Título da Palestra: O Estado atual da segurança cibernética industrial na Colômbia

1. Ing. Diego Bernal
IDENTIAN
dbernal@identian.co
Colombia
CYBERSECURITY STATUS IN COLOMBIA

2. Agenda
CIBERSECURITY IN COLOMBIA
•Risks
•Challenges
•Tendencies in Cibersecurity
•Strategies
•Models
•CIBERSEGURY´S ROADMAP
•CONCLUSIONS

3. Objectives and benefits
Fraud, cyber-security, solutions
Cybersecurityframeworkin Colombia

4. LudolfLuehmann,GerentedeTecnologíadeShellaseguraquetantosucompañíacomootrasdelsector,estánexperimentandouna¨nuevadimensión¨deataquesquepodríanponerlamaquinariafísicaenriesgo.
¨Sialguienlograentraraunáreaenlaquepuedecontrolarlaaperturaoelcierredeválvulas,puedenimaginarloquesucederá…costarávidas,dineroyproducción,causaráincendiosylapérdidadelcontroldelosdañosalmedioambiente.Ladestrucciónpodríaserenorme,enorme¨
BBC News, Diciembre 2011
TheEconomist
REPRESENTATIVE ATACKSThe average annual cost of a security in 2013 incident was 5.9 million dollars for the services sector and energy was 19,78 million dollars.
Ponemon Institute, Agosto 2011

8. SCADA
CRITICAL INFRAESTRUCTURES IN COLOMBIA

9. CRITICAL INFRAESTRUCTURES IN COLOMBIA

10. ACTUAL VIEW

11. RISKS IN CRITICAL INFRAESTRUCTURES IN COLOMBIA
Overconfidence in security due to ignorance in Industrial technology, large visibility.
Interconnection of SCADA systems with corporate networks
Use of multiple technologies and solutions of general purpose
Generalization and expansion of the use of monitoring and control systems
Configurations by default in technologies critical operation
Architectures of CONTROL without safety network
The possibilities of attacks increase
Inappropriateuses of components
Lock/intercept/counterfeitingof industrial communications
Computer virus or malware (SCADA)
STUXNET, FLAME, DUQU.
Internal attack: sabotage and espionage
UnautorizedAccess
Operationalmistakes

12. IC/HMI/SCADA ATACKS

13. LAWS
WorldWide& USA
•Creationof a CERT orCSIRT (USCERT, PerCert, ArCert, CRISIS, CTIR-GOV, CCIRC, CERTUy, VenCERT) 55 NationalCERT byU. Carnegie Mellon
•IC Protectionand sovereignty(Cibersecurity´sStrategies, DHS CIP, Germany, Australia, Canada, Latvia, France)
CriticalInfraestructure
•NERC CIP
•ISA SP99
•Others(AGA 12, API 1164, ISO 17799/27001/15408, NIST PCSRF, HIPAA, FIPS, IEC 62351, IEEE 1402-2000, ANSI HomelandSecurity Department.)
Colombia
•OEA CICTE (May2011)
•COMPES (3701 Julio 14 de 2011)
•LAWS AND REGULATIONS of Security Systems(527 Electróniccommerce, 599 penal, 962 Transactions, 1150 transparency, 1273 Data and InformationSecurity, 1341 Creationof theNationalAgency of new technologiesMin TIC , 2258 Regulationof Comunications, Circular 052)

22. SUPORT INSTITUTIONS

23. COORDINATION MODEL

24. SUPPORT INSTITUTIONS: GOVERMENT THE MOST EVOLVEDSECTOR ENERGY

26. COLOMBIA PROTECTS IT SELF?. COLCERT

27. CIBERSECURITY´S MAINLINES

28. PROTECTION DIAGRAM
IPS
Unidades
Generación
Proveedores
Terceros
Outsorcing TIC
Soporte
Replica Históricos,
Servidores Scada, RTU,
DB, Scada WEB, Soporte
Switch Red Control
IDS SCADA
Source Fire
Servidores
Publicos
Servidores
Corporativos
Matrix
PLANT

29. Activitiesin periodsof sixmonths
Short Time
Middle
Time
Long Time
1
2
3
4
5
6
7
8
10
11
12
13
14
Training
IDENTIFY CYBER COMPONENTS AND CYBER CRITICAL IC INFRASTRUCTURE
MANAGE RISKS OF IC –SCADA
CONTINUITY STRETEGIES, DRP IC
SECURITY AT ORGANIZATIONAL LEVEL
PHYSICALCAND LOGICAL SECURITY
INFRASTRUCTURE IC´S SECURITY SOLUTIONS
MANAGE IC SECURITY
MANAGING AND MONITORING
CHANGE´S MANAGEMENT, COMUNICATION´S CHANELS
SGSI IC AND SCADA SYSTEMSAPLICATION OF CIBERSECURITY ROADMAP
Energy´sevolution

30. FUTURE CHALLENGES?

31. CONCLUSIONS

32. CONCLUSIONS

33. CONCLUSIONS

34. ¨Security is, I would say, our number one priority, because all the exciting things that we can do with computers -organize our lives, keep in touch with the people, be creative -if we do not resolve these security problems, we will have to stop. ¨Bill Gates THANKS
Followus:
@IDENTIAN Bogotá, Cra. 16 A No. 80-16 Of. 402 / +571 7042400 / +57 315 333 7483 / +57 300 688 19507682 Audubon Meadow Way, Alexandria, VA 22306 / +1 703 625 6699www.identian.co -info@identian.co