Model-based security policy configuration and enforcement in an industrial automation system

A method for configuring industrial network security, comprising:

• rendering, by a system comprising a processor, a graphical interface configured to receive security configuration data;
• receiving, by the system via interaction with the graphical interface, zone configuration input data that defines groups of industrial devices and assigns the groups to respective security zones;
• receiving, by the system via interaction with the graphical interface, conduit configuration input data that identifies a first industrial device of the industrial devices and a second industrial device of the industrial devices that are to be permitted to exchange data, wherein the first industrial device and the second industrial device are assigned to different zones of the security zones;
• referencing, by the system, security model data that defines vendor and model information for the industrial devices;
• generating, by the system based on a result of the referencing, one or more security configuration instructions based on the zone configuration input data and the conduit configuration input data, wherein the one or more security configuration instructions are configured to set respective device-level security settings on one or more of the industrial devices to allow communication between a subset of the industrial devices assigned to a same zone of the security zones in accordance with the zone configuration input data, and to allow communication between the first industrial device and the second industrial device in accordance with the conduit configuration input data;
• and
• sending, by the system, the one or more security instructions to the one or more of the industrial devices.

A non-transitory computer-readable medium having stored thereon executable instructions that, in response to execution, cause a computer system comprising at least one processor to perform operations, the operations comprising:

• displaying a graphical interface configured to receive security policy data;
• receiving, via first interaction with the graphical interface, zone configuration data that defines an assignment of sets of industrial assets to respective security zones;
• receiving, via second interaction with the graphical interface, conduit configuration data that specifies a first industrial asset of the sets of industrial assets and a second industrial asset of the sets of industrial assets that are permitted to communicate with each other, wherein the first industrial asset and the second industrial asset are assigned to different security zones of the security zones;
• referencing security model data that defines vendor and model information for industrial devices of the sets of industrial devices;
• generating, based on a result of the referencing, one or more security configuration instructions based on the zone configuration data and the conduit configuration data, wherein the one or more security configuration instructions are configured to set respective asset-level security settings on one or more of the sets of industrial assets;
• and
• sending the one or more security configuration instructions to the one or more of the industrial as sets,
• wherein execution of the one or more security configuration instructions on the one or more industrial assets sets the respective asset-level security settings to allow communication between assets of one of the sets of industrial assets assigned to a common security zone of the security zones in accordance with the zone configuration data, and to allow communication between the first industrial asset and the second industrial asset in accordance with the conduit configuration data.