![©2016 Check Point Software Technologies Ltd. 1
©2016 Check Point Software Technologies Ltd.
©2016 Check Point Software Technologies Ltd. [Internal Use] for Check Point employees
Preventing the Kill Chain in
Industrial Control Systems (ICS) / SCADA
CRITICAL INFRASTRUCTURE and
INDUSTRIAL AUTOMATION SECURITY
Mati Epstein
Global sales manager
Critical Infrastructure and ICS](https://image.slidesharecdn.com/tomasvotruba-cpicssolutionforciandindustrial1-230417145312-dc3a0009/85/tomasvotrubacpicssolutionforciandindustrial-1pptx-1-320.jpg)
![©2016 Check Point Software Technologies Ltd. 2
Industrial Control Systems (ICS)/SCADA are All Around Us
… and we rely on it every day for our basic functions and needs.
Industrial Automation Oil & Gas
Critical manufacturing
Water & Sewage Electricity Transportation
[Internal Use] for Check Point employees
Building Management](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
Recommended
More Related Content
Similar to Tomas_Votruba_-_CP_ICS_Solution_for_CI_and_Industrial (1).pptx
Similar to Tomas_Votruba_-_CP_ICS_Solution_for_CI_and_Industrial (1).pptx (20)
Recently uploaded
Recently uploaded (20)
Tomas_Votruba_-_CP_ICS_Solution_for_CI_and_Industrial (1).pptx
- 1. ©2016 Check Point Software Technologies Ltd. 1 ©2016 Check Point Software Technologies Ltd. ©2016 Check Point Software Technologies Ltd. [Internal Use] for Check Point employees Preventing the Kill Chain in Industrial Control Systems (ICS) / SCADA CRITICAL INFRASTRUCTURE and INDUSTRIAL AUTOMATION SECURITY Mati Epstein Global sales manager Critical Infrastructure and ICS
- 2. ©2016 Check Point Software Technologies Ltd. 2 Industrial Control Systems (ICS)/SCADA are All Around Us … and we rely on it every day for our basic functions and needs. Industrial Automation Oil & Gas Critical manufacturing Water & Sewage Electricity Transportation [Internal Use] for Check Point employees Building Management
- 3. ©2016 Check Point Software Technologies Ltd. 3 Facts and Reality [Internal Use] for Check Point employees ©2016 Check Point Software Technologies Ltd. Dec 2015 Blackout across western Ukraine due to BlackEnergy Spear Phishing malware attack (And again on January 19th) Dec 2014 German Steel Mill was hacked by Spear Phishing – Massive damage to the factory March 2016 Hackers breached a water utility’s control system and changed the levels of chemicals being used to treat tap water (Kemuri Water Company)
- 4. ©2016 Check Point Software Technologies Ltd. 4 Most recent news [Internal Use] for Check Point employees ©2016 Check Point Software Technologies Ltd. December, 2017 Triton Malware - Affecting S.E. Triconex Safety Controllers, which are used widely in critical infrastructure . Threat actors deployed malware capable of manipulating emergency shutdown systems (Schneider Electric) July 16th, 2017 Energy sector hacking campaign targeted more than 15 U.S. firms (Cyberscoop) June, 2017 NotPetya Ransomware hits Ukraine's power distribution company, Mearsk and other’s OT infrastructure
- 5. ©2016 Check Point Software Technologies Ltd. 5 [Restricted] for designated teams US ICS-CERT report: (Jan-18) FY 2017 Most Prevalent Weaknesses Transportation Systems 5% Government Facilities 6% Water 6% Energy 20% Communication 21% Critical Manufacturing 22% Most Attacked Sectors 2016 3rd year in a row
- 6. ©2016 Check Point Software Technologies Ltd. 6 WHO ARE THE ATTACKERS? EXAMPLES OF INDUSTRY ATTACKS OVER THE PAST YEARS Activists Operation Green Rights Insiders Maroochy County Sewage Teenagers Lodz Tram BlackEnergy, CrashOverride State Actors [Internal Use] for Check Point employees ©2016 Check Point Software Technologies Ltd.
- 7. ©2016 Check Point Software Technologies Ltd. 7 Why Are These Attacks Possible? [Internal Use] for Check Point employees Legacy System Default Configuration Less/No Updates Less/No Encryption Policies & Procedures Less/No Segmentation Latency Concerns
- 8. ©2016 Check Point Software Technologies Ltd. 8 Attack Vectors Reaching the OT Network Guest Networks Unprotected Sockets Software Vulnerabilities Removable Media Email Phishing and Attachments Remote Technicians [Internal Use] for Check Point employees
- 9. ©2016 Check Point Software Technologies Ltd. 9 Securing against Attack Vectors [Internal Use] for Check Point employees Attack Vector Check Point solution Removable Media Endpoint data protection Spear Phishing Sandblast Emulation and Extraction Ransomware SandBlast Anti-Ransomware Remote Technicians Secured VPN Connectivity and Two Factor Authentication Software Vulnerabilities IDS/IPS Virus’s and BOT’s AV and AB Blades Missing Boundary Firewall and segmentation
- 10. ©2016 Check Point Software Technologies Ltd. HOW CAN WE SECURELY AND RELIABLY STAY AHEAD? [Internal Use] for Check Point employees
- 11. ©2016 Check Point Software Technologies Ltd. 11 [Internal Use] for Check Point employees Best Practices for Securing OT Secure Both OT and IT Environments Protect IT with Advanced Threat Prevention Technologies Clear Segmentation between OT and IT/Internet Deploy Specialized ICS/SCADA Security Technologies
- 12. ©2016 Check Point Software Technologies Ltd. 12 Security Solutions for Industrial Control Systems/SCADA CHECK POINT’S C Y B E R D E F E N S E Visibility of ICS/SCADA Traffic SCADA-Aware Threat Prevention Ruggedized Appliances for Harsh Environments [Restricted] ONLY for designated groups and individuals Enforcement of ICS/SCADA Traffic
- 13. ©2016 Check Point Software Technologies Ltd. 13 Visibility Real Time SCADA/ICS Network monitoring Field Devices Controllers (PLC/RTU) Sensor Data Pressure Flow Temp. Voltage State Analyze the ICS Network Traffic Control Network Control Center Network Traffic [Internal Use] for Check Point employees SCADA Historian / PI IT/OT Segmentation Level 0 Level 3 Level 1 Level 2 Purdue Reference Model SCADA/HMI/DCS
- 14. ©2016 Check Point Software Technologies Ltd. 14 • What assets you have on the network? • How assets are communicating and who is accessing them? • Uncover configuration issues and vulnerable assets Enhanced OT Visibility • IP and MAC Address • Equipment vendor • Equipment type (PLC, HMI, Engineering Workstation, Switch, etc.) • Asset model name and Serial # • Firmware version • Physical data (rack slots) • Protocols & Commands • Asset connections within the ecosystem • Open/proprietary protocols Network Mapping Communication Information Asset Information
- 15. ©2016 Check Point Software Technologies Ltd. 15 Visibility by SCADA Protocols and Commands [Internal Use] for Check Point employees Over 1000 SCADA and IoT commands in Check Point Application Control MMS DNP3 Siemens Step7 IEC 60870-5-104 IEC 61850 ICCP OPC DA & UA Profinet CIP IoT MQTT MODBUS And many more….. BACNET Updated list: appwiki.checkpoint.com
- 16. ©2016 Check Point Software Technologies Ltd. 16 Asset information [Internal Use] for Check Point employees Detailed asset information – Type, Vendor, Firmware and more
- 17. ©2016 Check Point Software Technologies Ltd. 17 Assets View – by layered map [Internal Use] for Check Point employees Asset layered view according to Perdue model, with variety of view options like neighbors assets, communication direction, ARP baseline and hide assets with no communication
- 18. ©2016 Check Point Software Technologies Ltd. 18 Security Solutions for Industrial Control Systems/SCADA CHECK POINT’S C Y B E R D E F E N S E Visibility of ICS/SCADA Traffic SCADA-Aware Threat Prevention Ruggedized Appliances for Harsh Environments [Restricted] ONLY for designated groups and individuals Enforcement of ICS/SCADA Traffic
- 19. ©2016 Check Point Software Technologies Ltd. 19 Enforcement • Learning phase - Automatically Discover Assets and communication • Anomaly-Based Behavior Analysis • Generate High-Fidelity Baseline Model • Generate security and process threats • Learning phase - network traffic and logging • Manual setting of SCADA commands baseline • Specific Command policies • Specific Values policies • Time of Day and traffic patterns policies Pre-defined Policies Anomaly Detection Combined Enforcement of Pre-Defined + Anomaly-Based analysis
- 20. ©2016 Check Point Software Technologies Ltd. 20 Detailed forensics for incident investigations Setting the Baseline Granular level logging of SCADA traffic – DETAILED GROUPED ANALYZED by Check Point SMARTLOG & SMARTEVENT [Internal Use] for Check Point employees
- 21. ©2016 Check Point Software Technologies Ltd. 21 [Internal Use] for Check Point employees Manual setting of SCADA commands baseline • Learning phase – logging of network traffic • Setting SCADA commands baseline • Specific Command policies • Passive (Alert) or optional Active (Block) policy
- 22. ©2016 Check Point Software Technologies Ltd. 22 Alerts by Behavior Analysis [Internal Use] for Check Point employees Alerts window with filtering capabilities and Alerts tree according to Process integrity and Security events
- 23. ©2016 Check Point Software Technologies Ltd. 23 Security Solutions for Industrial Control Systems/SCADA CHECK POINT’S C Y B E R D E F E N S E Visibility of ICS/SCADA Traffic SCADA-Aware Threat Prevention Ruggedized Appliances for Harsh Environments [Restricted] ONLY for designated groups and individuals Enforcement of ICS/SCADA Traffic
- 24. ©2016 Check Point Software Technologies Ltd. 24 Legacy Systems Are Often Unpatched [Internal Use] for Check Point employees
- 25. ©2016 Check Point Software Technologies Ltd. 25 [Internal Use] for Check Point employees PROTECTED by Check Point IPS Virtual patching Over 300 dedicated IDS/IPS signatures NSS Labs Highest Rating Stops exploits of known vulnerabilities and detects anomalous traffic
- 26. ©2016 Check Point Software Technologies Ltd. 26 Security Solutions for Industrial Control Systems/SCADA CHECK POINT’S C Y B E R D E F E N S E Visibility of ICS/SCADA Traffic SCADA-Aware Threat Prevention Ruggedized Appliances for Harsh Environments [Restricted] ONLY for designated groups and individuals Enforcement of ICS/SCADA Traffic
- 27. ©2016 Check Point Software Technologies Ltd. 27 • Fully featured Check Point security gateway [Internal Use] for Check Point employees • Compliant to the most rigid regulations: IEC 61850-3 and IEEE 1613 • 6x1GbE ports and firewall throughput of 2Gbps • Compact fan-less design with no moving parts; temperature range from -40°C to 75°C • Can be used in In-line or Tap (Mirror) modes • Routing and networking (e.g: BGP, OSPF, IPsec, etc.) Check Point 1200R New Purpose-Built Ruggedized Security Gateway Appliance
- 28. ©2016 Check Point Software Technologies Ltd. 28 [Internal Use] for Check Point employees CrashOverride/Industroyer – New ICS attack platform to Electric Grid Operations • CrashOverride (called Industroyer as well) malware was the malware employed in the December 17th, 2016 cyber-attack on the Kiev, Ukraine transmission substation which resulted in electric grid operations impact. (As reported by ESET and Dragos) • ICS-CERT reported on June 14, 2017 https://www.us-cert.gov/ncas/alerts/TA17-163A ̶ The tactics, techniques, and procedures (TTPs) described as part of the CrashOverride malware could be modified to target U.S. critical information networks and systems. • CrashOverride malware is an extensible platform that could be used to target critical infrastructure sectors, specifically using IEC104 and IEC61850 protocols. ̶ The malware issues valid commands directly to RTU’s. ̶ Using Check Point protocols visibility and baselining would detect and alert on None-Baseline protocols and commands • Could exploit Siemens SIPROTEC relay denial-of-service (DoS) vulnerability, leading to a shutdown of the relay. ̶ Using CVE-2015-5374 to Hamper Protective Relays ̶ Check Point published on June 20th an IPS signature for virtual patching protection of the DoS vulnerability
- 29. ©2016 Check Point Software Technologies Ltd. CASE STUDIES [Internal Use] for Check Point employees
- 30. ©2016 Check Point Software Technologies Ltd. 30 OT Security Blueprint – Micro Segmentation [Internal Use] for Check Point employees Management Facility Shop Floor Shop Floor SCADA Historian SCADA VPN PLC1 PLC2 PLC3 PLC4 Main Control Center Control Monitor SmartEvent
- 31. ©2016 Check Point Software Technologies Ltd. 31 OT Security Blueprint – High Availability [Internal Use] for Check Point employees Management Facility Shop Floor Shop Floor Control & monitor SCADA Historian SCADA VPN PLC1 PLC2 PLC3 PLC4 Main Control Center Control Monitor SmartEvent 1200R HA
- 32. ©2016 Check Point Software Technologies Ltd. 32 Full IT-OT Convergence Blueprint [Internal Use] for Check Point employees
- 33. ©2016 Check Point Software Technologies Ltd. 33 The Corporate Building (BMS) [Protected] Non-confidential content Energy Management HVAC Lighting Elevators Access & Security Water And more… Perimeter Segmentation Functional Zone Segmentation DPI of BMS Protocols SCADA/IoT MQTT, BACNET
- 34. ©2016 Check Point Software Technologies Ltd. 34 [Internal Use] for Check Point employees ICS & IoT Convergence (BMS Environment) Control Network PLC PLC Security Gateway SCADA Server NAC MQTT Over Ethernet WLAN / LAN MQTT BACNET R80 Elevator AC Water ICS Visibility Building Office
- 35. ©2016 Check Point Software Technologies Ltd. 35 [Internal Use] for Check Point employees Remote Maintenance for Elevator or HVAC (and more) PLC Security Gateway Elevators (or AC) Building VPN Connection Company’s service center • Secured connectivity (VPN) • Protocol Visibility • Command provisioning • Access Control • Remote Access VPN Client Protocol ?
- 36. ©2016 Check Point Software Technologies Ltd. 36 Central Site Substation SCADA Server Data Center RTU LAN MPLS IED RTU – Substation Controller IEC-104/ DNP3 Backup Site Smart Event • Typical power utility security deployment in substations • Single or cluster solution for combined OT and IT traffic • SCADA security [Internal Use] for Check Point employees Power Utilities — Substation Security SCADA Server Data Center Smart Event
- 37. ©2016 Check Point Software Technologies Ltd. 37 Securing a Transmission System Operator (TSO) Control Systems Remote Control Rooms SW2 SW1 MPLS DMZ Control Rooms DMZ WKS CONTROL ROOM SCADA 1 2 3 1 2 3 1 2 3 EXTERNALS DMZ SCADA SERVERS Reasons to Choose Check Point • Simple to manage • Virtual Machine deployment • Ability to granularly inspect SCADA protocols • Each Data center is designed to control the entire national grid in case of failure of all the others • Fully redundant topopolgy by 3 Firewalls per Data Center [Internal Use] for Check Point employees
- 38. ©2016 Check Point Software Technologies Ltd. 38 Wind Farms Topology [Internal Use] for Check Point employees MODBUS PLC PLC PLC MODBUS MODBUS SCADA Server Data Center Smart Event Communication cloud Ethernet/IP/MPLS Cellular SCADA Server Data Center Smart Event IT Zone VPN High Availability 1200R 1200R 1200R Compagnie Nationale du Rhone
- 39. ©2016 Check Point Software Technologies Ltd. 39 Waste Water Treatment Network Applicable in Oil and Gas (Off/On-Shore) [Internal Use] for Check Point employees MODBUS CIP OPC MODBUS Data Center SCADA Server Smart Center PLC PLC PLC PLC • Security Motivation – New regulation for Critical Infrastructure • Challenge and CHKP Advantage – Managing thousands of remote sites
- 40. ©2016 Check Point Software Technologies Ltd. 40 Customized Visibility Unified Policy Everywhere Monitoring UNIFIED IT and OT MANAGEMENT FOR BEST ROI AND OPTIMAL PROTECTION [Internal Use] for Check Point employees Management integration With Leading SIEM systems: Q-Radar, ARCSight, Splunk And more like Predix and others
- 41. ©2016 Check Point Software Technologies Ltd. 41 REPORTED by Check Point COMPLIANCE BLADE Real-time assessment of compliance with major regulations Dedicated Compliance and Regulation Monitoring SCADA SPECIFIC COMPLIANCE CHECKS [Internal Use] for Check Point employees
- 42. ©2016 Check Point Software Technologies Ltd. 42 [Internal Use] for Check Point employees Industrial Security Process Define Baseline and Policies Set Rules based on Known / Unknown / Not Allowed or Anomaly Based Behavior Analysis Detection - Identify Deviations and Attacks / Anomaly Detection Based on the defined rules, time of day, attack patterns Enforcement – Passive (Alert) / Active (Prevent) Based on configuration and/or topology – In-line or Tap Visibility - Independently log all SCADA activity: Network, Protocols, Commands, Values
- 43. ©2016 Check Point Software Technologies Ltd. 43 Check Point Offering- End to End Security suite for Critical Infrastructure IT and OT networks [Internal Use] for Check Point employees Most extensive security support of ICS/SCADA protocols Full OT to IT security segmentation Large Scale Management – Market “Gold Standard” (Gartner) Check Point offers complete security suite from Mobile, End-Point to the Cloud – including Private cloud for separation of IT from OT
- 44. ©2016 Check Point Software Technologies Ltd. 44 ©2016 Check Point Software Technologies Ltd. ©2016 Check Point Software Technologies Ltd. [Internal Use] for Check Point employees THANK YOU
Editor's Notes
- So what is ICS? ICS is around us and most days we do not even notice. It supplies the water when we turn on the faucet and takes waste away when we flush the toilet. It powers our lights and electronics, ensures our aircraft run on time and do not collide mid-air. It dispatches our emergency services and ships cargo around the world by sea, land, and air. It even ensures that our traffic flows smoothly, automates manufacturing and helps manage natural resources. ICS is the backbone of our nation’s economy, security and health.
- Energetic Bear, State Actor Sophisticated campaign using email spear- phishing and infection of industrial control software on vendor websites! Spied on hundreds of operation networks in at least 9 countries Maroochy County Sewage, Insider Disgruntled Contractor job application was rejected Attacker redirected millions of litres of sewage into local parks, rivers and hotel grounds Lodz Tram, Teenager Hacked the city’s tram system with a homemade transmitter that tripped rail switches and redirected four trains Operation Green Rights, Activists Anonymous group that fight “against big company which destroy nature and ancient cultures” Hacked websites and stole information from multiple energy companies. Targets included: Exxon Mobil, Monsanto, Canadian Oil Sands, ConocoPhillips, Imperial Oil and others
- When logging SCADA traffic, it is also important to log the actual parameters, registers and values being transferred. An attacker may be able to replay correct network flows (for example between different PLCs), but he may change the values transferred in the communication to affect the operation of the machines. For example, a furnace may receive a higher level of temperature to work in, and damage the operation. This parameter level functionality is unique to Check Point. None of our competitors offers this level of detail.
- Operational environments have some special needs: The first are the SCADA protocols which are used to communicate between the machines and controllers This requires a comprehensive and granular support for SCADA networks The second is the environment in which these production plants operate in. These production plants require robust security systems that can operate in these harsh environments in extreme environmental conditions.
- Let’s discuss the first pillar - Visibility and granular control of SCADA traffic and protocols
- Many SCADA protocols were adapted from non IP networks They were not designed with security in mind, and therefore lack validation of message authenticity, no encryption and they are therefore susceptible to replay attacks and DoS.
- Let’s discuss the first pillar - Visibility and granular control of SCADA traffic and protocols
- The first step in securing SCADA networks is to have visibility to what protocols are in the network, what are the different elements and what is their role. More often than not, these environments are considered as a black box (“if it works, don’t fix it” approach). Some of these machines have been installed and working for many years (5, 10, 20 or even more), and therefore the deep understanding of the communication may not even be known to the equipment manufacturers themselves, let alone the operators.
- Let’s discuss the first pillar - Visibility and granular control of SCADA traffic and protocols
- SCADA vendors continuously release vulnerability advisories for their ICS devices. Unfortunately, unlike the IT environment where patches are easily installed, the OT environment is not quick to install and upgrade their machines, leaving systems unpatched. The time between the moment a vulnerability is disclosed and the moment a patch is available is known as the Window of exposure or “vulnerability window”. This window is extremely large and can often last months and even years.
- Check Point can reduce this vulnerability window by using our IPS for “virtual patching”. We have over 200 ICS dedicated IDS/IPS signatures.
- Let’s discuss the first pillar - Visibility and granular control of SCADA traffic and protocols
- The new appliance is a fully featured Check Point Security Gateway, compliant to the most rigid regulations. The appliance is especially designed to operate in extreme environmental conditions due to its “no moving parts” design and its ability to withstand temperatures ranging from -40 to 75 degree centigrade.
- Check Point 1200R can be used to secure ICS at the PLC level, group of PLCs or even the entire manufacturing facility. The standard Check Point appliance provide security at the main control center where environment is fully controlled.
- Check Point 1200R can be used to secure ICS at the PLC level, group of PLCs or even the entire manufacturing facility. The standard Check Point appliance provide security at the main control center where environment is fully controlled.
- With Check Point we go one step further and supports full IT-OT convergence initiatives. Our Threat Prevention provides security at corporate level, prevent attacks from the Internet using email spear-phishing and other while providing a barrier between the IT and OT network. Adding Check Point EndPoint solution, verifies that the corporate and operational environment can be protected against malicious software and non-approved media (such as USBs).
- Perimeter segmentation Micro Segmentation of “functional zones” DPI of BMS protocols (MQTT, BACnet, etc.) and setting security rules based on Known / Unknown / Not Allowed
- We know security can be complex to implement. Our management system translates your security strategy into reality with unified policy and event management – known in the industry as the management gold standard. This management system provides end-to-end visibility that enables our customers to react quickly to any events affecting their network and also enables them to better prevent threats. Since our management is unified and both the visibility and policy components are linked together, an administrator can in a single step click on a security event and convert it into a new security rule. Also based on 3rd party analyst research, Check Point leads all other security vendors in needing the least amount of people to manage an extensive network of security gateways.
- ICS and Critical Infrastructure companies are very regulated environments. Using Check Point compliance blade, customers can now easily verify they are complaint with specific ICS/CI regulations (such as NERC CIP and others).
- Core Segment Refresh SMB Refresh (in progress) Refreshed messaging Update of over 14 pieces of collateral with creation of new assets including video Refresh checkpoint.com, wiki and PMAP content Enterprise NGFW Refresh (June-July) Refresh NGFW/Enterprise core messaging Update content across wiki and PMAP content Solutions/Verticals Refresh (Q2/Q3/Q4) Enrich content for key solution areas on checkpoint.com Focus areas: Critical Infrastructure, Data Center, Telco, Retail, Financial Services, add Healthcare SMB Collateral Refresh List: SMB Cybersecurity Flyer SMB Reseller Booklet SMB Cloud-Managed Security Service Data Sheet SMB Cloud-Managed Security Service At-a-Glance Sales Guide White Paper – Defending Small and Medium Sized Business with Cloud-Managed Security White Paper – The Attacker’s Target: The Small Business Advertisement – Check Point Cloud-Managed Security Service Advertisement – Have you locked your network? 600 Appliance Data Sheet PDF – Business Terms of Cloud-Managed Security Service PDF – TCO Script PDF – FAQ SMB Cloud-Managed Security Service PDF – SMB Conversation Starter SMB Cloud Service SLA SMB Video (Meirav) PPT – Choosing the Right SMB Firewall SMB Messaging Solutions Areas: Critical Infrastructure – marketing video, solution brief Jessica will start working on enriching solution areas. She will tackle Critical Infrastructure/IoT Security thought paper. I have also asked her to take on one Solution area on the web & come up with a plan to enrich/update the content there.