Advancing Network Security in Manufacturing: Exploring a solution for challenges caused by hybrid Static IP and DHCP environments

The unique requirements of manufacturing environments and the prevalence of static IP configurations present distinct challenges for ensuring strong network security, while meeting the operational requirements. 

In this blog post, we will discuss i) reasons for the the prevalence of Static IP Configurations in industrial networking, ii) some of the drawbacks of DHCP-based Network Security in industrial networks, and iii) a few capabilities and benefits of implementing a network-agnostic Edge Microsegmentation security solution like Byos for these types of networks. 

The prevalence of Static IP

The use of static IP configurations are common in industrial networks for several reasons:

Predictability and reliability

Industrial environments require consistent and reliable communication between devices to ensure smooth operation of processes and equipment. Static IP configurations provide predictable IP addresses for devices, making it easier to manage and maintain network communication without unexpected changes or disruptions.

Legacy systems

Many industrial networks still utilize legacy systems and devices that were designed before the widespread adoption of DHCP. These devices may not support DHCP or have limited compatibility, making static IP configurations a necessary choice for their operation.

Network simplicity

Industrial networks often have a simpler topology compared to enterprise networks and often are changed less frequently. Using static IP configurations can simplify network management in such environments, as it allows for easier documentation, troubleshooting, and maintenance of the network.

Real-time communication

In industrial networks, real-time communication between devices is often critical. Static IP configurations eliminate the potential delay that can be introduced during the DHCP lease acquisition and renewal process, ensuring consistent low-latency communication between devices.

Access control and security

Static IP configurations can provide a basic level of access control and security by allowing network administrators to define which devices are permitted on the network. By assigning specific IP addresses to known devices, unauthorized devices can be more easily detected and prevented from accessing the network.

Not a one size fits all approach - enter DHCP

However, it's important to note that static IP configurations can also introduce challenges in terms of scalability, management, and security. As industrial networks continue to evolve and adopt modern technologies, such as the Industrial Internet of Things (IIoT), more dynamic and adaptive network management approaches, including DHCP, may become increasingly necessary. In such cases, it's important to implement appropriate security measures and management practices to maintain the reliability and security of the industrial network.

DHCP has a number of advantages over static IP use: 

• Simplified IP address Management
• Improved Scalability
• Dynamic IP address Allocation
• Configuration consistency
• Faster Set up time

The Drawbacks of DHCP-based Network Security Solutions

The use of DHCP can provide some operational benefits like reduced administrative workload, centralized management and control. However, since most Operational Technology like Industrial Control Systems (ICS) and SCADA systems in Industrial Networks still rely on static IP addressing, DHCP-based security solutions still have limited effectiveness. 

Here are some ways DHCP use in industrial networks can be exploited:

1. Static IP configuration: Since the security solution relies on modifying the DHCP response, attackers can bypass this by configuring a static IP address on their device. This lets them operate outside the DHCP-administered environment and avoid subnet masking and gateway restrictions.
2. Rogue DHCP server: An attacker could set up their own rogue DHCP server on the network, which could provide incorrect or malicious IP configurations to devices, allowing them to bypass the security solution's subnet masking and gateway restrictions.
3. ARP spoofing: By conducting ARP spoofing attacks, an attacker could impersonate the solution's gateway, intercepting and manipulating traffic between devices. This would allow them to bypass the visibility and control enforced by the solution's gateway.
4. VLAN hopping: If an attacker is able to exploit misconfigurations or weaknesses in the network, they could perform VLAN hoping to access other VLANs and bypass the security solution's restrictions.

DHCP Incompatibility with ICS and Legacy systems

Many ICS and legacy systems were designed before DHCP became widely adopted, resulting in a lack of native support for the protocol. These systems rely on static IP addresses for their deterministic behavior, crucial for maintaining real-time communication and control within the industrial environment, meaning DHCP-based security leaves gaps in protection of OT networks. 

The evolution of industrial networks from static IPs to DHCP has brought about increased scalability and flexibility. However, this shift has also introduced challenges in troubleshooting and resolving mismatched addressing structures and duplicate IP assignments. As networks grew in size and complexity, identifying conflicts became increasingly difficult, making it almost impossible to undertake massive architectural projects to redesign the addressing scheme. Instead, network administrators rely on patchwork solutions and workarounds, such as meticulous documentation, strict IP assignment policies, and network monitoring tools. While DHCP offers benefits, the complexities and dependencies within industrial networks make complete overhauls challenging.

Enhancing Network Security in all types of industrial networks 

Modern industrial networks should not be limited by the underlying networking architecture. The key question to be addressed is “How do I secure my industrial network when I have both DHCP and Static IP devices?” Byos provides a solution that protects any IP-based underlying network architecture that scales across a worldwide network of assets, while bringing consistency and simplicity to how the network is administered by plant-floor network engineering teams. The key aspects of our Byos’ Edge Microsegmentation Solution for Industrial Networks include:

Simple integration with existing equipment and network architecture

• Plug-and-play deployment - no agents or drivers needed. Every asset protected gets a Secure Edge Device - read more here.
• Compatible with both static IP and DHCP - no configuration changes are needed on the underlying infrastructure.
• Security independence from the asset’s OS and local network, for protection and control of both egress and ingress traffic
• Wireless connectivity to legacy and other typically wired equipment, reducing cabling requirements and complexities during production changeovers, retooling, line conversions, etc.. 

Enhanced management and scalability

• Centralized cloud-based (or on-prem) control plane where administrators manage Assets, Policy Groups, Byos Overlay Zones, and Secure Edges within the Byos-protected network.
• Instant “policy push” from one device to thousands, meaning scalability across large diverse networks
• Customizable internal and external network routing rules for flexibility of customer requirements of how traffic is routed within the Byos network, across the intranet, and Internet when required.

Device profiling, access control, and Continuous monitoring

• Automatic asset discovery
• Layer 2, 3 and 4 Access Controls (Authentication and Authorization) of asset communication in the overlay
• Real-time alerting and logging of activities within the Byos network
• Prevents lateral movement - reduces the “blast radius” of ransomware and a wide range of network attacks.

Conclusion

As the landscape of industrial networking continues to evolve, it is essential for manufacturing environments to adopt security solutions that address the unique challenges associated with the use of both static IP and DHCP. To learn more about how implementing Byos improves the security, management, and scalability of your network, start a conversation here.