A look at the application of behavioral learning in transportation environments.

1. Stories from the Trainyard:
Interesting things I learned!
Presented By: Patrick Kelley
Critical Path Security 2020

2. Critical Path Security 2020

3. • Logs Lie…
– Even if they aren’t lying, the technology is dated.
• Intrusion Detection Systems at the border only tell a
portion of the story.
• Signature-based detection is quick, but often
ineffective.
– Too many false positives!
• Visibility must be multi-dimensional and contextual.
– It must be enriched with outside data!
Why are we were there?
Critical Path Security 2020

4. Problem: Traditional IDS Appliances grade all indicators based
on CVSS or arbitrary grading, without considering contextual
factors specific to the environment.
– Solution: Correlating Suricata and (Zeek) Zeek-IDS flow data gives
teams the ability to apply custom grading based on the context, type,
and amount of correlated events.
Problem: Black Box Recorders can record for a finite period of
time.
– Solution: Sensors are only limited by available storage, which is far
easier to allocate. In short, the data retrieved can save lives. Sensors
become more than myopic security devices and have the ability to
become flight data recorders.
What is an multi-directional, contextual detection network sensor?
Critical Path Security 2020

5. • Blended IDS technologies
(Zeek) Zeek-IDS is great for behavioral indicators, but Suricata is updated more
frequently for atomic indicators.
– You have to start somewhere. In the middle of 2 million raw DNS flows, isn’t
that place.
• Logging with more enhanced fidelity (json > syslog)
• Portability (Not every environment has a rack)
• Intelligence is applied where all atomic indicators can be correlated and acted upon,
regardless of collection point.
– Move this action away from the sensor, itself.
• Zeek (Zeek-IDS) fallback analyzers are your friend.
What makes an effective network security platform?
Critical Path Security 2020

6. • Detect cyber incidents in time to permit effective response and
recovery
• Expand visibility and monitoring capabilities within manufacturing
control systems, networks, and devices
• Reduce opportunities for disruptive cyber incidents by providing
real-time monitoring and anomaly-detection alerts
• Support the oversight of resources (e.g., IT, personnel, data)
• Enable faster incident-response times, fewer incidents, and shorter
downtimes (REDUCE DWELL)
Don’t blow the budget!!!
The objectives
Critical Path Security 2020

7. • Ingress/Egress (Obvious)
• In-between VLANS (Should be obvious)
• Between the Office, Plant, and Control networks in ICS
environments. Expand to include PTC.
• At remote sites
• Integrated in Deception Technology Networks
• Dynamic environments where system log forwarding is easily
forgotten. (Example: That DevOps box in the corner…)
• Wherever you can make it fit on a train or vessel! Lots of Velcro.
Where to place sensors to get the most value in OT/IT environments.
Critical Path Security 2020

8. Simulating Attack Traffic
Critical Path Security 2020

9. Challenges experienced when placing sensors in high value OT/IT
environments.
Critical Path Security 2020
You don’t always have rackspace!
You don’t always have a protocol analyzer written.

10. Challenges experienced when placing sensors in high value OT/IT
environments.
Critical Path Security 2020
Example: Integration into trains requires proprietary cables to J5 ports and
it can be difficult to find suitable power.
Bring batteries. Lots of batteries.

11. Backpressure: It is common that communication between a Locomotive and the Back Office will
be severed and routed across different links and verbosity. As illustrated above, it can choose
between 220 MHz, Cellular, and WiFi to the Wayside.
For that reason, the ability to backpressure and store-and-forward messages is most
important. Without the proper adherence to time, you can’t build an accurate narrative.
IT/OT Communications Aren’t Always Stable
“You can’t properly build a narrative around an event,
without proper adherence to time.”
Critical Path Security 2020

12. However, some of the information collected is really interesting, if you can
make it work.
Critical Path Security 2020
{"ts":1536324083.512216,"uid":"5b9271d60000000000002a50","id.orig_h
":"10.255.255.17","id.orig_p":4096,"id.resp_h":"10.255.255.255","id.resp_
p":22001,"nmea_msgid":"GPRMC","gps_time":"200626.934","latitud
e":3610.372304,"latitude_dir":"N","longitude":8646.492506,"longitud
e_dir":"W","checksum":"*15","checksum_verified":true,"validity":"A","sog
":2.61,"cmg":244.29,"dof":"040117","mv":0.0,"mv_dir":""}

13. payload_len":1460,"excerpt":"u00ffu00ffu0000hu00ffu0097u0000u0000
u0001u0008u0083u0001u0000u0010u0000^<2>WARN:2017/01/04
14:49:18.766:BRAKE_INTERFACE:","excerpt_size":64,"payload_size":1460}
{"ts":1536324073.413067,"uid":"5b9271e900000000000054fb"
…REALLY interesting.
Critical Path Security 2020

14. • ICS networks react unpredictably when traditional firewall, IPS/IDS and endpoint
protection controls are introduced.
• You can’t “scan” networks to find vulnerabilities. You must be available to find value
in a passive manner.
So…we enrich Indicators with Zeek-IDS flows
Critical Path Security 2020

15. We have to make it actionable...
Several options are readily available for safely transferring data to aggregation.
• Splunk with signed certificates
• Secure Logstash
• SSL curl direct to Elasticsearch from Zeek
• Elasticsearch with certs, encryption, etc..
For the case of working with (Zeek) Zeek-IDS and Suricata, we find Kafka to be
the most stable option available when working with Raspberry Pi devices. This
requires a dedicated Kafka server and Zookeeper to be present.
How to ingest, process, and transport data safely
Critical Path Security 2020

16. Lessons Learned
• For Raspberry Pi devices, centralize on a Zeek-IDS build that works best
on the platform. Most often, sub-versions are going to be
problematic.
• MicroSD cards fails over time. They last long enough for most onsite
work.
• Ingest the SPAN/TAP traffic using the interface ON the board. Backhaul
over USB Ethernet or WiFi.
• Splunk works, but Zeek-IDS protocol data can be heavy. You’ll exhaust
Splunk licenses relatively quickly.
• Log verbosity requires significant consideration, as trains can pass data
over 220 radio, Cellular, or Wifi. You don’t want to DoS PTC (Positive
Train Control) or other sensitive systems.
Critical Path Security 2020

17. Where to go from here
Easy...
• Develop additional protocol analyzers. Make them good! Make them verbose!
– Embrace the fallback analyzers.
• Reduce difficulty in maintaining a lightweight Zeek-IDS profile.
Hard…
• Develop sensing methods for altering log verbosity and destination of aggregate
based on available WAN link. Route determination is critical! Verbose logs over radio
could be disruptive to some environments.
• Upgrading OT environments that are constantly moving or require significant
oversight. In short, upgrading thousands of moving freight trains is hard.
• Find a more efficient method for transferring from air gapped networks.
Critical Path Security 2020

18. Thank you!
Twitter:
@pkelley2600
LinkedIn:
https://www.linkedin.com/in/pmkelley/
Critical Path Security 2020