Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / Industrial 5G Jamming: Protecting Control When the Radio Fails

Transcript

Industrial 5G Jamming: Protecting Control When the Radio Fails · Cybersecurity Under Pressure. Real Attacks, Real Lessons

• 0:47
  Don't know about your week, but after the sheer volume of
• 0:49
  architecture reviews I've been drowning in, I am very ready to
• 0:52
  just sit back, decompress, and share a virtual drink with you,
• 0:57
  our listener. We somehow dragged ourselves
• 0:59
  across the finish line of another week.
• 1:01
  Barely. I mean, we survived, sure, but
• 1:03
  looking at the stack of research sitting on the desk today, I
• 1:06
  might need to make that drink a double.
• 1:08
  We are watching the industrial networking landscape undergo a
• 1:10
  complete existential crisis in real.
• 1:13
  Time. This one has it all.
• 1:14
  A real incident, a lesson nobody wants to hear, and a detail that
• 1:18
  will make you check your own systems.
• 1:20
  We're doing a deep dive into the massive tectonic shift happening
• 1:23
  across manufacturing and critical infrastructure.
• 1:27
  Basically the great migration from wired ICS to 5G.
• 1:31
  Because everyone is chasing the mobility, you know, the data
• 1:35
  density, the sub millisecond speed, but they are ripping up
• 1:38
  the Moat to build a highway and they don't quite realize what
• 1:41
  they're letting into the castle. Exactly.
• 1:43
  To unpack this, we are looking at some seriously heavy hitting
• 1:46
  data. We've got packet level analysis
• 1:48
  from the SYCS test bed that's the simulated wireless ICS
• 1:51
  environment, alongside this cutting edge research out of the
• 1:54
  University of PEDOVA on AI threat detection at the radio.
• 1:57
  Layer, right? And plus, we're tearing into the
• 1:59
  IEC 62443 standard and looking at how giants like Siemens and
• 2:04
  Palo Alto Networks are architecting real world
• 2:06
  rollouts. Because we need to look at the
• 2:08
  promise, the terrifying new vulnerabilities, and the actual
• 2:11
  blueprints for surviving this wireless frontier.
• 2:14
  We really need to start with the foundational motivation, I
• 2:17
  think, because if you sit down with a veteran OT engineer and
• 2:20
  suggest pulling out their rock solid deterministic copper
• 2:24
  Ethernet cables to replace them with probabilistic radio waves.
• 2:29
  They will laugh you out of the. Plan or literally throw you off
• 2:31
  the catwalk. They've spend decades building
• 2:34
  systems where availability and real time operation are the only
• 2:37
  metrics that actually matter, right?
• 2:39
  Confidentiality. Integrity.
• 2:41
  I mean, those are nice to haves in traditional ICS, but if a
• 2:45
  safety interlock triggers, that Profinet packet needs to arrive
• 2:48
  in under a millisecond every single time a copper wire
• 2:52
  delivers that. It's static, it's rigid.
• 2:54
  Which is precisely the bottleneck for Industry 4 point
• 2:56
  O, right? The physical wire is the
• 2:59
  ultimate constraint on flexibility.
• 3:01
  You can't have a fleet of AM Rs dragging CAT6 cables across the
• 3:04
  logistics floor like a pack of robotic dogs on tangled leashes.
• 3:08
  It physically doesn't scale. No, not at all.
• 3:10
  The industry demands autonomous mobility, digital twins
• 3:13
  ingesting high frequency telemetry, massive uplink
• 3:16
  capacity, and we all know Wi-Fi simply cannot handle
• 3:19
  deterministic sub millisecond control loops.
• 3:22
  Oh, absolutely not. Wi-Fi Mac layer scheduling is
• 3:25
  essentially a polite conversation.
• 3:27
  CSM Maggie is just devices yelling over each other and
• 3:29
  backing off when they collide. Yeah, and it operates an
• 3:32
  unlicensed spectrum, which means a forklift's reversing beacon or
• 3:35
  a microwave in the break room can completely destroy your
• 3:38
  jitter budget. That is why 3 GPP release 16 and
• 3:43
  17 position 5G as the true successor.
• 3:46
  We aren't just talking about broader bandwidth.
• 3:47
  We're talking URLLC, right? Ultra reliable low latency
• 3:51
  communication. Exactly the entire frame
• 3:53
  structure of the 5G new radio was redesigned with many slots
• 3:56
  and preemption mechanisms to guarantee that a critical safety
• 4:00
  payload can bump routine traffic out of the way on the air
• 4:03
  interface. And this isn't just white paper
• 4:05
  theory anymore. For you listening, the sources
• 4:07
  detail actual live pilot deployments.
• 4:09
  Look at Siemens in their Fernberg test center.
• 4:12
  They bypassed the commercial carriers entirely and deployed a
• 4:14
  private 5G standalone network and SA architecture using the
• 4:18
  3.7 to 3.8 gigahertz industrial band.
• 4:21
  The standalone distinction is critical there.
• 4:24
  By deploying A5G core on premises, they ensure the user
• 4:28
  plane function. The UPF routes the industrial
• 4:31
  traffic locally. It never leaves the building.
• 4:33
  Right. It never backhauls to a telecom
• 4:35
  operators regional data center because if your procinet traffic
• 4:38
  has to bounce to a telecom hub and back, you've already blown
• 4:41
  past your one millisecond latency budget just in fiber
• 4:45
  transit time alone. Then look at Gaston in
• 4:48
  Barcelona. They partnered with Telefonica
• 4:50
  to hook up robotic welding cells to 5G.
• 4:53
  The robots stream high resolution point clouds and
• 4:56
  torque feedback to a digital twin in real time.
• 4:59
  That's a massive amount of data. It is the twin instantly runs
• 5:02
  finite element analysis and dynamically adjusts the welding
• 5:05
  parameters for the very next car chassis down the line.
• 5:08
  Legacy systems would buckle under the payload.
• 5:10
  The sheer volume of uplink throughput required for
• 5:13
  uncompressed sensor fusion like that is staggering.
• 5:16
  And we also have AT&T and Samsung deploying millimeter
• 5:19
  wave 5G in Texas for mixed reality training.
• 5:22
  They're using augmented reality headsets on the factory floor,
• 5:26
  streaming live video overlays and high def feeds back to a
• 5:29
  remote expert. Completely untethered, pushing
• 5:33
  multi Gigabit throughput without dropping a single frame of
• 5:36
  render. Operational agility is
• 5:39
  undeniably revolutionary. It allows manufacturers to
• 5:42
  reconfigure an entire assembly line over a weekend without
• 5:46
  pulling new conduit. But, and this is the massive
• 5:49
  looming but hanging over this whole transition for you and
• 5:52
  your teams, cutting those physical Ethernet cables to the
• 5:55
  machinery feels exactly like cutting an umbilical.
• 5:58
  Cord. It's the perfect way to frame.
• 5:59
  It think about it. The umbilical cord is
• 6:01
  restrictive, yes, but it provides a closed, protected,
• 6:04
  highly predictable environment. You cut it and suddenly you're
• 6:07
  robots can roam anywhere, your digital twins are breathing live
• 6:11
  data and you are totally liberated, but you are now
• 6:13
  completely exposed to the elements.
• 6:14
  Yeah, the physical trust boundary of that closed copper
• 6:17
  loop is just gone. The architectural shift
• 6:19
  fundamentally alters the threat model.
• 6:21
  It does. By moving to non public
• 6:23
  networks, NP NS companies gain data sovereignty, keeping their
• 6:28
  proprietary manufacturing telemetry off commercial
• 6:30
  networks, but they simultaneously move the OT risk
• 6:34
  to a domain that industrial security teams have absolutely
• 6:37
  no experience defending. The radio layer.
• 6:39
  The radio frequency layer. For 30 years, securing a plant
• 6:42
  meant physical air gaps, port security, MSC filtering and
• 6:46
  preventing rogue USD drives. Now the attack surface is the
• 6:50
  actual atmosphere inside the facility.
• 6:53
  The air itself, the physical perimeter of the building, no
• 6:55
  longer defines the network boundary.
• 6:57
  Our app bleeds through drywall. It bounces off metal silos.
• 7:01
  Which brings this to the core issue.
• 7:03
  Since the risk has shifted to a probabilistic medium like radio,
• 7:06
  we have to examine what happens when that medium is compromised.
• 7:09
  What does the cyber attack in the air actually do to the
• 7:12
  kinetic physical machinery? This is where the sex we ICS
• 7:15
  testbed research provides some terrifying clarity.
• 7:18
  Simulated wireless ICS. The researchers built a highly
• 7:21
  accurate virtual environment of a 5G enabled industrial loop and
• 7:25
  ran attacks against it under 2 conditions.
• 7:27
  Right, A5 GGC representing a good channel and A5 GDC graded
• 7:32
  channel. And they mapped this against a
• 7:34
  classic kinetic process, a bottle filling station.
• 7:37
  It's a textbook control loop. A conveyor belt moves a glass
• 7:41
  bottle. A proximity sensor detects the
• 7:43
  bottle's edge and fires a signal to the PLC.
• 7:46
  The PLC calculates the timing and sends a command to halt the
• 7:49
  conveyor motor. A valve actuates, liquid fills
• 7:52
  the bottle, the valve closes and the belt resumes.
• 7:55
  It requires incredibly tight synchronization between the
• 7:58
  sensor pulling rate and the actuator response time.
• 8:01
  Under a traditional wired set, or even a flawless 5G good
• 8:05
  channel, the system is remarkably resilient to basic
• 8:08
  network layer attacks. If an attacker manages to launch
• 8:11
  a volumetric denial of service, Oregon injects a machine in the
• 8:13
  middle payload, say, spoofing A continuous keep moving command
• 8:17
  to the motor. The PLC is pulling and
• 8:19
  transmitting its legitimate stop commands so rapidly, often every
• 8:22
  millisecond, that the legitimate traffic simply overwrites the
• 8:26
  malicious injection before the physical inertia of the motor
• 8:28
  can even respond. Exactly.
• 8:30
  The network speed and reliability act as a natural
• 8:33
  kinetic buffer. The bottle stops exactly under
• 8:36
  the nozzle. No liquid spills.
• 8:38
  The determinism of the network mitigates the attack payload.
• 8:41
  But introduce the 5G degraded channel, a noisy RF environment.
• 8:46
  This could be natural multipath fading because a massive metal
• 8:49
  crane moved across the factory floor, or maybe heavy cell
• 8:52
  congestion. And the entire control theory
• 8:55
  falls apart. The attacker initiates the same
• 8:57
  Dos flood. The ingress queues of the UPF
• 9:00
  start to fill up. Now compound that with the
• 9:02
  degraded radio channel. The module coding scheme drops
• 9:06
  to compensate for the noise, which drastically reduces
• 9:08
  bandwidth. The Mac layer starts executing
• 9:11
  HRRQ retransmissions because packets are failing checksums.
• 9:15
  The latency spikes unpredictably.
• 9:16
  The jitter budget is completely blown.
• 9:18
  The PLC fires the critical stop command when the sensor detects
• 9:22
  the bottle. But that packet gets caught in
• 9:24
  HRQ retransmission loop. It's delayed by maybe 40 or 50
• 9:27
  milliseconds. In human terms it's a blink.
• 9:30
  In industrial terms, it's an eternity.
• 9:32
  Wow. The conveyor motor doesn't
• 9:34
  receive the halt command in time.
• 9:36
  It keeps rolling right past the filling station.
• 9:39
  The valve logic executes because it assumes the bottle is in
• 9:42
  position. And you have a kinetic failure,
• 9:44
  a catastrophic liquid spill on the factory floor, potentially
• 9:48
  damaging equipment or causing a safety hazard.
• 9:51
  So the attacker didn't need a highly sophisticated Stuxnet
• 9:55
  level 0 day exploit targeting the PLC firmware.
• 9:58
  They simply threw garbage volumetric traffic at a network
• 10:02
  that was already struggling to maintain RF integrity, and the
• 10:06
  physics of the factory tore itself apart.
• 10:08
  The degraded channel didn't just facilitate the attack, it
• 10:10
  amplified it into a fiscal disaster, which forces us to
• 10:13
  confront how completely broken our traditional defense
• 10:16
  mechanisms are in this environment.
• 10:18
  Look at standard intrusion detection systems.
• 10:20
  Traditional anomaly detection. Right.
• 10:22
  Industrial IDs platforms rely almost exclusively on deep
• 10:25
  packet inspection and strict time series analysis.
• 10:29
  In a wired profit a cell, the PLC sends a polling packet every
• 10:32
  10 milliseconds. Not 10.5 5, not 11, exactly
• 10:36
  10.00. So the IDs builds A baseline
• 10:38
  around that deterministic interval.
• 10:40
  Precisely if it suddenly sees packets arriving at 12
• 10:44
  milliseconds or a spike in inter arrival jitter, the statistical
• 10:48
  models immediately flag it as an anomaly.
• 10:51
  The assumption is that an attacker is manipulating the
• 10:53
  queues or injecting traffic. Wait, no, that's not right.
• 10:56
  If the network is jittery, shouldn't the IDs be more
• 10:58
  sensitive? That is the exact vulnerability
• 11:01
  the IES screams constantly in a 5G architecture.
• 11:05
  A timing anomaly does not correlate to malicious activity,
• 11:08
  it correlates to the physics of radio waves.
• 11:10
  It could be a brief shadow fading event as an AMR drives
• 11:14
  behind a stamping press. It could be a handover delay as
• 11:17
  a sensor transitions from 1G node D to another.
• 11:19
  The baseline of normal is no longer a flat line, it's a
• 11:23
  highly volatile stochastic wave. And the ambiguity of that
• 11:26
  wireless medium gives the attacker the ultimate
• 11:29
  camouflage. Exactly.
• 11:30
  They can hide their injected packets or volumetric floods
• 11:33
  directly inside the natural variance of the radio
• 11:36
  instability. If you deploy a legacy IDs on a
• 11:38
  5G network, you're going to generate thousands of false
• 11:41
  positives an hour. The security operations center
• 11:44
  will experience total alert fatigue.
• 11:46
  They'll just filter out the alerts or tune the sensitivity
• 11:49
  so low that the system becomes practically useless.
• 11:52
  It's a psychological coping mechanism for the SoC analysts,
• 11:56
  but it's a fatal blind spot for the network architecture.
• 11:59
  And if the attackers know they can hide in the RF noise, the
• 12:02
  logical next step is intentionally manufacturing that
• 12:05
  noise to create an opening. Which brings us to the nightmare
• 12:09
  scenario for wireless ICS, physical layer jamming.
• 12:12
  We just established that availability is the Holy Grail
• 12:15
  of OT, and jamming is a direct kinetic assault on availability.
• 12:20
  The reconnaissance phase alone is chilling.
• 12:22
  An attacker does not need to compromise a firewall or
• 12:25
  spearfishing operator. They can park a vehicle on a
• 12:27
  public St. adjacent to the factory perimeter with a
• 12:30
  software defined radio and just passively monitor the 5G
• 12:33
  spectrum. Even if the payload data is
• 12:35
  heavily encrypted with IP SAC or MA SAC, the physical radio
• 12:38
  bursts aren't. Right.
• 12:39
  They conduct traffic analysis on the control channels.
• 12:42
  They monitor the physical downlink control channel, the
• 12:44
  PDCCH. By observing the scheduling of
• 12:47
  resource blocks, they can infer the precise mechanical cycle of
• 12:51
  the factory. That's terrifying.
• 12:53
  They can map the exact microsecond the bottle hits the
• 12:56
  sensor, the valve actuates and the robotic arm swings purely by
• 13:00
  watching the RF energy spikes. They map the entire heartbeat of
• 13:04
  the assembly line from the parking lot.
• 13:05
  I always picture jamming as a brute force unsophisticated
• 13:09
  attack, like some guy with a massive amplifier screaming
• 13:12
  white noise across the entire 100 megahertz band drowning out
• 13:16
  everything. That is traditional undirected
• 13:19
  wide band jamming. It requires immense power.
• 13:22
  The Podova research notes. It takes around 55 DDBMR to
• 13:25
  reliably saturate a cell that's highly detectable.
• 13:28
  Yeah, regulatory bodies like the FCC or local spectrum
• 13:31
  authorities will triangulate A55DB MV main wide band emitter
• 13:34
  almost immediately, right? But within minutes.
• 13:36
  But the researchers highlight a threat vector that is surgically
• 13:39
  precise narrow band jammers targeting control structures.
• 13:42
  OK, let's get into this, because this is the part that will make
• 13:45
  you rethink your entire wireless strategy. 5G networks rely on
• 13:49
  specific periodic broadcasts to maintain synchronization between
• 13:53
  the user equipment and the base station.
• 13:55
  The most critical is the Signal Synchronization Block, or SSB.
• 14:00
  It contains the primary and secondary sync signals and the
• 14:03
  broadcast channel is the absolute anchor of the cell.
• 14:06
  OK, so if a device cannot decode the SSB, what happens?
• 14:11
  It considers the cell lost and drops the connection entirely,
• 14:14
  forcing a lengthy reattachment procedure.
• 14:16
  So the attacker doesn't need to jam the massive data payloads,
• 14:19
  they just take scalpel and slice the synchronization heartbeat.
• 14:22
  Combined with a directed MIMO antenna array, multiple input,
• 14:25
  multiple output, they can use beam forming to focus that
• 14:28
  interference into a highly concentrated created spatial
• 14:31
  beam aimed through a specific window directly at a critical
• 14:34
  manufacturing cell. And this brings us back to the
• 14:36
  stat from the cold open. A directed MIMO jammer focused
• 14:39
  specifically on the SSB can force a denial of service
• 14:42
  pulling just 30 DB meters of power.
• 14:44
  That is 1 Watt. You can power a 32 billion SDR
• 14:46
  off a standard USB power bank. If it's in a shoe.
• 14:49
  Box. Exactly.
• 14:50
  If it's in a shoe box, it can be hidden in a backpack on a
• 14:52
  visitor or a drone landed on the roof.
• 14:55
  And because the power output is so incredibly low and the beam
• 14:58
  is so tight, the traditional IT network monitoring tools won't
• 15:02
  register an anomaly. They won't see malformed packets
• 15:05
  or volumetric spikes. The targeted machine simply
• 15:08
  drops off the network. The operators will assume a
• 15:11
  sensor failed or a switch died. They will dispatch maintenance,
• 15:15
  not incident response. So how do you defend against an
• 15:18
  invisible low power sniper that targets the fundamental physics
• 15:22
  of your connectivity? You have to push threat
• 15:24
  detection down to the physical layer using machine learning.
• 15:28
  The research from the University of Podova specifically tested
• 15:31
  various AI models to detect these stealthy narrow band SSB
• 15:34
  jammers by analyzing the radio spectrograms in real time.
• 15:38
  Spectrogram, so visualizing the radio waves.
• 15:40
  Yes, they benchmarked convolutional neural networks, K
• 15:44
  nearest neighbors and support vector machines.
• 15:46
  Why wouldn't they just default to ACNN?
• 15:49
  Computer vision models are incredibly good at recognizing
• 15:52
  patterns in 2D data like a spectrogram.
• 15:54
  CNN's are highly accurate, but performing deep convolutions on
• 15:59
  high dimensional fast 4A transformer rays requires
• 16:02
  massive computational overhead. You were talking about millions
• 16:06
  of multiply accumulate operations.
• 16:08
  Which you can't exactly run on a tiny edge switch.
• 16:11
  No. In an industrial edge
• 16:13
  environment you might have hundreds of radio notes.
• 16:16
  You cannot deploy massive GPU clusters to every single edge
• 16:19
  switch just to run inference on RF noise.
• 16:23
  The latency and cost are prohibitive.
• 16:24
  So they needed a model that was computationally cheap but highly
• 16:27
  accurate, and the support vector machine went out.
• 16:30
  But not just a raw SVM, they combined it with Principal
• 16:33
  Component Analysis, or PCA for aggressive dimensionality
• 16:36
  reduction. Let's drill into that, because
• 16:38
  applying PCA to RF interference is fascinating for anyone
• 16:41
  looking at signal processing. Most background RF noise is
• 16:44
  highly random thermal noise, random multipath scattering.
• 16:48
  But a narrow band jammer transmitting a continuous or
• 16:50
  periodic signal over the SSB creates a highly correlated
• 16:54
  structure in the data. So PCA computes the covariance
• 16:57
  matrix of the spectrogram and extracts the eigenvalues.
• 17:00
  It strips away all the high dimensional random noise and
• 17:03
  isolates the principal components, essentially the core
• 17:06
  vector of the jamming signal. It compresses the massive image
• 17:09
  of the spectrum down to just the mathematical essence of the
• 17:12
  interference. Exactly, and passes that reduced
• 17:14
  feature set to the SVM. The SV Ms. only job is to find
• 17:18
  the optimal hyperplane that separates the normal data points
• 17:21
  from the jam data points. It is a convex optimization
• 17:25
  problem that requires very little compute power at
• 17:28
  inference time. What does that translate to in
• 17:30
  terms of detection speed? Because as we discussed the
• 17:33
  bottle filler, if it takes a full second to detect the
• 17:35
  jammer, the liquid is already on the floor.
• 17:38
  The PCASVM pipeline detects the narrowband jammer in 0.11
• 17:42
  milliseconds. 1/10 of a millisecond.
• 17:44
  That is astonishing. With 95 to 97.6% accuracy it
• 17:49
  provides the sub millisecond physical layer radar required to
• 17:51
  actually trigger a fail or switch the device to a backup
• 17:55
  frequency before the kinetic process derails.
• 17:57
  But spotting the jammer only covers the availability attack
• 18:00
  vector. What happens if the attacker
• 18:02
  actually compromises a node? Say they exploit a vulnerability
• 18:06
  in a legacy PLC that was bridged under the 5G network, or they
• 18:09
  spoof the credentials of a temperature sensor, right?
• 18:11
  The lateral movement problem. Yeah, in a traditional flat
• 18:14
  industrial network, once you pop 1 device you can pivot and scan
• 18:17
  everything else. How do we prevent lateral
• 18:20
  movement over the air? This is where the 3G GPP 5G
• 18:24
  architecture actually provides a massive structural defensive
• 18:27
  advantage over traditional wired Ethernet or Wi-Fi.
• 18:31
  It's called network slicing. The ability to create multiple
• 18:34
  logically isolated virtual networks on the exact same
• 18:37
  physical radio and core infrastructure.
• 18:39
  It uses a mechanism called NSSAI, the Network Slice
• 18:43
  Selection Assistance Information.
• 18:45
  Usually enterprises use this macro level slicing.
• 18:49
  They'll create one slice with high bandwidth for video
• 18:51
  cameras, one slice with low latency for the robots, and
• 18:54
  maybe a best effort slice for employee tablets.
• 18:57
  But the research suggests taking that concept the absolute
• 19:00
  microscopic extreme, doesn't it? Nano segmentation, yes.
• 19:04
  Instead of grouping 50 sensors into one slice, you provision A
• 19:08
  dedicated, mathematically isolated 5G slice for every
• 19:12
  single piece of user equipment, one UE per slice.
• 19:17
  That is a logistical paradigm shift for any network architect
• 19:20
  listening to this Every single AMR, every individual PLC, every
• 19:24
  valve controller gets its own personal network.
• 19:28
  Either the ultimate realization of a Zero Trust architecture and
• 19:31
  forced it to cellular core, the access and mobility management
• 19:34
  function, the AMF, and the section management function for
• 19:37
  strict isolation for the PDU sessions.
• 19:39
  If an attacker compromises a temperature sensor, they're
• 19:42
  trapped in a routing domain of 1.
• 19:44
  Hold on, if every device is in solitary confinement, how do
• 19:47
  they interact? The AM Rs have to coordinate
• 19:49
  their paths so they don't crash at intersections.
• 19:51
  They don't communicate peer-to-peer at the network
• 19:53
  layer. The slice only permits routing
• 19:55
  to the specific back end application like the fleet
• 19:57
  manager server. The fleet manager ingested
• 20:00
  telemetry from all the isolated slices, calculates the logic,
• 20:03
  and sends the individual movement commands back down.
• 20:06
  The devices never actually see each other on the network.
• 20:08
  O Even if you have root access on the sensor, you can't ping
• 20:11
  the robot arm. You can't run an nmap scan of
• 20:14
  the subnet because there is literally no subnet.
• 20:17
  Lateral movement becomes mathematically impossible at the
• 20:20
  radio and core layers. You combine that nano
• 20:22
  segmentation with rigorous identity management, certificate
• 20:26
  based mutual authentication and MFA for any human access and you
• 20:31
  effectively neutralize the blast radius of a compromised edge
• 20:34
  device. The concept is brilliant, but
• 20:37
  deploying and managing 10s of thousands of individual slices,
• 20:40
  Managing the cryptographic certificates for every sensor?
• 20:43
  You can't just wing that. You need a structural framework
• 20:46
  to ensure you aren't leaving gaping holes in the
• 20:48
  configuration. Which is exactly why the
• 20:51
  transition to industrial 5G leans so heavily on the IEC
• 20:55
  62443 standard. The absolute bedrock of OT
• 20:58
  cybersecurity. I swear, you walk into any
• 21:00
  industrial security conference and people are just murmuring
• 21:03
  62443 like a mantra. Because it works.
• 21:06
  It's a comprehensive series of international standards
• 21:08
  specifically designed for industrial automation and
• 21:11
  control systems IACS. What makes it vital for the 5G
• 21:16
  transition is that it doesn't just mandate technical features
• 21:19
  like encryption algorithms. It defines the entire
• 21:22
  organizational life cycle, processes and responsibilities.
• 21:27
  The sources are highly specific about how it divides the
• 21:29
  ecosystem into 3 principal roles.
• 21:31
  You have the asset owner, the manufacturing company actually
• 21:34
  running the plant, you have the product supplier, the vendors
• 21:38
  manufacturing the 5G base stations, the core software and
• 21:41
  the PLCS. And you have the integrator, the
• 21:43
  engineering firms that stitch the hardware and software
• 21:45
  together. And everyone holds a distinct
• 21:47
  liability. The asset owner cannot just buy
• 21:50
  a quote UN quote secure 5G router from a supplier, plug it
• 21:53
  in and claim compliance. The integrator has to validate
• 21:56
  the architecture and the ad fed owner has to maintain the
• 21:58
  operational security continuously.
• 22:00
  And the standard measures this operational maturity through its
• 22:03
  four maturity levels, right? Yes.
• 22:06
  ML1 is initial. It's ad hoc processes are
• 22:10
  undocumented, reactive, and highly dependent on individual
• 22:14
  heroes in the IT department putting out fires.
• 22:16
  Chaos engineering, basically. We've all been there.
• 22:18
  Yeah, we have. ML 2 is managed.
• 22:21
  You have documented guidelines, trained personnel, and
• 22:23
  repeatable processes for things like patch management or
• 22:26
  incident response. ML3 is defined and practiced.
• 22:29
  The processes are standardized across the entire global
• 22:32
  organization and you have the audit trails to prove it.
• 22:34
  And ML4IS improving. You are just following a
• 22:38
  checklist. You are continue ingesting
• 22:40
  telemetry, analyzing near misses, and proactively evolving
• 22:44
  the security posture against emerging threats.
• 22:46
  Parallel to the process maturity, IEC 62443 defines
• 22:50
  technical security levels SLS for the actual resistance of the
• 22:53
  architecture. SL1 mitigates casual or
• 22:56
  accidental misuse and operator typing the wrong IP address.
• 22:59
  SL2 targets simple intentional attacks with low resources
• 23:02
  script kiddies running automated exploits.
• 23:04
  SL3 scales up to sophisticated means, moderate resources and
• 23:08
  specific IACS knowledge. This is where you face dedicated
• 23:12
  cyber criminal syndicates or ransomware gangs that understand
• 23:15
  how to manipulate Prophinet or Modus.
• 23:17
  And SL4IS the apex protection against highly motivated,
• 23:21
  extensively resourced attackers using sophisticated prolonged
• 23:24
  campaigns. Nation state actors advanced
• 23:28
  persistent threats. The challenge we face today is
• 23:31
  mapping the legacy concepts of IEC 62443 onto a 5G
• 23:36
  architecture. The standard relies
• 23:38
  fundamentally on the concept of zones and conduits.
• 23:41
  Right. A zone is a logical grouping of
• 23:43
  assets that share the same security requirements.
• 23:46
  All the robotic welders in cell A are in one zone.
• 23:48
  A conduit is the authorized communication path between
• 23:51
  zones. In the legacy wired world, a
• 23:52
  conduit was literally a copper uplink cable plugged into an
• 23:55
  industrial firewall. You configure an access control
• 23:58
  list on that physical port and you have secured the conduit.
• 24:01
  But in a 5G deployment, the conduit is probabilistic.
• 24:04
  It's shared spectrum. The conduit is the air itself.
• 24:07
  You cannot put a physical firewall rule on a radio wave.
• 24:10
  So how do you define a conduit when the transmission medium
• 24:12
  bleeds through the walls? You have to abstract the conduit
• 24:16
  away from the physical layer and tie it to cryptographic
• 24:19
  identity. The conduit now encompasses the
• 24:21
  physical radio coverage, yes, but more importantly it includes
• 24:25
  the device identity management, the life cycle of the subscriber
• 24:28
  credentials, and the edge computing routing rules.
• 24:31
  Securing the conduit means securing the fundamental route
• 24:34
  of trust of the device attempting to access the
• 24:37
  spectrum. Which brings us to the
• 24:39
  convergence of telecom authentication and industrial
• 24:42
  authentication. 5G inherently has robust security protocols
• 24:46
  like 5G AKA Authentication and Key Agreement or EAPAKA.
• 24:52
  They use a challenge response mechanism with sequence numbers
• 24:55
  to prevent replay attacks validating the device against
• 24:58
  the authentication server function in the core.
• 25:00
  But those protocols traditionally only authenticate
• 25:03
  the telecom hardware to the telecom network.
• 25:05
  They don't authenticate the industrial application to the
• 25:07
  industrial controller. The massive push right now is
• 25:10
  bridging those domains using hardware roots of trust,
• 25:13
  specifically the UICC. The universal integrated circuit
• 25:17
  card. The tamper resistant physical
• 25:20
  SIM or E SIM inside the industrial modem.
• 25:23
  The industry is developing a generic trust Anchor API.
• 25:27
  This allows the industrial application layer, say an OPC UA
• 25:31
  Pub sub client running on a robot, to access the secure
• 25:35
  enclave of the telecom UICC. The Industrial Protocol can use
• 25:39
  the telecom Sims cryptographic capabilities to sign its own
• 25:43
  payloads or established TLS session.
• 25:44
  OK, I need to visualize this. Let's use an analogy.
• 25:47
  Think of the legacy wired network like an exclusive
• 25:49
  nightclub. We're really going with a
• 25:51
  nightclub. Stick with me.
• 25:52
  It works in the legacy Wired architecture.
• 25:55
  Perimeter security was like having a massive, intimidating
• 25:57
  bouncer at the front door. He checks IDs at the perimeter,
• 26:00
  but once you are inside the club, it's a trusted zone.
• 26:03
  You can wander over to the bar, you can walk into the VIP
• 26:05
  section, you can talk to anyone. The classic M&M model.
• 26:08
  Hard, crunchy exterior, soft, vulnerable interior.
• 26:11
  Once an attacker breaches the perimeter firewall, they have
• 26:14
  free reign to pivot. Exactly, but with 5G nano
• 26:17
  segmentation and the generic trust anchor API tying the
• 26:20
  industrial payload to the hardware SIM, we aren't just
• 26:23
  relying on the bouncer at the front door.
• 26:25
  We are upgrading to assigning a personal, highly trained,
• 26:29
  heavily armed bodyguard to every single VIP inside the club.
• 26:34
  The bodyguard represents the secure enclave of the UICC
• 26:38
  executing the cryptography. Right, The bodyguard checks your
• 26:40
  5G AKA credentials before you can even step onto the dance
• 26:43
  floor. And because of nano
• 26:45
  segmentation, if you want to talk to another VIP across the
• 26:48
  room, you can't just walk over. Your bodyguard has to
• 26:51
  cryptographically negotiate with their bodyguard via the central
• 26:54
  security broker before a single word is exchanged.
• 26:57
  It is the absolute enforcement of zero trust at the hardware
• 27:00
  layer mapped directly to a radio layer.
• 27:02
  And it is mandatory because the club is no longer a concrete
• 27:05
  building with a single door. The club is wherever the RF
• 27:09
  signal propagates. It's brilliant in theory, but
• 27:12
  theory doesn't manufacture automotive chassis or fill
• 27:14
  bottles. A blueprint is just APDF until
• 27:17
  someone actually writes the code, builds the hardware, and
• 27:19
  drops it onto a loud, vibrating, dirty factory floor.
• 27:23
  And this is where we see the theoretical frameworks of 62443
• 27:27
  manifesting in actual deployable enterprise architectures.
• 27:31
  The vendors recognize that IT and OT can no longer operate in
• 27:35
  silos. The sources highlight the
• 27:37
  collaboration unveiled at Mobile World Congress between Siemens
• 27:40
  and Palo Alto Networks. This is the collision of a
• 27:43
  massive industrial automation legacy with top tier IT
• 27:46
  cybersecurity. How are they actually
• 27:48
  integrating this? They are merging Siemens private
• 27:51
  5G infrastructure, the distributed unit, central unit
• 27:54
  and 5G core with Palo Alto's AI optimized next generation
• 27:58
  firewalls. But you can't just take a
• 28:00
  standard IT Palo Alto appliance, drop it in line between a PLC
• 28:04
  and a high speed robotic arm, and turn on deep packet
• 28:07
  inspection. The firewall would induce so
• 28:10
  much processing latency that the control loop would instantly be
• 28:13
  sync. That is the core engineering
• 28:15
  challenge. The NGFW has to be optimized for
• 28:17
  the specific deterministic traffic patterns of industrial
• 28:20
  protocols, but the crucial innovation in their architecture
• 28:23
  is how they deploy the CNET Security Monitor.
• 28:26
  Synex How does it inspect the traffic without breaking the
• 28:28
  jitter budget? By operating entirely out of
• 28:31
  band it utilizes passive, non intrusive anomaly detection.
• 28:36
  Instead of sitting in line on the user plane function and
• 28:38
  acting as a physical bottleneck, the UPF mirrors the industrial
• 28:42
  traffic via a span port or tap to the cynic monitor.
• 28:47
  So it's just a copy of the traffic.
• 28:48
  Exactly. Cynic performs the deep packet
• 28:51
  inspection on the mirrored payload.
• 28:52
  It maps the assets, identifies unauthorized protocol usage, and
• 28:56
  scans for malware signatures asynchronously.
• 29:00
  It provides complete visibility into the industrial application
• 29:03
  layer without ever inserting a single microsecond of delay into
• 29:06
  the live Profnet control loop. So going back to the analogy,
• 29:09
  the cynic monitor is the eye in the sky camera system watching
• 29:12
  the bodyguards in the club. It observes everything, detects
• 29:15
  suspicious behavior and alerts security, but it never stops the
• 29:18
  patrons to frisk them while they are dancing.
• 29:20
  Because in manufacturing, if you stop the dance, you bleed
• 29:23
  revenue. Which brings us to the most
• 29:25
  profound realization of this entire architectural shift.
• 29:29
  In traditional enterprise IT, cybersecurity is heavily biased
• 29:32
  toward confidentiality. The primary objective is
• 29:36
  preventing data exfiltration. Don't let the threat actors
• 29:39
  steal the customer database or the intellectual property.
• 29:42
  But on the OT side. On the OT side, a momentary
• 29:44
  disruption does not have to result in kinetic damage to be
• 29:48
  considered a catastrophic success for the attacker.
• 29:50
  If a 30 DBM, A narrow band jammer forces a robotic cell to
• 29:54
  drop its connection for two seconds, or a malformed packet
• 29:57
  triggers a safety interlock that holds a conveyor.
• 30:00
  The material flow stops the sequencing of the entire plant,
• 30:03
  D syncs. The batch of pharmaceuticals is
• 30:05
  ruined because it's sat outside the temperature parameters for
• 30:08
  too long. The attacker doesn't need to
• 30:09
  encrypt a single hard drive with ransomware, they just need to
• 30:12
  introduce enough latency to break the physical timing.
• 30:15
  In the industrial 5G era, cybersecurity becomes completely
• 30:19
  indistinguishable from operational uptime.
• 30:21
  If the network stutters, the factory dies.
• 30:24
  Security is uptime. It's the darkest irony of
• 30:27
  Industry 4 Point O. We spent decades designing these
• 30:31
  incredible autonomous, self optimizing digital twins to make
• 30:35
  manufacturing effortless, to make our Fridays easier.
• 30:38
  And instead, we've engineered a reality where we spend our
• 30:41
  Fridays sweating over invisible radio waves, sub millisecond HRQ
• 30:46
  retransmissions, and physical layer jamming from a shoebox in
• 30:49
  the parking lot. We successfully traded the
• 30:52
  physical constraints of copper cabling for the mathematical
• 30:55
  anxiety of probabilistic spectrum.
• 30:56
  You really did. But for everyone listening right
• 30:59
  now, whether you are architecting a Greenfield 5G
• 31:01
  deployment, managing a legacy planet, or just trying to keep
• 31:04
  your digital twins breathing, here is the reality check.
• 31:07
  The foundational question is not whether industrial 5G works
• 31:10
  Florida State on a clear day. The throughput and agility are
• 31:14
  spectacular when the channel is clean.
• 31:15
  The real question is how your kinetic machinery behaves when
• 31:18
  the radio layer inevitably degrades.
• 31:20
  Do you have define deterministic fall back modes when the air
• 31:23
  itself becomes hostile, either through natural interference or
• 31:26
  a directed 30 DBM attack? What is the recovery logic?
• 31:29
  You can no longer treat the network as a transparent
• 31:31
  utility. The private 5G core is critical
• 31:34
  OT infrastructure. You have to design the physical
• 31:38
  safety interlocks assuming the wireless signal will eventually
• 31:40
  fail. Check your systems, check your
• 31:42
  assumptions, and maybe, just maybe, question whether what you
• 31:45
  trusted yesterday is still trustable today.
• 31:48
  That's all for this episode of Cybersecurity Under Pressure.
• 31:50
  Real attacks, real Lessons. See.
• 31:53
  You in the next chapter.