1. Deployment of a Secure Distributed SCADA (DSCADA) System
Using Data-diodes in a Self-contained Fiber-optic Network
Burlington Electric Department
Dorian Hernandez
Schneider Electric (Telvent)
Mark Atchley
Waterfall Security
Andrew Ginter
Made with LibreOffice and Ubuntu Linux

2. Overview
● How to share data from a high security net-
work (SCADA) to a lower security network
(business LAN).
● How to implement the best deployment
strategy to achieve the above.
● Problems encountered during deployment.
● Benefits and drawbacks.
Made with LibreOffice and Ubuntu Linux

3. Long-term goals
● To make implementation as permanent as pos-
sible.
● Improve bandwidth and redundancy depending
on traffic.
● Apply same methodology to other critical sys-
tems like PLCs, etc.
● Complete isolation while maintaining required
communications.
Made with LibreOffice and Ubuntu Linux

4. About BED
● Established in 1905 in
Burlington, Vermont.
● Approx. 20,000 customers.
● Largest municipally-owned
electric utility in Vermont.
● Power coming from sources
that include biomass, wind
and hydro.
● Smart Grid deployment.
● Smart Meter deployment.
Made with LibreOffice and Ubuntu Linux

5. Present Situation
● Current SCADA system uses firewalls for network
“segmentation”.
● Firewalls have their vulnerabilities.
● New SCADA system has to have best approach to
mitigate potential threats.
● Opportunity to build it from the ground up and be
integral part of the process.
● We want the best possible solution while not
breaking the bank.
Made with LibreOffice and Ubuntu Linux

6. Present Situation (cont.)
● Old way of doing things:
Made with LibreOffice and Ubuntu Linux

7. Present Situation (cont.)
● Constant monitoring of intrusion logs.
● Correct setup of rules and other settings.
● CPU may not scale to traffic demands.
● Costs incurred due to licensing.
● Multiple units to achieve redundancy.
● Life cycle, end-of-life.
Using firewalls
Made with LibreOffice and Ubuntu Linux

8. Present Situation (cont.)
● “TCP Split Handshake”
● “ACL Bypass”
● “ASDM Administrative Command Injection”
● “Cross-Site Scripting (XSS)”
● If payload is delivered via sneaker-net, outbound traffic
may be incorrectly treated as valid.
Potential Firewall Vulnerabilities
Made with LibreOffice and Ubuntu Linux

9. 1) Phishing / drive-by-download – victim pulls your attack through firewall
2) Social engineering – steal a password / keystroke logger / shoulder surf
3) Compromise domain controller – create ICS host or firewall account / passwd
4) Attack exposed servers – SQL injection / DOS / b-overflow / default password
5) Attack exposed clients – compromise web servers / file servers / b-overflows
6) Session hijacking – man-in-the-middle / steal HTTP cookies / cmd-injection
7) Piggy-back on VPN – split tunneling / malware propagation
8) Firewall vulnerabilities – bugs / zero-days / default passwords / design vulns
9) Errors and omissions – bad firewall rules/configs / IT reaches through fwalls
10) Forge an IP address – most rules are IP-based / ARPSpoof to block real IP
11) Bypass network perimeter – rogue wireless / dial-up / complex topologies
12) Physical access to firewall – reset to factory defaults / local admin / wiring
13) Sneakernet – removable media / plug untrusted laptops into trusted network
13 Ways Through a Firewall
Present Situation (cont.)
Made with LibreOffice and Ubuntu Linux

10. Development up to present
● Starting from scratch with the latest Telvent Oasys
DNA SCADA solution.
● Applying the “Onion” model for security.
● Applying the “Pretender” model for data sharing.
● Deploying Telvent's Oasys DNA DSS
SCADA model solution.
● Deploying Waterfall For ICCP Uni-Directional Gateway.
Made with LibreOffice and Ubuntu Linux

11. Development up to present
● The “Onion” model approach.
● What's your high-
est priority in your
SCADA network?
● Don't be afraid to
be paranoid.
● Don't be afraid to
be a “control
freak”.
● T.N.O: “Trust No
One”.
Made with LibreOffice and Ubuntu Linux

12. Development to present (cont.)
Possible Solution Model
● Obfuscation of SCADA NETWORK by means of segmenting
networks via Uni-Directional Gateway AND “Pretender” systems.
Made with LibreOffice and Ubuntu Linux

13. Development to present (cont.)
● “Real” SCADA system is not exposed to external
networks.
● “Pretender” system handles all request from systems
needing data from it.
● “Pretender” system can be part of Honey-Pot system,
along with IDS/IPS systems to monitor for intrusion
attempts that get past BIZ-facing firewalls.
● DSS system should be easier to rebuild than “Real”
SCADA system.
Made with LibreOffice and Ubuntu Linux

14. Architected solution
Made with LibreOffice and Ubuntu Linux

15. Pros and Cons
● Secure network cannot be penetrated by less secure network.
● Data to be shared is passed to DSS system where it is an exact
replica of “Real” SCADA system.
● Isolation of possible intrusion to DSS zone.
● Controls cannot be modified at “Real' SCADA system.
● DSS can help in scanning for possible intrusion attempts.
● DSS easier to rebuild than “Real” SCADA system.
● Burden taken off “Real” SCADA system DB for queries, etc.
● Discrete architecture to compartmentalize connections.
● Almost “set-it-and-forget-it” design – peace of mind.
Pros:
Made with LibreOffice and Ubuntu Linux

16. Pros and Cons
● User needs to understand ICCP point assignment and al-
ways adhere to the rules.
● No “auto-magic” way to set up data sets: some manual la-
bor is required but this forces admin to really understand
setup.
● Double-the-work, double-the-fun. Need to set up ICCP on
both SECURE and DSS networks – not big deal.
● More devices to setup, maintain, and assure their up-time.
● Longer deployment time, but this could also result in better
understanding of system.
Cons:
Made with LibreOffice and Ubuntu Linux

17. Improvements
● Create a two-site configuration of the
Telvent Oasys DSS system for better re-
dundancy.
● Upgrade to Waterfall for ICCP High Avail-
ability solution for better redundancy.
● Upgrade BIZ-facing and DSS-facing fire-
walls to High-Availability systems.
Made with LibreOffice and Ubuntu Linux

18. Improvements
● Create a two-site configuration
of the Telvent Oasys DSS sys-
tem for better redundancy.
Made with LibreOffice and Ubuntu Linux

19. Improvements
● Upgrade to Waterfall for ICCP High Availability so-
lution for better redundancy.Upgrade to Waterfall
for ICCP High Availability solution for better redun-
dancy.
Made with LibreOffice and Ubuntu Linux

20. Other possibilities
● Protecting PLCs
Made with LibreOffice and Ubuntu Linux

21. Conclusion
● Because of the stringent cyber-security
requirements by the DOE, NERC, and other
entities, the Uni-Directional Gateway Data
Diode was the best solution to mitigate potential
threats and comply with existing and future
regulations (NERC CIP V5, etc.) and protect
SCADA systems against obsolescence and its
side effects.
Made with LibreOffice and Ubuntu Linux

22. Feedback
● Thank you for your time
Made with LibreOffice and Ubuntu Linux