Cybersecurity in Industrial Control Systems (ICS)
•
13 likes•6,999 views
Presented at ISACA's EuroCACS 2015 (Copenhaguen). Understand the impact of Industrial Control Systems (ICS) on the security ecosystem. Expand the knowledge on SCADA systems and how cyberattacks can have physical consequences, bridging the cyber and physical worlds.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Cybersecurity in Industrial Control Systems (ICS)
Similar to Cybersecurity in Industrial Control Systems (ICS) (20)
Recently uploaded
Recently uploaded (20)
Cybersecurity in Industrial Control Systems (ICS)
- 2. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS AGENDA • Introduction to Industrial Control Systems • Security Concerns (Cyber Incidents, CERT) • Threats and Vulnerabilities (ICS Exploitation, SHODAN) • IT/OT Convergence (Security Principles, Countermeasures) • Best Practices, Guidelines and Frameworks Juan Figueras, CISA Security & Privacy Consultant
- 3. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS INTRODUCTION Industrial processes • Manufacturing • Smart Grid • Utilities • Oil & Gas • Transport • Telecomm • Chemicals
- 4. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS DEFINITION Industrial Control Systems (ICS) are command and control network and systems designed to support industrial processes[1] [1] ENISA “Protecting Industrial Control Systems. Recommendations for Europe and Member States” (2011)
- 5. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS COMPONENTS • IED – Intelligent Electronic Device • RTU – Remote Terminal Units • PLC – Programmable Logic Controllers • DCS – Distributed Control Systems • HMI – Human-Machine Interfaces • SCADA – Supervisory Control and Data Acquisition
- 6. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS COMPONENTS SCADA DCS RTU PLC HMI IED
- 7. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS SECURITY CONCERNS • Weak communication protocols – Lack of authentication in most cases – Lack of encryption • Weak passwords – Default passwords – Insecure password management • Poor QoS (Quality of Service) – DoS “friendly” • Internet connected web servers without protection • Difficult or nonexistent patching – “If it isn’t broke, don’t fix it” – Extensive use of Windows XP
- 8. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS CYBER INCIDENTS Attack Year Description Vector Outcome Motivation German Steel Mill Cyber Attack 2014 Malware to gain access to the corporate network an then moved into the plant network Spear Phishing email Physical damage Unknown DragonFly 2014 Campaign against energy companies compromising ICS equipment SQL Injection & Remote Access Trojan Sabotage Espionage / Sabotage Telvent Canada attack 2012 Access to SCADA Admin Tools Malware New project files stolen Information Thief Stuxnet 2010 Rootkit to take control of ICS of nuclear power plants Infected USB flash drive Systems stop Sabotage Baku – Tbilisi - Ceyhan (BTC) pipeline attack 2009 Access to the pipeline’s control System to supress alarms ans manipulate the process Physical access to network Temporary disruption in pipeline transfers Geopolitics (?)
- 9. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS-CERT MONITOR 245 incidents received by ICS-CERT in 2014 [2] [2] ICS-CERT Monitor, September 2014 - February 2015, NCCIC
- 10. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS-CERT MONITOR 245 incidents received by ICS-CERT in 2014 • Unauthorized access and exploitation of Internet facing ICS/Supervisory Control and Data Acquisition (SCADA) devices • Exploitation of zero-day vulnerabilities in control system devices and software • Malware infections within air-gapped control system networks • SQL injection via exploitation of web application vulnerabilities • Network scanning and probing • Lateral movement between network zones • Targeted spear-phishing campaigns
- 11. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS-CERT MONITOR
- 12. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS EXPLOITATION: SHODAN DEMO (I) Gathering information
- 13. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS EXPLOITATION Project SHINE, uncovered that over 1 million SCADA / ICS systems are connected to the internet with unique IPs, and this figure is growing by between 2000 – 8000 per day.
- 14. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS EXPLOITATION: SHODAN DEMO (II) Common ICS ports port 102 Siemens S7 port 502 Modbus port 789 Red Lion port 20000 DNP3 port 34980 EtherCAT port 34962 PROFINET port 44818 EtherNet/IP port 47808 BACnet/IP
- 15. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS EXPLOITATION Open Sourced Vulnerability Database (http://www.osvdb.org)
- 16. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS IT/OT CONVERGENCE «The purpose of ENTERPRISE security is to protect the data residing in the servers from attack. The purpose of ICS security is to protect the ability of the facility to safely and securely operate, regardless of what may befall the rest of the network» [3] [3] Weiss, Joe; “Assuring Industrial Control Systems (ICS) Cyber Security”
- 17. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS SECURITY PRINCIPLES (IT vs. OT) CONFIDENTIALITY INTEGRITY AVAILABILITY IT Systems OT Systems (Business) (ICS) + importance - - importance +
- 18. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ISA95: ENTERPRISE – CONTROL SYSTEM INTEGRATION
- 19. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ISA95: ENTERPRISE – CONTROL SYSTEM INTEGRATION Level 0 Level 1 I/O, Devices and Sensors Production Process Device Networks Level 2 HMI, SCADA Level 3 MES, Batch, Historian Level 4 ERP. CRM, BI Business Planning & Logistics Manufacturing Operations Manufacturing Control and Monitoring Automation Networks Operations Networks Business Networks PLCs, DCS
- 20. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS COUNTERMEASURES [4] 1. Assess existing systems: Understand risk and prioritize vulnerabilities 2. Document policies and procedures: Determine position regarding ICS and develop company-specific policies 3. Train personnel and contractors: Develop and institute policy awareness and training programs 4. Segment the control system network: Create distinct network segments and isolate critical parts of the system using a “zone and conduit” model 5. Control access to the system: Provide physical and logistical access controls to both your zones and equipment 6. Harden the components of the system: Lock down the functionality of components 7. Monitor and maintain the system: Update antivirus signatures, install patches, and monitor the system for suspicious activity [4] Byres, Eric; “The Industrial Cybersecurity Problem” – ISA White Paper
- 21. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS BEST PRACTICES & GUIDELINES • ISA99/IEC 62443 Security for Industrial Automation and Control Systems • NIST SP 800-82 Guide to Industrial Control Systems (ICS) Security • ENISA Report (2011) Protecting Industrial Control Systems. Recommendations for Europe and Member States • IIC Technical Paper (2015) Industrial Internet Reference Architecture
- 22. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS FRAMEWORK: COBIT 5 Implementing NIST Cybersecurity Framework Using COBIT 5
- 23. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS ICS SECURITY FRAMEWORK [5] Alcoforado, Ivan; “Leveraging Industrial Standards to Address Industrial Cybersecurity Risk”; ISACA Journal, Volume 4, 2016 Standards Leveraged for IACS Cybersecurity Framework Example [5]
- 24. #ICSSecurity Juan Figueras (@JoanFiguerasT) #EUROCACS THANK YOU! Juan Figueras, CISA Security & Privacy Consultant @JoanFiguerasT