Secure Industrial Networking

A DMZ, or Demilitarized Zone, in the context of network security, refers to a physical or logical subnetwork that separates an internal local area network (LAN) from other untrusted networks. DMZ are mostly implemented at the edge of a given infrastructure, which is a problem in todays' connected environments.

A OD-LAN - or Overlay Demilitarized Local Area Network - is a logical subnetwork that aims to protect a given LAN with Demilitarized capacities: internal firewall, access control, proxy server and log monitoring. OD-LAN brings the concept of DMZ internally to an infrastructure to drastically increase its security.

A VLAN (Virtual Local Area Network) or bridge, consists in "bridging" several ports of a switch onto a similar LAN, allowing them to connect at the switch speed. To ensure maximum speed VLAN use the 802.1q standard to tag ethernet frames and quickly pass them along without interpretation.

OD-LAN provide a logical overlay to implement Demilitarized capacities in front of a given LAN. The newly setup DLAN provides a high level of security: analyzing packets, enforcing access control, proxying services on the LAN...

VLAN optimize for speed, OD-LAN optimize for security.

Several cybersecurity frameworks and organizations recommend the use of DMZs as part of a layered security strategy. Notable among these are:

• ISO/IEC 27001: This international standard for information security management systems (ISMS) recommends implementing network segmentation and segregation, which include DMZs, to protect sensitive data.
• NIST (National Institute of Standards and Technology): NIST's cybersecurity guidelines often include the use of DMZs to protect internal networks from untrusted external networks.
• IEC 62443: IEC 62443, the leading international standard for security in automation environments, recommends to shield OT systems with a DMZ with front and back firewalls.
• PCI DSS (Payment Card Industry Data Security Standard): For organizations that handle credit card information, PCI DSS requires the implementation of DMZs to separate payment systems from other network resources.
• ANSSI (National Agency for the Security of Information Systems in France): ANSSI provides recommendations for network segmentation and the use of DMZs to secure critical infrastructure.

A well-configured DMZ should provide the following functionalities:

• Service Isolation: The DMZ should host only the services that need to be accessible from the untrusted network, minimizing the risk of internal network exposure.
• Access Control: It should strictly control incoming and outgoing traffic between the DMZ, the internal network, and the internet using firewalls and other security appliances to prevent unauthorized access.
• Monitoring and Logging: The DMZ should be equipped with tools to monitor and log activities, allowing for the detection of suspicious behavior and potential breaches.
• Intrusion Detection and Prevention: Implement intrusion detection systems (IDS) and intrusion prevention systems (IPS) within the DMZ to identify and block malicious activities.
• Regular Updates and Patch Management: Services hosted in the DMZ should be regularly updated and patched to protect against known vulnerabilities.

The Trout Cyberbox simplifies the implementation of these DMZ functionalities by providing a hardware solution that automates the setup and management of a secure IDMZ environment, adhering to recommended security practices and standards.