Siemens Aktiengesellschaft

Siemens Industry, Inc.

Siemens Corporation

John W Crawford

Leandro Pfleger De Aguiar

Martin Kunz

Harry A Brian, Jr

Nicholas Nichols

Kaan Bardak

Tzu-hsin Tsao

Lesley Morgan

Tsao Tzu-Hsin

Jr Harry A Brian

Embodiments include methods, network security computer systems, and computer program products for identifying deviant engineering modifications to programmable logic controllers. Aspects include: collecting, by a network traffic collection device of the network security computer, network traffic data from one or more engineering stations, and storing, by a network traffic data storage device, the network traffic data collected. Each of the engineering stations may include one or more programmable logic controllers. The method also may include: comparing, by a network traffic comparison module, the network traffic data collected, detecting, by an abnormality detection module, any deviant engineering modifications to the programmable logic controllers in the engineering stations; and generating, by an alarming and correction module, one or more reports for the deviant engineering modifications to programmable logic controllers. The alarming and correction module may generate one or more alarms and block any network traffic associated with the deviant engineering modifications.

Identification of deviant engineering modifications to programmable logic controllers

A computer-implemented method for assessing and managing network security for a network includes retrieving topology data and network traffic data with a processor, where the topology data is indicative of a topology of the network. The method may further include retrieving, via the processor, network flow data from a plurality of network data collectors, generating, via the processor, an attack tree based on the topology data and the network flow data, updating a customer model database with the attack tree and the topology data, and outputting a security assessment based on the attack tree and the topology data.

System and method for passive assessment of industrial perimeter security

Security for network communications is internally generated by an industrial control system (ICS). The ICS is assembled in a known-good environment prior to connecting to another network. While in the known-good environment, one or more components of the ICS auto-negotiate () with other components, assigning () security tokens. These certificates are used to internally secure communications between the components prior to any connection to other devices and without relying on external provisioning of the security tokens during commissioning () of the ICS.

Industrial control system with internal generation for secure network communications

Holder for empty cassette case

Growing community of inventors

Cumming, GA, United States of America

John W Crawford