Introduction to SCADA Security

1. Introduction to SCADA Security Class 5: Mitigation Strategies 12/20/2013Clint Bodungen

2. Mitigation STRATEGY Now let’s take everything we’ve learned about Threats, Vulnerabilities, Exploits, and Attack Methodology, and apply it towards building mitigation strategies. FACT: A study by DHS reported that by the time an intrusion is discovered, an average of at least 90 days has passed since the initial exposure. FACT: That same study reported that relating to ICS/SCADA networks, it takes an average of about a year from the time a vulnerability is discovered within an application or firmware until the vulnerability is patched within the operator’s systems. (Idaho National Laboratories, “Empirical Estimates of Zero-Day Vulnerabilities in Control Systems”, 2009)

3. Mitigation Strategy Security 101: What are we protecting? Enterprise Confidentiality Integrity Availability Industrial Availability Integrity Confidentiality The CISSP “CIA Triad” Still Applies… Just in a Different Way VS.

4. Mitigation Strategy Security 101: Strategy Overview • Risk can never be fully mitigated • Risk is either mitigated, reduced or accepted/managed • Remember our Threats, Vulnerabilities, and Exploits? Now think of these like a fire triangle (ingredients required for a fire to burn): Fire Attack Vulnerability Exploit Threat • Take any one leg out, and the Fire will be mitigated. • This same principle applies with all 3 aspects of security.

5. Mitigation Strategy Security 101: Strategy Overview • Eliminating Exploits • While you can’t eliminate exploits, understanding them will help you maximize your mitigation strategy later by knowing exactly what controls to implement and how to deploy them most effectively • Eliminating Threats • Like exploits, it is nearly impossible to eliminate the actual threats aside from terminating employees (not Arnold Schwarzenegger style) • But understanding their methods allows you to anticipate how and when they will strike, thereby maximizing your mitigation deployments • Eliminating Vulnerability • Eliminating or blocking access to vulnerabilities is the only real direct control you have in the attack triangle scenario • Primary methods of eliminating vulnerabilities: • Restrict access to the system • System Hardening (Eliminate the vulnerability, remove/block ability to exploit)

6. Mitigation Strategy Security 101: Restricting Network Access • Network Segmentation • Concept of filtering by protocol/services/source and destination address to isolate network traffic and services from private or sensitive parts of the network; e.g., traffic restricted to an extranet • Design the network architectures to separate “untrusted” traffic apart from “private” and “trusted” network segments/sub-domains • Accomplished by: • Filtering by protocol/services • Filtering by source and destination address • Network design • ISA99/IEC 62433, NERC CIP, API 1164 and many others process control security standards require it • Technologies • Firewalls • Implement stateful inspection • White list IP address access when possible • Explicit port ingress and egress when possible • Should block malformed packets. • Detect and mitigate against DDoS or DoS storms. • Bridged “bump in the wire” firewall for field devices and SCADA network segmentation • DMZ Implementation • Denies endpoints access to networks when endpoints do not meet security requirements • Allows thin client access instead of direct network access

7. Mitigation Strategy Security 101: Restricting Network Access • Network Segmentation 1. Process 4 2. HSE/Control 3. Supervisory Control 4. Operations Management 5. Enterprise 3 2 1 0

8. Mitigation Strategy Security 101: Restricting Network Access • Technologies • Firewalls • Implement stateful inspection • White list IP address access when possible • Explicit port ingress and egress when possible • Should block malformed packets. • Detect and mitigate against DDoS or DoS storms. • Bridged “bump in the wire” firewall for field devices and SCADA network segmentation • DMZ Implementation • Denies endpoints access to networks when endpoints do not meet security requirements • Allows thin client access instead of direct network access • Switch Port Security • MAC Address filtering helps prevent unauthorized port access to switches • It’s not fool proof as MAC addresses can be spoofed • “Sticky MACs” tie specific MAC addresses to specific switch ports and add extra layers of security

9. Mitigation Strategy Security 101: Restricting Network Access • Never use WiFi (802.x) on your SCADA Network! • But if you feel you must: • Do NOT use WEP • Enable WPA/WPA2 • Use enterprise TKIP • Change SSID default values from vendor’s configuration • Disable SSID broadcast • Implement another layer of authentication (IPSec) • Logically place the AP in a DMZ with a firewall between the AP and internal network • Physically place the AP in the center of the building if possible • Beware of windows and other rogue APs

10. Mitigation Strategy Security 101: Restricting Host Access • Password Security • Poor, weak passwords have the following characteristics • Contains less than eight characters • Is a word found in a dictionary (English or foreign) • Is a common usage word such as • Birthdays and other personal information, such as addresses and phone numbers • Word or number patterns like • Common words spelled backwards. • Any of the above preceded or followed by a digit (e.g., secret1, 1secret) • Strong passwords have the following characteristics • Contain both upper and lower case characters • Contain special characters • Are at least eight alphanumeric characters long (15 characters to defeat rainbow tables) • Are not a word in any language, slang, dialect, jargon, etc. • Are not based on personal information, names of family, etc. • Never be written down or stored online

11. Mitigation Strategy Security 101: Restricting Host Access • Strong Authentication For Remote Access • Something you know (i.e. a password) • Something you have (i.e. token or smart card) NOTE - 2-Factor Authentication Should be used for physical access as well: • Proximity cards alone are simply RFID • Proximity card + pin or bio reader should be used • Proximity card access alone can be easily defeated • Most organizations don’t use two factor authentication with proximity card security

12. Mitigation Strategy Security 101: Communications Security • Use VPN when possible • Secure Shell (SSH) instead of telnet • SSL instead of standard HTTP

13. Mitigation Strategy Security 101: Blocking Exploitation/System Hardening • Security Patching & Anti-Virus Software • Should be done in accordance with vendor recommendation • Should be tested in a test and development environment before deploying • Typical Anti-Virus drawbacks • Requires regular updates • Signature based • Only as good as the signatures and updates • Does not protect against Zero-Day • Use Heuristics based (can be difficult to “tune” and might cause problems in SCADA networks) • Application White Listing (AWL) • Provides an alternative when other malware prevention isn’t an option • Only allows authorized processes to run instead of signature based • Protects against most Zero-Day • Small footprint • Does not require updates • “Learning modes” provide safe installation without interruption

14. Mitigation Strategy Security 101: Blocking Exploitation/System Hardening • ICS/SCADA System Specific Security • SCADA, DCS or HMI Software • Should be ran under a user account with least privileges. • Security model of the software should be used for individual (not group) login accounts for accountability. • All user actions should be logged. • SCADA, DCS or HMI software should be on a patch cycle based on the frequency of change from the vendor. BHP should not allow its software to get more than (3) revisions old if an upgrade or patch can be safely made without affecting the operations of the facility. • Set key executables, services and DLLs to auto-restart upon failure. • Data Historian or Archival Applications • Should be installed in a neutral DMZ network not in SCADA or IT environments. • Do not install multiple network cards in the historian server and directly connect it to all networks that it needs to communicate with. • Specific firewall rules should govern the flow of data from SCADA to the data historian servers.

15. Mitigation Strategy Security 101: Monitoring • Intrusion Detection System (IDS) • Requires expertise • Limited application • Security Information and Event Management (SIEM) • Combines IDS, management console, log management, vulnerability assessment integration, etc. • Adds threat intelligence • Vendors • AlienVault • OSSIM (free AlienVault) • Mcafee SIEM (Nitro) • ArcSight • Qradar • Cisco MARS

16. Mitigation Strategy Layered “Defense in Depth” Strategy • Standards and best practices recommend a layered defense model (a.k.a. – Defense in Depth) • Multiple layers of security controls provide enhanced deterrence against all but the most determined attackers in addition to alternative defense where direct controls are not an option • For example: Anti-virus software may not be an option for some DCS environments so alternative, layered defense would be appropriate

17. Mitigation Strategy Layered “Defense in Depth” Strategy • But this can be taxing on resources • How can we maximize cost/benefit ratio?

18. Mitigation Strategy Topological Vulnerability Analysis Strategy (TVA) • The Topological Vulnerability Analysis (TVA) strategy is much more efficient in terms of resource utilization • When combined with a proper risk analysis, TVA provides a strategy that still effectively mitigate security threats, while meeting budget requirements • TVA provides comprehensive vision of your organization’s risk profile by overlaying system vulnerability details and potential attack paths onto a network diagram.

19. Mitigation Strategy Topological Vulnerability Analysis Strategy (TVA) • Inventory systems, diagram networks and communication paths • Determine system criticalities • Assess and rate threats and vulnerabilities • Estimate attack methodologies and likelihood according to communication paths • Prioritize mitigation by most critical systems with the highest level of vulnerabilities and the most communication pathways

20. Questions? • If you liked this week’s cyber security training lectures on ICS/SCADA security, check out Cimation University! • Coming January 2014: • Introduction to ICS/SCADA Security • ICS/SCADA Security Vulnerability Assessment (SVA) • ICS/SCADA Security Risk Analysis and Mitigation • Hacking SCADA: Advanced ICS/SCADA Vulnerability Assessment & Penetration Testing • www.cimation.com/CimationUniversity Clint Bodungen Senior ICS/SCADA Security Researcher, Cimation 281.832.3129 cbodungen@cimation.com www.cimation.com