Scada Security


Published on

Published in: Business, Technology
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • So security for critical infrastructure is now an issue around the world. Because these systems are no longer isolated, they need to be protected from Internet-borne threats that can come in through the corporate IT network.Typical IT security products rely heavily on the need to take down the network on a regular basis for maintenance, security patches, and signature updates. While a signature file update can only take a few minutes, in a controlled system like the power grid, that would constitute a denial of service, causing outages and service disruptions.Non-employees are now being given access to the control networks as well. Separate entities, like the Independent Systems Operators, need to aggregate power between multiple companies.Remote access poses its own security risks and hacking into wired or wireless communications is fairly routine.Since critical systems were never designed with security in mind, it can be extremely difficult to diagnose an attack. In a famous case in Australia in 2000, an attacker was able to penetrate a water treatment plant over 20 times before they even realized they were under attack. The hacker was caught after his 46th infiltration, but it was already too late. His hacking caused a pumping station to overflow, dumping raw sewage into a residential neighborhood and tidal canal.In addition, there are about 1500 potential regulations and standards that these industries could be subject to. It’s almost a guarantee that every company is out of compliance with SOMETHING.And don’t think that the hacker community hasn’t been aware of these vulnerabilities. Chatter on hacker sites using “control systems” or “scada” as key words has grown astronomically over the last 2 years. And it only takes one talented hacker … or one disgruntled employee … to give away the keys to the kingdom to every miscreant on the planet.
  • Here are the 9 CIP standards. Secure Computing can provide solutions for almost every CIP standard. The only one that we can’t help with is physical security.These regulations have some real teeth in them, too. While it might seem like the target date to be “auditably” compliant is far off, it really isn’t based on the amount of thought and planning that needs to go into making critical infrastructure really secure. And that planning will pay off. Companies who meet the deadlines will be spared the fines of up to $1 million US per day.Now let’s discuss the four most critical ones where Secure Computing can help you meet and exceed CIP requirements.
  • The first is to protect the critical network from everything else … whether it’s the IT corporate network or an independent systems’ operator … the control network must be segmented and secured.The second is to control users … everything from allowing access to monitoring their behaviour in the network. Insiders pose the greatest risks … the best protection is monitoring and control.The third is protection of critical asset information. If network schematics or topologies were to fall into the wrong hands, serious damage could ensue.And lastly, these all need to be done without jeopardizing the business reasons for the networks’ existence .. Availability, integrity and reliability.
  • Scada Security

    1. 1. Secure SCADA<br />supervisory control and data acquisition<br />Presenter: Tal Ein-Habar, CISSP<br />Security Architect<br />
    2. 2. What is SCADA Network?<br />Government Services<br />Transportation (Road, rail, air, local public transportation, hazardous materials)<br />Energy (Electrical utility transmission & distribution, oil and gas pipelines, nuclear materials & power)<br />Water Controls (Dams, levees,reservoirs)<br />Public Health (Hospitals, disease control)<br />Emergency <br />Services (Fire and police departments)<br />Defense Industrial Base<br />Critical Infrastructures<br />Chemical<br />Industry (Petroleum, hazardous waste)<br />State & Municipal Services (Safe water systems, waste disposal)<br />Banking <br />And Finance (Trading systems, automated clearinghouse network, ATM networks)<br />Telecommunications (Broadcast television and radio)<br />Postal & Shipping<br />
    3. 3. Why Security Is An Issue ?<br />Connections to IT networks are now the norm<br />Normal security maintenance causes disruptions and outages<br />Remote access suffers from wireless and radio communication vulnerabilities<br />Critical asset information is unsecured<br />Security forensics are almost non-existent<br />Identification of cyber attacks is difficult to impossible<br />> 1500 potential and existing regulations and standards<br />Control systems are on the hackers’ radar<br />Specific malware has already been created and downloadable <br />Insiders pose biggest threat<br />75-80% of incidents have been caused by current employees<br />
    4. 4. Threat is changing<br />Countries are looking at Cyber war as primary & legitimate way of Damaging their opponents <br />The incentive for using cyberwar are:<br />damage citizens to lead into chaos / changing political policy <br />Acting from religious / political agenda<br />Cyberwar is intended to create fear on the remote populations <br />
    5. 5. Attacks are here …<br />דני יתום, לשעבר ראש המוסד, חושף:<br />"ארגוני הטרור הגדולים מפעילים כיום אקדמיות לפיגועים מקוונים"<br /><ul><li>ככל שמדינה מבססת יותר ויותר את תשתיותיה הלאומיות על רשת האינטרנט הציבורית והפתוחה - כך היא חושפת עצמה לסכנת טרור קיברנטי הולכת וגדלה, לפריצה ולשיבוש מערכות מוחלט"
    6. 6. מדינות בעולם מודעות לפגיעה אפשרית בתשתיות שלהן והן חוששות ממנה: תקשורת, בנקאות, חשמל, אנרגיה, נפט, שינוע גז, מים, תחבורה, שירותי חירום ושירותי ממשלה, "כולן יכולות לקרוס במקרה התקפה קיברנטית.</li></li></ul><li>Attacks are here …<br />Russian Hackers Attack an Azerbaijani Energy Pipeline<br />Aviation week reported that Russian hackers attacked servers controlling an energy pipeline carrying gas from Azerbaijan to Europe bypassing Russia. <br />The hacker attacks caused suspension in the pipeline operations, forcing the operating company to redirect the oil through Baku-Novorossiysk Russian pipeline. <br />Georgian websites claim that the attacks had the same IPs as those of Estonian websites DDos during the 2007 Estonian Cyber attacks.<br />Information Security News 08/24/2009 <br />
    7. 7. Attacks are here …<br /><ul><li> Cyber Terror</li></ul>“CIA Confirms Cyber Attack Caused Multi-City Power Outage: We have information that cyber attacks have been used to disrupt power equipment in several regions outside the United States. In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, butall involved intrusions through the Internet.” <br />(SANS Organization - January 18, 2008. )<br /><ul><li> Cyber CRIME</li></ul>“Federal prosecutors have charged 11 people with stealing more than 41 million credit and debit card numbers, cracking what officials said on Tuesday appeared to be the largest hacking and identity theft ring ever exposed. … Once the thieves identified technical weaknesses in the networks, they installed so-called sniffer programs, obtained from collaborators overseas.” <br />(New York Times – 5 August 2008)<br /><ul><li> Cyber WARFARE</li></ul>““While Russia and Estonia are embroiled in their worst dispute since the collapse of the Soviet Union, a row that erupted at the end of last month over the Estonians' removal of the Bronze Soldier Soviet war memorial in central Tallinn, the country has been subjected to a barrage of cyber warfare, disabling the websites of government ministries, political parties, newspapers, banks, and companies.<br />(The Guardian, May 17, 2007)<br />
    8. 8. Where is the problem<br />We divide the problem into several main segments:<br />Connection between control networks & their sensor’s<br />Connection between Control network & IT network<br />Remote management of critical Infrastructure<br />
    9. 9. Sample Network Design<br />
    10. 10. 9 Critical Infrastructure Protection (CIP) Standards<br />Affected companies must be “auditably” compliance by mid-2010<br />Compliance must be re-confirmed annually<br />Consequence of non-compliance:<br />Up to $1m USD per day<br />
    11. 11. 4 Design Requirements<br />Segment and Protect Critical Infrastructure Assets from Interconnected Networks<br />Know Who Has Access and What They’re Doing in the Network <br />Protect Information about Critical Infrastructure Assets from Data Leakage<br />Implement Strong Security without Jeopardizing Availability, Integrity, and Reliability Requirements<br />
    12. 12. Vendors<br />
    13. 13. Waterfall<br /><ul><li>פריסה של מערך שערים חד כיוונים לכל הקישורים לעולם החיצוני.
    14. 14. ניתן למנף את יכולות השערים הללו לשם ביצוע בבטחון מלא , של :
    15. 15. שליחת סטטוס שוטף למרכזי ניטור ובקרה מרוחקים.
    16. 16. שליחת נתוני ייצור לרשת הארגונית.
    17. 17. ניהול מבוקר של פעולות תחזוקה בחומרות המפוקחות.
    18. 18. יתרונות השיטה - A Win-Win situation :
    19. 19. הפרדה חלקית / קישור חלקי.
    20. 20. הדרישות העסקיות באות על סיפוקן ( הגישה המסורתית) .
    21. 21. בטחון ברמה הגבוהה ביותר ( הגישה הקפדנית ) .</li></ul>T<br />
    22. 22. Waterfall<br />קישור חד כיווני מוחלט בין רשתות בעלות סיווג / רגישות שונה זו מזו<br /><ul><li>המערכת הינה חד כיוונית לחלוטין על בסיס תקשורת אופטית .
    23. 23. שני רכיבי חומרה אחד לשליחה בלבד –TX והשני לקבלה בלבד –RX .
    24. 24. הרכיבים שונים זה מזה ברמת החומרה , לא ניתן להפוך ליחידת שידור ליחידת קליטה וההיפך .
    25. 25. הפרוטוקול הינו חד כיווני בתיכנונו כך שאינו מחייב ACKs אינו מצטריך תהליך ראשוני של Hand Shake ואינו פונה בבקשת מיידע לאחור בשום מקרה שהוא.
    26. 26. המוצר תומך בכל שיטות העברת הקבצים הקיימות =ביכולתו להעבירכל מיידע באשר הוא המוגדר כקובץ . בין אם מדובר במיידע מוצפן , קבצי ZIP , קבצי דואר , קבצים שמקורם בעברת FTP , וכו'</li></ul>Receiver<br />Transmitter<br />Hardware Based One-Way Data-Flow Gate<br />Laser – Transmit Only<br />Photocell– Receive Only<br />
    27. 27. Waterfall<br />פתרון קל להטמעה : <br /><ul><li>העברת פקטות מידע ( UDP , TCP ) .
    28. 28. העברת קבצים ( כולל תקיית עצים ) .
    29. 29. העברת Stream ( קול , וידאו ) .
    30. 30. רפליקציה של DB .
    31. 31. תמיכה ב Historians: OSISOFT , Siemens,GE .
    32. 32. תמיכה בפרוטוקולים תעשייתים מובילים כמו :</li></ul>Modbus, OPC, DNP3, Profibus, ICCP <br />
    33. 33. Waterfall<br />Waterfall One-Way™ includes connectors for :<br />Leading Industrial Applications/Historians<br /><ul><li>OSISoft PI, GE iHistorian, GE iFIX
    34. 34. GE OSM, Siemens WinTS, SINAUT</li></ul>Leading IT Monitoring Applications<br /><ul><li>Log Transfer, SNMP, SYSLOG
    35. 35. CA Unicenter, CA SIM, HP OpenView
    36. 36. Matrikon Alert Manager</li></ul>File/Folder Mirroring<br /><ul><li>Folder, tree mirroring, remote folders (CIFS)
    37. 37. FTP/FTFP/SFTP/TFPS/RCP</li></ul>Remove Screen View™<br /><ul><li>Unidirectional transfer of real-time screen display capture</li></ul>Leading Industrial Protocols<br /><ul><li>Modbus, OPC (DA, HDA, A&&E)
    38. 38. DNP3, ICCP</li></ul>Other connectors<br /><ul><li>UDP, TCP/IP
    39. 39. Video/Audio stream transfer
    40. 40. Mail server/mail box replication
    41. 41. IBM Websphere MQ series
    42. 42. Antivirus updater, patch (WSUS) updater
    43. 43. Remote Print server </li></li></ul><li>Waterfall<br />ניטור מרחוק – הפתרון :<br /><ul><li>הקישור מבוצע באמצעות שער חד כיווני.
    44. 44. הנכסים היקרים מאובטחים לחלוטין – אין יכולת כלשהי להגעה אליהם.</li></li></ul><li>Waterfall<br />מוצר חדש להעברת "מסכים": טופולוגיה אופיינית לחדר בקרה<br />חדר בקרה<br />רשת חיצונית<br />Waterfall RSV שומר על הפרדה פיסית בין רשתות הבקרה לרשתות חיצוניות ומונע כל גישה "מבחוץ".<br />External/public<br />network<br />Waterfall Tx <br />server<br />Waterfall Rx<br />server<br />Standard Browser<br />
    45. 45. McAfee is a trusted partner to many civil, military, and intelligence customers<br />Secure Firewall (Sidewinder) is used in many sensitive and highly important networks around the world.<br />Governments having deployments include:<br /><ul><li>United States
    46. 46. United Kingdom
    47. 47. Australia
    48. 48. Canada
    49. 49. Germany
    50. 50. Japan
    51. 51. and more…</li></ul>19<br />
    52. 52. McAfee - Trust = Positive Security + Reputation <br />Positive Secure Model:<br />Everything is bad EXCEPT what is EXPLICITLY determined to be good<br />In-depth understanding of individuals <br />In-depth understanding of malicious practices<br />In-depth understanding of applications<br />Protects from both known, and zero-hour unknown attacks<br />Inbound AccessControls<br />Outbound <br />Access Controls<br />Stop KnownThreats<br />Stop UnknownThreats<br />IPS<br />Virus &<br />Malware <br />Prevention<br />Intelligent <br />Application Inspection<br />Reputation Services<br />Network Access Rules <br />Auth & Role-based access<br />Network Access Rules<br />Auth & Role-based access<br />
    53. 53. McAfee – Design solution<br />
    54. 54. McAfee - Application Visibility & Control Case Studies<br />Many customers depend upon the positive model & application proxies to protect critical apps and data:<br />Database - Oracle & MS-SQL<br />DOD– protects all Human Resources records (several million) held in Oracle<br />Web App – HTTP/S<br />Insurance–protects all in/out Web traffic using Sidewinder<br />Retail– largest vacation travel provider uses for protecting inbound web traffic & PCI compliance<br />Remote Access for Citrix<br />Finance–protects the Citrix-delivered trading infrastructure of the largest stock exchange<br />VOIP (SIP), DNS, FTP, etc.<br />Finance – protects data transfers (FTP)<br />Plant CML – largest worldwide 911 network MSP protects all VoIP<br />Classified Agencies – secure imaging and intelligence data using the IIOP proxy<br />Infrastructure/SCADA<br />Multiple Utilities –segment their network & control systems<br />2 of out the 3 Largest Energy Producers –NERC CIP regulations<br />