OT Security with Endian
Eight Principles, One Platform
How can operational technology (OT) be securely networked and managed? Eight cybersecurity agencies, including the German Federal Office for Information Security (BSI), have addressed this question. The result is a joint guide to secure OT connectivity. This article shows how Endian supports the implementation of the eight core principles described in the document.
For a long time, availability, business continuity, and safety were the primary considerations in the design of OT environments. Growing pressure to improve efficiency has led to these environments becoming increasingly networked and, as a result, accessible via the Internet.
Companies benefit from this by being able to carry out predictive maintenance and data analysis, for example. At the same time, new risks arise: With every point of connectivity, the potential attack surface grows. The steady increase in cyberattacks shows that attackers are increasingly exploiting precisely this exposure.
Eight Core Principles for Secure OT
The guide, titled “Secure Connectivity Principles for Operational Technology (OT) — How Organizations Should Design, Secure, and Manage Connectivity in OT,” outlines eight core principles for securely designing connections to and from OT systems.
The Endian Secure Digital Platform supports these principles to a large extent. Here’s how:
Principle 1
Weighing Risks Against Benefits
Before companies connect their OT to the Internet, they need to clarify a few fundamental questions that will set the course for how to proceed: Who is allowed to access which systems, and when? What data can they view there, and what actions are they permitted to take? The guide recommends creating a business case for each connection that justifies and documents the access permissions.
This step is not yet about technical solutions or their implementation, but rather about strategic policy decisions. As recommended in the guide, Endian supports the principle of least privilege, in which access is limited to what is strictly necessary.
Principle 2
Reduce the Attack Surface
Companies should minimize the risks posed by the connectivity of their OT systems as much as possible. To this end, the guidelines recommend, among other things, allowing connections only when necessary and avoiding direct external connectivity for legacy components.
The Endian Secure Digital Platform enables the setup of approval workflows for remote access as well as seamless monitoring and documentation of every session.
Endian 4i gateways, which were developed specifically for industrial environments, are used to connect OT components. Equipped with several finely tuned IT security tools, they protect the operational infrastructure from cyberattacks.
Principle 3
Centralize and Standardize Network Connections
In industrial environments, a wide variety of stakeholders need access to the infrastructure. This creates a certain degree of complexity and is the reason why the attack surface in industrial environments is difficult to contain and monitor. The guide therefore recommends centralized and standardized access points, as well as standardization of access types.
The Endian Secure Digital Platform aims to make the complexity of industrial networks manageable. That is why it provides precisely this single central access point through which everything can be configured, controlled, and monitored. The Endian Switchboard, the management tool of the Endian Secure Digital Platform, enables granular rights and authorization management on a single interface. This allows users to maintain an overview of all connections at all times, whether human-to-machine or machine-to-machine.
Principle 4
Use Standardized and Secure Protocols
In addition to protecting networks and end devices, organizations should also pay attention to the protocols they use. The guidelines recommend limiting industrial protocols such as Modbus, OPC DA, or EtherNet/IP to isolated OT segments and handling IT/OT data exchange via secure protocols and interfaces.
On the Endian Secure Digital Platform, IT/OT data exchange takes place via the 4i Security Gateways. They can handle a wide variety of machine languages and encrypt all data transmitted over the Internet. Bilateral data exchange is possible, and incoming connections can be strictly limited.
Principle 5
Hardening the OT Perimeter
A robust perimeter around the OT environment is the first line of defense, especially for assets that are difficult to update. To secure the OT perimeter, the guidelines recommend not only the least-privilege principle but also next-generation firewalls with Layer 7 inspection, multi-factor authentication for external connections, and context-sensitive access controls. Regular updates are particularly important for devices that bridge the IT and OT networks.
The Endian Switchboard enables the updating of all deployed Endian 4i gateways. This ensures that all gateways are equipped with the latest security software at all times and can provide optimal protection for the connected systems. In addition, the Switchboard allows for the configuration of granular rights and permissions. Each user can access only the data and systems relevant to performing their tasks. Multi-factor user authentication provides even greater security.
The Endian 4i Gateways offer a range of security measures, including an advanced firewall, Intrusion Detection and Prevention (IDS/IPS) and VPN. Docker comes preinstalled on the gateways, so you can run your own applications or third-party software securely.
Principle 6
Minimize the Impact of Security Breaches
If, despite all precautions, an attacker manages to gain access to the network, their scope of action there should be limited as much as possible. The guidelines therefore call for microsegmentation to contain lateral movement within the network, as well as stateful filtering, deep packet inspection, and IDS/IPS functionality. There should be a clear separation of responsibilities between control, monitoring, and business systems.
The Endian Secure Digital Platform enables network microsegmentation by placing an Endian 4i gateway in front of each network segment. Each gateway is equipped with a firewall that pre-filters network traffic. An Intrusion Detection System (IDS) can detect dangerous network traffic, and the Intrusion Prevention System blocks it. This allows for the inspection of data packets down to the application layer (Deep Packet Inspection).
Principle 7
Log and Monitor All Connections
According to the guidelines, comprehensive logging of all connections is the last line of defense: anomalies must be detected, and data flows between network zones must be monitored.
All connections, authentications, and data transfers can be reliably recorded using the Endian Secure Digital Platform. Session recording for remote access enables the complete documentation of maintenance access.
Principle 8
Isolation Plan
In an emergency, OT systems must be able to isolate themselves without losing critical functions. The guidelines distinguish between three strategies: complete site isolation, selective isolation of individual connections or services, and site isolation with hardware-secured communication channels for particularly critical data flows.
Using the Endian Switchboard, third-party access can be deactivated in real time and restored later. Since everything is managed through a single interface, changes are easy to implement.
Conclusion
Eight international security agencies have developed guidelines to help OT operators design secure network architectures. The Endian Secure Digital Platform supports many of the required measures. Which requirements can be fully met in a specific environment depends on the respective conditions.
Common questions, clear answers
Do I really need to disconnect my OT from the internet to keep it secure?
No, you only need to control access. The guidance recommends allowing each connection only when needed. The Endian Secure Digital Platform sets up approval workflows for this and documents every session in full.
How do I protect legacy machines that can't be updated?
Legacy assets are never connected directly to the internet. The Endian 4i Gateway sits in front of them and handles firewall, encryption and access control. This keeps even non-patchable assets protected.
How do I keep track of many users and connections?
Through a single central access point. The Endian Switchboard manages all rights and connections on one interface, whether human-to-machine or machine-to-machine. So you always see who is accessing what.
Are industrial protocols like Modbus or OPC DA secure enough for remote access?
These protocols belong in isolated OT segments. With Endian, IT/OT data exchange runs through the 4i Security Gateways. They encrypt all data and strictly limit incoming connections.
What happens if an attacker does get into the network?
Their room to move stays limited. The Endian Secure Digital Platform enables microsegmentation by placing a 4i Gateway in front of each segment. Firewall, IDS/IPS and deep packet inspection stop it from spreading.
How do I keep my gateways secure and up to date?
Centrally, through the Endian Secure Digital Platform. With the Endian Switchboard you update all Endian 4i Gateways from one interface, so the latest security software runs everywhere. Endian Network simplifies the organization and lifecycle management of your devices. Granular rights and multi-factor authentication add an extra layer of protection.
Can I trace who accessed my systems and when?
Yes. The Endian Secure Digital Platform records all connections, authentications and data transfers in a traceable way. Session recording documents every remote maintenance access in full.
Can I shut down individual connections instantly in an emergency?
Yes. With the Endian Switchboard you can deactivate third-party access in real time and restore it later. Since everything runs through one interface, changes like these are done quickly.