Operating distributed systems securely: with containers and edge platform

Machines, plants and operating sites spread across many locations need secure connectivity, local computing power and central management. The integrated edge platform secunet edge from secunet combines hardened hardware with container management from Portainer.io and standardizes operations across large numbers of sites.

Applications can be installed, configured, updated and monitored centrally. At the same time, the platform protects networks, controls data flows and separates network segments from one another. System integrators, service providers and manufacturers gain a uniform basis for new plants and for retrofitting existing systems. The solution is proven in production use and available through system integrators. Projects with several thousand connected devices are running in critical infrastructure sectors such as eHealth, MedTech, smart manufacturing and public-sector environments.

The challenge: keeping distributed data processing under secure control

Companies in many industries operate sites and technical systems across different regions or countries. As a result, data processing is shifting further and further towards the edge of the network. This principle is known as edge computing. Data is processed directly on computer systems at the operating site rather than in a central application or in the cloud.

This creates a new challenge for companies that run applications at many distributed sites. They look after hundreds or thousands of local systems that have to be securely connected to central systems or cloud services. At the same time, additional applications run directly at the point of use. One service provider in the healthcare sector, for example, looks after several thousand dental practices in exactly this way, and has to connect, secure and supply them with local applications from a central point.

Heterogeneous edge environments make operations harder

Without a standardized edge platform, the result is often a patchwork of one-off solutions that brings the following challenges:

• Different hardware generations, operating systems, communication protocols and security requirements all come together at the individual sites.
• In industrial environments, modern applications frequently have to work with older machines and production networks that have grown organically over time.
• When something goes wrong, it is often unclear where an application is installed and how the site in question is set up technically.
• The various vendors involved may each suspect the cause of a fault in a different area. Troubleshooting therefore takes longer.
• AI-based attacks on edge systems that are hard to keep track of and time-consuming to maintain create an elevated cyber security risk. They call for fast, effective response capability across every endpoint in the field.

Companies that deploy an edge platform can draw on secure connectivity, local applications, central control and uniform security mechanisms.

The solution: an edge platform that combines security and container management

Security provider secunet has developed the secunet edge appliance. Under its strategic partnership with container specialist Portainer.io, that company's container management is natively integrated into the secunet Edge Management Suite (EMS). The result is a hardened infrastructure that Portainer extends with central container and application management. It brings together the previously separate layers of edge hardware, network and system security, fleet management, container orchestration and application operations. Both components are technically matched to one another and work as an integrated service.

The edge appliance protects the network and local applications

The technical basis is secunet edge, a hardware and software platform for deployment at the edge of a network. The edge appliance sits close to the systems it is there to protect. These can be machines, production lines, medical devices, pumps, local networks or entire operating sites. The platform combines secure communication with local computing power and handles the following functions:

• Secure connectivity for distributed systems: secunet edge connects local devices to data centers or cloud services. In doing so, it protects the communication paths and controls the exchange of data.
• Firewall and network segmentation: The edge appliance provides firewall functions and separates network zones from one another. Connections can be set up on a least-privilege basis.
• Protected local execution of applications: secunet edge provides a secure execution environment for applications such as network monitoring, data analytics, remote maintenance, AI or connection to IoT platforms. It thereby replaces several separate devices.
• Centralized fleet management: secunet's Edge Management Suite (EMS) detects new appliances, onboards them into central administration and makes them configurable. Network and firewall settings as well as technical parameters can thus be managed centrally for hundreds or thousands of devices.
• Monitoring and hardening: The EMS monitors numerous parameters of the hardware and the base system. On top of that, there are security functions such as secure boot, integrity protection, device identities, encrypted storage areas and signed system updates.

Security is a fundamental design principle of secunet edge. This security-by-design approach covers hardware, network and application environment alike and addresses the security requirements that apply in critical infrastructure as well as at machine and plant manufacturers.

Container management controls applications centrally

Portainer extends the infrastructure to the application layer. Many modern edge applications are delivered as containers. These bundle the software in question together with the components it needs to run. Portainer manages containers based on Docker and Kubernetes and offers functions for installation, configuration, updating, orchestration and monitoring.

As a module of the EMS, Portainer manages images and containers, installs new applications and updates existing software. It can deploy individual containers or entire application groups. It also manages application parameters, monitors the running containers and controls access via roles and permissions. Different user groups thus receive precisely the permissions they need for their tasks. By connecting their own registries – GitLab, for example – manufacturers can also roll out applications they have developed themselves.

The real value comes from the interplay between the two layers. secunet contributes low-level protection functions that cannot be implemented at the application layer – a secure key store, for example, so that credentials no longer sit in plain text in configuration files such as Docker Compose. Conversely, Portainer gains insight into the state of the underlying system, such as free storage or CPU load, which container management on its own does not have. Application layer and system layer thus mesh together in a single shared view.

A clear division of tasks governs how the two components work together. secunet controls the hardware, the base system, the network connections and the secure execution environment. Portainer manages the applications and their lifecycle. The edge platform is aimed above all at companies that provide technical services to their own customers:

• System integrators develop and implement complete solutions for operators. Here the edge appliance serves as a standardized technical basis that they no longer have to put together from scratch for every single project.
• Managed service providers operate IT and security functions at their customers' sites. With this platform, they can offer secure edge services centrally.
• Machine and plant manufacturers can integrate secunet edge directly into their systems. The edge appliance thereby becomes part of the product and ships together with the machine in question. That makes it possible to embed the appliance in refrigerated display cases or medical devices, for instance, and deliver it with the product.

The combined solution can be sourced entirely from secunet; anyone already running their own Portainer instance can just as easily combine it with secunet edge. The solution is built on open standards.

The result: standardized operations, stronger security and faster rollouts

The joint platform from secunet and Portainer enables uniform management of hardware, security, fleet management and applications across multiple sites. That makes the edge appliance a turnkey technical basis for distributed sites. It offers its users the following benefits:

• Deploying secunet edge results in more secure connectivity for machines, plants and distributed sites, in compliance with NIS2 and the CRA. Machines can exchange data and use digital services without being connected to external networks in an uncontrolled way.
• The solution is quick to get up and running: with the preconfigured system, system integrators start almost immediately instead of needing the usual four to twelve weeks to procure and integrate their own components. In ongoing operation, secunet estimates that recurring effort drops by roughly a factor of ten.
• The shared view of the infrastructure and container layers simplifies troubleshooting: faults can be analyzed end to end instead of being passed back and forth between several vendors.
• Operating effort drops noticeably: settings and updates are applied centrally instead of site by site, which eliminates recurring on-site visits.
• Local processing at machines, plants or operating sites shortens response times and reduces the volume of data that has to be transmitted. Applications do not have to send data to the cloud first.
• The edge appliance is scalable and grows with the company. New machines or sites can be commissioned quickly and consistently.
• The solution supports interoperability with higher-level security architectures and initiatives such as the German Cyberdome and is suitable for use in regulated critical infrastructure environments.

The joint solution from secunet and Portainer is available in production and can be deployed directly in real-world projects. For evaluations, pilot projects or an assessment of specific deployment scenarios, secunet and Portainer are available for a direct conversation.