The availability of performance studies and simple models for firewalls able to deal with industrial application-layer communication protocols, like Modbus/TCP, is crucial when the impact of these devices has to be estimated, even roughly, before their actual deployment in industrial networks. Unfortunately, most manufacturers do not provide this kind of information for COTS available products. Thus, a viable solution is the development and experimental validation of simple models that can be used by designers to predict those firewall characteristics not explicitly related to their security capabilities. As an example, latency introduced on message forwarding is an aspect of significant interest in many industrial control systems, where delays and jitters in data delivery can severely impact on the effectiveness of the control actions. This paper reports on our experience in developing a performance model for a commercial device able to perform advanced application-layer filtering, in particular of Modbus/TCP traffic. A set of ad-hoc designed experiments, performed by means of a purposely-developed laboratory testbed, enabled both model development and validation, confirming a good correspondence of the estimated performance with the device actual behavior.

Industry 4.0 has significantly improved the industrial manufacturing scenario in recent years. The Industrial Internet of Things (IIoT) enables the creation of globally interconnected smart factories, where constituent elements seamlessly exchange information. Industry 5.0 has further complemented these achievements, as it focuses on a human-centric approach where humans become part of this network of things, leading to a robust human–machine interaction. In this distributed, dynamic, and highly interconnected environment, functional safety is essential for adequately protecting people and machinery. The increasing availability of wireless networks makes it possible to implement distributed and flexible functional safety systems. However, such networks are known for introducing unwanted delays that can lead to safety performance degradation due to their inherent uncertainty. In this context, the Time-Sensitive Networking (TSN) standards present an attractive prospect for enhancing and ensuring acceptable behaviors. The research presented in this paper deals with the introduction of TSN to implement functional safety protocols for wireless networks. Among the available solutions, we selected Wi-Fi since it is a widespread network, often considered and deployed for industrial applications. The introduction of a reference functional safety protocol is detailed, along with an analysis of how TSN can enhance its behavior by evaluating relevant performance indexes. The evaluation pertains to a standard case study of an industrial warehouse, tested through practical simulations. The results demonstrate that TSN provides notable advantages, but it requires meticulous coordination with the Wi-Fi MAC layer protocol to guarantee improved performance.

Modern ICT infrastructures, i.e., cyber-physical systems and critical infrastructures relying on interconnected IT (Information Technology)- and OT (Operational Technology)-based components and (sub-)systems, raise complex challenges in tackling security and safety issues. Nowadays, many security controls and mechanisms have been made available and exploitable to solve specific security needs, but, when dealing with very complex and multifaceted heterogeneous systems, a methodology is needed on top of the selection of each security control that will allow the designer/maintainer to drive her/his choices to build and keep the system secure as a whole, leaving the choice of the security controls to the last step of the system design/development. This paper aims at providing a comprehensive methodological approach to design and preliminarily implement an Open Platform Architecture (OPA) to secure the cyber-physical systems of critical infrastructures. Here, the Open Platform Architecture (OPA) depicts how an already existing or under-design target system (TS) can be equipped with technologies that are modern or currently under development, to monitor and timely detect possibly dangerous situations and to react in an automatic way by putting in place suitable countermeasures. A multifaceted use case (UC) that is able to show the OPA, starting from the security and safety requirements to the fully designed system, will be developed step by step to show the feasibility and the effectiveness of the proposed methodology.

Equipment to be installed in real-time industrial control system networks must be carefully characterized before commissioning to ensure it meets performance requirements. However, performance analysis tools may be expensive and come with stringent hardware and software requirements that render them out of reach for many small and medium enterprises. In this paper, we propose a software tool that leverages inexpensive, commonly available personal computer hardware and Linux-based, user-level open source software to enhance portability, flexibility, and ease of use without sacrificing measurement accuracy. An extensive evaluation of the tool’s custom-designed traffic generator shows that it compares favorably with related work. At the same time, the measurement system is able to achieve remarkable accuracy in determining the mean delay and delay variance of the device under test, as also demonstrated by a practical device evaluation example.

Access control (AC) is the core of every architectural solution for information security. Indeed, no effective protection scheme can abstract from the careful design of access control policies, and infrastructures underlying modern Industrial Networked Systems (INSs) are not exceptions from this point of view. This paper presents a comprehensive framework for INS access control. The proposed approach enables the description of both positive and negative AC policies, by applying the Role Based Access Control (RBAC) paradigm to typical INS implementations, while taking into account different levels of abstraction. Suitable techniques are adopted to check whether or not policies are correctly implemented in the system (verification). When conflicts are detected, possible (re)assignments of credentials to the system users are automatically computed, that can be adopted to correct anomalies (conflict resolution).