The audako security concept against cybercrime: IT security at the highest level from an expert's perspective
audako IoT platform is secure... and the next sections will show you just how secure. Sure, IT security is on everyone's lips and probably even every layman knows it already: protection against cyber attacks is important, the use of the best security software is unavoidable and there was something about the many legal requirements for IT security. The latter is especially true for CRITIS operators. But even as an IT professional, it is not always easy to navigate through the jungle of regulations. Then it is better to access an IoT platform built by experts in the field.
The further development of our secure and modular audako IoT Platform 4.0 was based on requirements to ensure adequate protection for secure network operation, which was adopted by the German government in August 2015 via the IT security catalog pursuant to Section 11 (1a) of the German Energy Industry Act (EnWG), specifically for infrastructure. The ISO 27001 certification is the successful proof of our skills. Our expertise in IT security went even further, even every company with automation processes and building operators benefit from audako's security concept. Because your data management is in good hands with us. We want you to concentrate on your core business and no longer have to worry about data security. Paragraph phobias are a thing of the past.
If you are a developer or other IT professional wondering what makes audako's technical architecture so secure against outside attacks, this blog post is for you. Or if you are an expert looking for a secure platform 4.0 for your customer, who you also need to convince about audako, then you should just stay tuned:
High Availability and redundancy concepts support distributed operation and load balancing
All components of the audako IoT platform have been developed with state-of-the-art software architecture and can be scaled as required. Both the load shares among the number of running components of the same type as well as each similar component seamlessly takes over the service of the failing component.
Scaling can be done per component. Different applications use the underlying components differently. For applications with a focus on historical data, for example, our audako Historian, which is responsible for storing and providing this data, can be scaled to additional server systems, while all other components continue to simply exist in the overall system.
Georedundancy means the use of two data centers for redundant operation of a platform, which are located at least 200 kilometers apart in accordance with BSI requirements. The audako IoT platform supports this operation across data center boundaries and is neither limited in the number of data centers used nor dependent on particularly fast connections between the data centers.
Consequential encryption and no use of third parties in data transmission
Whether a normal user, an operations manager or a project planner: all access the platform via the encrypted transmitted web interface. HTTPS/SSL encryption is based on the latest TLS standard in version 1.3. Data transmission between the platform and the IoT Edge Gateways is also encrypted. The connection of the IoT Edge Gateways to the central network in which the audako IoT platform is operated is made using the established OpenVPN, although IPsec can also be used here on customer request.
There is no use of intermediaries or other third parties in the communication, so the communication is actually end-to-end. There is no need for a cloud service from narz systems or any third party if the customer decides to run their IoT platform independently. In addition to the communication between the technical components, encryption and the avoidance of third parties in the communication is also used for the transmission of events via remote alarming.
Isolation of OT components
Secure IoT Edge Gateways completely isolate OT components. IoT Edge Gateways such as our audako IoT Gateway separate PLC controllers and other components from the Internet while still establishing a secure communication channel between them and the audako IoT platform. Our IoT Edge Gateways are based on an up-to-date and secure Linux kernel with the minimum necessary kernel modules and have no open ports on the WAN interfaces. A web interface provided via encrypted communication is used to manage the gateways. In the gateway, a wide variety of protocols from the field level are converted into a standardized protocol for communication with the audako IoT platform. The centralized management of the IoT gateways serves to always keep them up to date with the latest software and thus ensure security.
Centralized identity management with password policies, two-factor authentication, and protections against identity attacks
An equally modern, centralized identity management is part of a modern platform. The audako IoT platform uses an identity and access management system that implements the latest secure standards in this area. These include OpenID Connect and OAuth 2.0, for example.
Of course, identity management includes secure password policies that determine how secure users must make their passwords and how often they must change them. Further, the use of a second factor to authenticate users allows for a great increase in protection from hackers and fraudsters.
The centralized identity management can also be used for multiple instances of the audako IoT platform and also supports single sign-on across the different instances. For use in the corporate network, there is the option of connecting audako's identity management to LDAP or Active Directory directory services.
Deployment in standardized container environment
narz systems provides the required software components for audako environments in the form of containers. Containers separate the runtime environment of an application from the actual host environment of the computer system.
Containers are created on so-called base images as part of the development process. These base images represent a minimum executable Linux environment and, due to the very limited functionality, form an equally minimum possible attack surface for possible security vulnerabilities. The base images do without all unnecessary parts of the Linux kernel and do not include any pre-installed applications. In addition to this base image, the containers provided then only contain the software component intended for the container in question. During operation, only absolutely necessary files and network ports are exchanged or released between the container and the host system.
The images for the containers are made available as part of an ISO 27001-certified process in a non-public software depot that is only accessible to customers. This prevents untested or even malicious applications from finding their way onto systems, in contrast to provisioning using public software repositories provided by containerization vendors.
Container environments cannot be provided with security updates & patches through a traditional installation process. In containerized environments the update of the container is done by replacing the complete image, of course the application data is preserved. Through narz systems permanently released, tested container images are provided on the most current state with all available security updates & patches. The container environment can be configured in such a way that containers for which a new image is available are updated fully automatically.
Web-based applications with pure HTML5 technology provide less attack surface
The complete functionality of the audako IoT platform is based on pure HTML5 technology and does not require any installations, plug-ins or add-ons on the user side. Likewise, the complete engineering is web-based and at the same time only requires a compatible web browser for project planning.
This consistent avoidance of client-side additional components already categorically avoids a large number of security vulnerabilities. Coupled with the many other measures we have already taken elsewhere to protect users and applications, we provide a very high level of protection for our customers.
