OPC DA traffic for suspicious activity and detect potential security threats. IPS can help identify and block unauthorized access attempts, malware, and other security incidents in real-time.

>>Intrusion detection takes time, and some attacks happen very quickly. Intrusion prevention can generally be enabled only for the most serious and most obvious attacks, because false alarms lead to connectivity interruptions and possibly other malfunctions of the OT OPC-DA server. More generally, advanced attacks often create very “noisy” diversions in other parts of a compromised IT network, generating a lot of alarms and drawing attention away from more subtle attacks on OPC DA servers exposed through firewalls to the IT network.

Regular Patching and Updates: All the systems, from the OPC DA server itself, to all the supporting hardware and software all need to be patched and kept updated so that any new vulnerabilities can not be exploited by attackers who remain more up-to-date with the system.

>>One downside with this solution is that the system remains vulnerable before the patch is installed, even if it’s just for a few days. Additionally, there might be issues in the patches themselves that can cause damage. This creates an ongoing dilemma between updating and patching as soon as possible, and delaying it in order to give time for the patch to be confirmed as “good” on other machines before updating it to your own. Another downside is that “zero day” attacks exploit vulnerabilities for which no patches exist, and modern attacks only sometimes exploit known vulnerabilities, often preferring nowadays to exploit permissions instead.