ICS Cybersecurity: How to Protect the Proprietary Cyber Assets That Hackers Covet and WMI Cannot See.
Presenter: David Zahn, PAS Industrial control systems represent the brass ring for hackers who want to disrupt plant operations and negatively impact safety and productivity. The problem for cybersecurity professionals is that plants have highly vulnerable proprietary control systems where configuration data is not visible via standard WMI or SNMP calls. Yet, it is this same configuration data, such as I/O cards, firmware, installed software, and more, that hackers work hard to attain as it aids them in gaining control over industrial systems within plants. As the saying goes, “you can’t manage what you can’t measure.” Taking inventory of this hidden configuration data and doing so for all control assets is difficult. Plants as a result fall short of achieving centralized, automated inventory – a cybersecurity best practice and a necessary precursor to effective change management. So how do you address change management when important security data is kept locked within each vendor’s distributed control systems, programmable logic controllers, and remote terminal units? In this session, we’ll explore the types of inventory data that comprise a best practices cyber security plan. Next, we will dive into cost effective, accurate automation opportunities for inventory discovery and maintenance of heterogeneous proprietary and non-proprietary control assets. Finally, we’ll present a case study for implementing best practices for hardening ICS cyber security and automating management of change. Agenda: Building and Maintaining an Accurate ICS Inventory Best Practices in Inventory Automation Case Study
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (7)
Similar to ICS Cybersecurity: How to Protect the Proprietary Cyber Assets That Hackers Covet and WMI Cannot See.
Similar to ICS Cybersecurity: How to Protect the Proprietary Cyber Assets That Hackers Covet and WMI Cannot See. (20)
More from EnergySec
More from EnergySec (20)
Recently uploaded
Recently uploaded (20)
ICS Cybersecurity: How to Protect the Proprietary Cyber Assets That Hackers Covet and WMI Cannot See.
- 1. How to Protect the Proprietary Cyber Assets That Hackers Covet and WMI Cannot See David Zahn CMO, GM of Cybersecurity Business Unit dzahn@pas.com
- 2. Agenda • A Simple Test • Challenges With Taking Stock • Inventory Done Right © PAS - Confidential and Proprietary 2015 | 2
- 4. Impact Of This ICS-CERT Vulnerability to the Enterprise? • HART DTM Vulnerability • Honeywell Temperature Sending Unit • Impact – Cease operations until restarted © PAS - Confidential and Proprietary 2015 | 4
- 5. Detect An Inadvertent Engineering Change? •Safety instrumented system (Triconex) configuration change •Bypass condition masked from operator © PAS - Confidential and Proprietary 2015 | 5
- 6. Identify the Next Successful Malicious Attack? © PAS - Confidential and Proprietary 2015 | 6 Anatomy of Stuxnet AttackSiemens S7: • Memory Block DB890 • AWL File
- 7. © PAS - Confidential and Proprietary 2015 | 7 You Cannot Secure What You Cannot See
- 8. 8 Challenges with Taking Stock
- 9. Hidden Cyber Assets Create Risk: A Case Study © PAS - Confidential and Proprietary 2015 | 9 20% 80% Network Proprietary • Heterogeneous, proprietary systems • Complex architecture • No agents • “Hidden” inventory • I/O cards, firmware, installed software, configuration & more • Heterogeneous, but common protocols • IP addressable • Agent friendly • Inventory in plain sight Case Study PAS inventory engagement to feed vulnerability assessment Challenge Inventorying, monitoring, and gaining full compliance on cyber assets
- 11. Information Technology Inventory In Depth(a sample data set) © PAS - Confidential and Proprietary 2015 | 11 Windows • Ports & services • User accounts • Anti-virus • Events • OS information • HW information (HD, memory, etc.) Network • Global switch settings • Interface definitions • VLANS • Routing tables • Firewall objects Operational Technology DCS • IO Cards • Controllers • Com Modules • Operator Stations • Application Stations • Wireless IO Modules • Control Level Firewall • Applications PLC / Vibration Monitoring • IO Cards • Controllers • Com Modules • 3rd Party Module • Applications SCADA / Historian / APC • Operator Stations • Application Stations • Applications Instrumentation • Wireless Devices • Hart Devices • Foundation Fieldbus Devices • Profibus Devices Malicious attack (Stuxnet) ICS-CERT Vulnerability Inadvertent Engineering Change SIS / Turbine Control • IO Cards • Controllers • Com Modules • Applications
- 12. Not All Inventory Is Created Equal © PAS - Confidential and Proprietary 2015 | 12 Networked IT Networked Proprietary Islanded
- 13. Inventory Options Manual • Pros • Flexible • Cons • Training time • Labor cost • Error prone • Stale data ICS Vendor Supplied Tool • Pros • Vendor specific • Purpose-built • Cons • Multiple formats • Varying capabilities • Different terminology • Data silos Centralized and Automated • Pros • Accuracy • Evergreen inventory • Common data format • Efficiency • New device detection • Cons • Business process changes © PAS - Confidential and Proprietary 2015 | 13
- 14. Good ICS Inventory = Good Compliance OT + IT Inventory CIP-002 Inventory & review… CIP-007 Ports, services, patching… CIP-008 Incident response, testing, review… CIP-009 Disaster recovery, testing, review… CIP-010 Change & configuration management… And more.... © PAS - Confidential and Proprietary 2015 | 14
- 15. ICS Cybersecurity Best Practices © PAS - Confidential and Proprietary 2015 | 15 Requirements • Automated OT & IT inventory • Configuration change monitoring & alerts • Patch management • Closed-loop workflows • Backup & recovery Benefits • Increases internal & regulatory compliance • Reduces compliance effort • Supports for all major control systems • Hardens control system security • Speeds recovery from downtime Automation Systems Single Repository
- 16. Background • Founded in 1993 with headquarters in Houston, Texas • Offices in North America, Europe, Middle East, Africa, Asia, and Australia • Serving Power, Oil & Gas, and Processing industries globally Industry Leadership • First-to-market solutions in ICS Cybersecurity, Alarm Management, and HP HMI • Honeywell, INTECH, Intergraph, Invensys, and NovaTech ecosystem • AICHE, EMMUA 191, EPRI, ISA, NERC CIP, NIST, NPRA, and OSHA standards • 20% annual R&D reinvestment Who We Are By The Numbers • 400+ customers • 1,046 plant sites • 8,749 licenses • 20,560 automation assets managed • 40,000+ users © PAS - Confidential and Proprietary 2015 | 16
- 17. Thank You David Zahn CMO, GM of Cybersecurity Business Unit dzahn@pas.com