How Next-gen LAN Firewalls Enhance Industrial Network Security and Uptime

Because of their frequency, cyberattacks on critical infrastructure are no longer the sensational news they once were. However, these types of cyberattacks always heavily impact citizens and organizations, as our daily lives are closely tied to critical infrastructures, such as power substations, intelligent transportation, and water treatment.

To mitigate the impact of cyberattacks, governments worldwide are implementing laws and regulations to strengthen cybersecurity for critical infrastructure. For example, by October 2024, EU members are required to incorporate the NIS2 Directive into their national laws to strengthen cybersecurity for critical infrastructure. Therefore, industrial organizations need to adopt a comprehensive cybersecurity framework and implement robust solutions to meet these cybersecurity standards and regulations.

Defense-in-depth Strategies

Usually, industrial cybersecurity standards and regulations recommend defense-in-depth strategies, which involve implementing multiple layers of protection to minimize security risks for organizations. Industrial operators usually concentrate on fortifying network boundaries and establishing security zones to minimize potential threats from external access. However, addressing internal threats is just as critical because internal devices without protection can compromise the entire network. For example, plugging in a portable storage device that carries malware can compromise your network and have your network controlled by others. Thus, protecting your network from internal and external threats is of utmost importance. Industrial firewalls effectively filter traffic to prevent potential threats from internal and external access. However, industrial operators usually have concerns about network performance when deploying industrial firewalls in LANs near their critical assets.

This article focuses on four concerns faced by various stakeholders— asset owners, chief information security officers (CISOs), system integrators, OT network administrators, and industrial network design experts—when implementing firewall solutions. The article also highlights how next-gen industrial LAN firewalls overcome these challenges to strengthen network security and ensure uninterrupted network operation.

The 4 Big Worries When Implementing Firewall Solutions

Although implementing firewall solutions increases the security level of your industrial operations, these changes can affect your current operations. Striking a balance between network security and performance is challenging. Learn more about the four concerns that are pushing industrial operators to find solutions for smoother implementations.

Concern 1: Adding New Devices Requires Changes to the Existing Network Design

Deploying industrial firewall solutions into existing networks can lead to significant network topology changes. Redesigning the topology and reconfiguring IP subnets to integrate the new firewall solution into existing networks will demand substantial efforts and time from industrial engineers. This is particularly difficult for critical applications that cannot afford any network downtime. Therefore, industrial operators need a firewall solution that does not alter their present network configuration.

Concern 2: Adding New Devices Affects Network Performance and Services

Seamless system operations rely on smooth network communications. The big worry when adding new devices to enhance cybersecurity is whether they meet current network performance standards, such as boot time, network latency, and operating environment needs. Furthermore, the addition of new devices raises the likelihood of network downtime caused by maintenance or device malfunctions. Therefore, a firewall solution must prioritize network performance and mitigate the risk of complete shutdown from a single point of failure.

Concern 3: Protecting Many Legacy Devices at Field Sites Is Challenging

Standards such as IEC 62443 and frameworks like NIS2 require critical assets to protect against DoS attacks and maintain event logs during incidents. However, many critical assets in industrial applications are legacy devices that usually use older versions of operating systems and cannot be replaced right away to meet these network security requirements. To safeguard legacy devices from growing threats, a firewall solution is required that doesn’t require frequent system updates. Moreover, a significant number of legacy devices at field sites use diverse industrial communication protocols for different application needs. For improved communication security, a firewall solution needs to support these protocols and conduct detailed data analysis in industrial control networks.

Concern 4: Monitoring Networks and Cyberthreats Is Not So Simple

To ensure the safety of your networks, constant monitoring and management of network security is crucial. It requires a lot of time and effort for administrators to keep their eyes on the network status, making sure they receive real-time notifications when a network error or security event occurs. The absence of an effective monitoring mechanism for firewall solutions leads to delays in network error notifications and security event alerts, resulting in extended network downtimes and compromised operational performance.

Maximize Your Industrial Network Security and Uptime With Next-gen LAN Firewalls

With our EDF-G1002-BP Series industrial LAN firewalls, industrial operators can overcome networking challenges, ensuring both network security and uptime. Operating in transparent firewall mode, the LAN firewall prioritizes safeguarding your critical assets and facilitating secure east-west communication within the LAN.

Simplified Installation

The nature of the LAN firewalls allows you to deploy firewalls without reconfiguring IP subnets. Such designs are perfect for those critical applications that cannot afford to change their existing network topology. To simplify network installations, our 2-port LAN firewalls allow bump-in-the-wire installations so that engineers can simply connect these LAN firewalls in front of critical assets without reconfiguring IP subnets. This way, our LAN firewalls ensure minimal disruption to existing configurations and enhance network security.

Optimized Network Uptime

It only takes 30 seconds of boot time to enable our LAN firewalls. This quick boot time ensures that, during a power outage and subsequent restoration, the anomaly detection mechanism between the control center and terminal PLC equipment does not trigger mistakenly. Also, our LAN firewalls have a LAN Bypass function that prevents any hardware or software anomalies from causing the firewall to interrupt operational services. Both mechanisms aim to achieve uninterrupted operations.

Legacy Device Protection

Making it easy to protect legacy devices is the core mission of our LAN firewalls. We design them for industry use and incorporate IPS and DPI technology to strengthen network security. Industrial-grade IPS designs ensure the security of your legacy devices, including PLC and HMI. Our IPS functions safeguard your legacy devices from current threats using virtual patches and pattern-based protection, allowing you additional time to update your systems. With our DPI technology, you have greater control over the security of your industrial communications. To maintain data integrity, you can define rules that limit Modbus equipment to read-only access, for instance. You can effortlessly safeguard legacy devices using different protocols and benefit from our DPI technology’s support for multiple industrial protocols and advanced traffic filtering capabilities.

Simplified Network Management

If you use our LAN firewalls to secure your network and legacy devices, you can simplify network monitoring and security management using our MXview One network management software and MXsecurity network security management software. MXview One software provides a holistic view of network security status and notifies you when a network error occurs. With our MXsecurity software, you can effectively manage firewalls and monitor security events. Implementing firewall policies on a centralized platform minimizes manual errors in individual configurations. Furthermore, our software notifies you of security events for quick responses and risk mitigation.

Moxa’s EDF-G1002-BP Series is an advanced LAN firewall that boosts industrial cybersecurity and provides the reliability required for your applications.

About Moxa

Moxa is a leading provider of edge connectivity, industrial computing, and network infrastructure solutions for enabling connectivity for the Industrial Internet of Things. With over 35 years of industry experience, Moxa has connected more than 102 million devices worldwide and has a distribution and service network that reaches customers in more than 85 countries. Moxa delivers lasting business value by empowering industry with reliable networks and sincere service for industrial communications infrastructures. Information about Moxa’s solutions is available at www.moxa.com.

###

The MOXA logo is a registered trademark of Moxa Inc. All other trademarks mentioned in this document are the property of their respective owners.