A high-level share for non-IT Managerial/Director audience a glimpse into current and emerging business threats at the OFSEC Expo 12-16 Sept in Muscat, Oman. Please feel free to use any content and share original sources were noted.

2. Why SCADA, ICS
& Embedded
Devices continue
to be a threat
DUMB SECURITY & SMART GRIDSDUMB SECURITY & SMART GRIDSDUMB SECURITY & SMART GRIDS
Faris A. Al-Kharusi, MPhil, MSc., GWCBA

3. AGENDA
SCADA, ICS & Embedded Devices
• Evolution of theThreat
• Industry Standards vs. Residential Realities
Specific Contemporary Challenges
• The {C}oldWar
• Paradigm Shift
CybersecurityWorld-View
• Weak vs. Strong Implementations
• The Real Calculation of Risk (InformationAssurance)
Do’s & Don’t of Smart Projects
• Data Storage & Security Policy
• Knowledge & Competency
• BCP & DRP
AGENDA

4. The Story So Far
• Hard-Coded Passwords.
• Hard-Coded Firmware (Exploits
can not be patched!)
• Lack of belief that critical
infrastructure is internet-facing.
• Reconnaissance can be done
anonymously with low likelihood
of detection.
• Lack of skill-sets to conduct
forensics minimize reporting on
intrusions.

5. Evolution of theThreat: How We Got Here
– Complex interdependencies
arose …
– The IP/TCP Landscape has
opened the doors to ease of
setup since the early 80’s ...

6. Evolution of theThreat: GlobalView
– Bacnet (port 47808)
– DNP3 (port 20000)
– EtherNet/IP (port 44818)
– Niagara Fox (ports 1911 )
– IEC-104 (port 2404)
– Red Lion (port 789)
– Modbus (port 502)
– Siemens S7 (port 102)

7. AndThe Internet ofThings Grows Regionally
UPnP - UDP Port 1900
- Mobile Devices
- CCTV
- Biometric Readers
- Energy Generators
- Card Readers
- Appliances
- POS Kiosks
- Routers
- Printers
- And the list goes on …

8. Industry Standards
The “Perfect
Landscape” as
conveyed in our
security centric
minds …

9. Residential Outlook
And the current
reality …

10. The {C}oldWar

11. Paradigm Shift

12. Real-TimeOperations:Weak Implementations
Sifting through Events

13. Real-TimeOperations: Strong Implementations
IntelligentAlarms & Exception Based Surveillance

14. The Real Calculation of Risk
Risk =
Threat x
Vulnerability x
Consequence

15. Stop fighting yesterday’s war today . . .
The Do’s
• Understand consequence of your
vulnerabilities.
• Use Local Clouds – keep ownership
of your Data.
• Think clearly about your Data
Analytics strategy as it pertains
guarding your assets.
The Don’ts
• Stop treating your security
decision’s like it is 2005.
• Outsource all the knowledge and
competency (especially around
forensics) to a third-party.
• Expect proprietary or complex
setups to provide protection.

16. ThankYou &
Feel FreeTo
Ask Questions