The most important issues regarding IT security

Maintenance accesses are intentionally created openings of the network to the outside that must necessarily be protected sufficiently if required.

For this INSYS routers permit the restriction to individual users with different rights, an authentication of these users using certificates or RADIUS server, the limitation of accesses to secure protocols, like HTTPS or SSH, or various options for secure VPN connections.

Office IT is usually connected to the Internet on many paths. Usually, there are also network connections from office into application network, so that offenders can invade on this way.

In order to prevent this, INSYS routers permit the segmentation of the networks, the use of a firewall, in which the necessary connections are opened with precise restrictions to ports, protocols and interfaces, and provide authentication and VPN options.

IT standard components (commercial off-the-shelf, COTS) like operating systems, application servers or databases usually contain faults and weak points that are exploited by offenders. If these standard components are also used in the application network, this will increase the risk of a successful attack on the systems in the application network.

In order to prevent this, INSYS routers permit the segmentation of the networks, the use of a firewall and provide authentication and VPN options as well as an own, particularly hardened operating system based on Linux.

Network connections and necessary resources can be compromised and systems can be caused to crash by denial of service attacks, for example to disturb the functionality of an application network.

INSYS routers allow to use redundant connections via Ethernet, DSL and cellular radio (LTE) in case of communication problems.

Deliberate acts – regardless whether by internal or external offenders – are a massive threat for all protection objectives. Besides this, negligence and human failure are a major threat especially regarding the protection objectives confidentiality and availability.

In order to prevent this, INSYS routers permit the limitation to individual users with different rights, an authentication of these users using certificates or RADIUS server, the limitation of the accesses and permit also a targeted information in case of configuration modifications or plugging a device to an Ethernet port as well as log files that record a variety of processes with a timestamp. Moreover, inputs and outputs at the router permit external security circuits, for example using key switches for a manual release of the access.

The use of removable media and mobile IT components by external employees is always a great risk regarding malware infections. This aspect was important for Stuxnet for example.

INSYS routers do not allow the connections of data carriers and also permit the segmentation of the networks, the use of a firewall and VPN connections as well as the targeted disabling of unused Ethernet ports. The measures described under "Attacks to network components" below are available against the connection of NAS systems.

Since most control components communicate via plain text protocols and thus non-protected at the moment, eavesdropping and introducing of control commands is often possible without much effort.

In order to prevent this, INSYS routers permit the use of secure VPN connections as well as the detection of permitted MAC addresses.

For an IT secure application, no services should be accessible from the Internet. A modern application has client services only on field level and the respective server services in the cloud or central data systems. If services need to be executed on the devices in the field (e.g. CLI or web server), these must be configured such that they can only be accessed within a VPN tunnel in no case from the Internet. Moreover, such services and components in the application network must not use no or unsafe authentication and authorisation methods.

In order to prevent this, INSYS routers permit the segmentation of the networks, the use of a firewall, the use of VPN connections and authentication options as well as the targeted disabling of unused Ethernet ports.

Network components can be manipulated by offenders, to make man-in-the-middle attacks or easy sniffing for example.

In order to detect this, INSYS routers permit a targeted information in case of configuration modifications or plugging a device to an Ethernet port, log files that record a variety of processes with a timestamp as well as the targeted disabling of unused Ethernet ports.

Failures due to extreme environmental conditions or technical failures are always possible – risk and damage potential can only be minimised here.

In order to prevent this, INSYS routers permit the use of redundant connections via Ethernet, DSL and cellular radio (LTE), the use of redundant devices as well as a backup of the device configuration.