Presented at BSidesDC 2016, October 23, 2016 Video on YouTube at https://youtu.be/Idv9cR8xDNQ Traditionally, assessing networks has involved hammering on them using a variety of passive and active techniques and tools. While IT systems can generally survive momentary downtime associated with this type of testing, ICS/SCADA systems generally cannot. The way that most vulnerability assessors and penetration testers have handled these systems in the past is to remove them from the scope of their testing. As more and more ICS/SCADA systems are being connected to corporate networks, in a variety of secure and insecure ways, assessors and testers will probably come across these types of systems more often. This presentation discusses some of my experience from conducting vulnerability assessments and penetration tests on ICS/SCADA systems over the past few years. It discusses our general approach to assessing these types of systems and some of the modifications that we have to make to accommodate them.

1. What’s the Big Deal with Assessing ICS/SCADA?

2. Jim Gilsinn
• 4 Years Senior Investigator, Kenexis Consulting
• 20 Years Electronics Engineer, NIST Engineering Lab
• Got my first certification less than a year ago
• @JimGilsinn
• jim.gilsinn@kenexis.com

3. Why Am I Here?
• ICS/SCADA systems are an extension of IT systems
• ICS/SCADA systems are being connected to IT systems
• ICS/SCADA systems don’t behave like IT systems
• ICS/SCADA systems are now being scrutinized

4. Traditional ICS/SCADA
• ICS = Industrial Control Systems
• DCS = Distributed Control Systems
• SCADA = Supervisory Control And Data Acquisition

5. Non-Traditional ICS/SCADA or “Control Systems”
• Building automation systems
• Heating, ventilation, and air conditioning (HVAC) systems
• Energy monitoring & conservation systems
• Fire monitoring & suppression systems
• Physical security systems
• Traffic monitoring & control systems
• Sensor networks

6. If You Live Here…

7. If You Live Here…

8. If You Live Here…

9. If You Live Here…

10. If You Live Here…

11. What Do A Lot Of Assessors Do?
• Discover ICS/SCADA systems inadvertently!
• Knock things over accidentally!
• Avoid them like the plague!
• There is a better way!

12. Understand the Risks

13. Understanding the Risks
• Talk to the customer!
• Very few assessment steps have a “Crater Factor”
• Most problems lead to system downtime
• Unplanned downtime is real $$$

14. Determine What The Customer REALLY Wants
• Passive Network Assessment
• Vulnerability Assessment
• Penetration Test

15. Figure Out How To Tailor Tools For Use
• Most are IT tools tailored for ICS/SCADA
• Slow things down
• Don’t be aggressive
• Second guess the tools

16. Questions To Ask – Pre-Engagement
• PPE = Personal Protective Equipment?
• Safety training?
• Can we actually plug in?
• Logistics of communication?
• Where/how are we allowed to store data?

17. Questions To Ask – During Engagement
• What are the risks?
• Walk-down?
• Will someone be monitoring the system?
• How do we report thing?

18. Questions
• Jim Gilsinn
• @JimGilsinn
• jim.gilsinn@kenexis.com