Automated Security Configuration Verification for OT Networks: An Architecture and AutomationML Approach

Security configurations in operational technology (OT) networks are increasingly critical yet complex and error-prone when managed manually, often due to intricate certificate management and protocol-specific processes.This paper proposes a novel approach to automate the verification of OT security configurations, minimizing misconfigurations and enhancing the correct application of protection mechanisms. We introduce an AutomationML-based architecture to model OT environments as a digital twin, a data model capturing security configuration parameters exemplified with PROFINET including a proposed configuration for the unspecified entities, and a formal language extending predicate logic for protocol-independent rule verification. Using a Python-Prolog implementation, our automated verification tool processes an AutomationML InstanceHierarchy to detect incomplete and inconsistent configurations that preclude the establishment of secure communications. Applied to PROFINET, our prototype successfully identifies issues like unsupported algorithms or missing certificates, demonstrating applicability while remaining extensible to other protocols.