SCADA - Fear, Uncertainty, and The Digital Arm Aged Don

Fear,Uncertainty,andtheDigitalArmageddon
SCADA
PresentedByMorganMarquisBoire
2007SecurityAssessment.com
Whois
Hi,MyNameisMorgan
Whois
Hi,MyNameisMorgan Imasecurityguy
Whois
Hi,MyNameisMorgan Imasecurityguy SecurityAssessment.com
Whois
Hi,MyNameisMorgan Imasecurityguy SecurityAssessment.com Kiwicon
Introduction
TodaywewillbecoveringSCADA
Whatisit? Whyisitsohiprightnow? Howdowebustit? WhengoodSCADAgoesbad Aretherecyberterroristslurkinginthebushesoutsidemy

SCADAinstallation?
SCADAsecurityandSecuringyourSCADAnetworks Questions
WhatthehellisSCADA? SCADAis
IndustrialControlSystems(ICS),commonlyreferredtoas
SCADAunderliemuchoftheinfrastructurethatmakeseveryday lifepossibleinthemodernworld.
WhatthehellisSCADA? SCADAis
IndustrialControlSystems(ICS),commonlyreferredtoas SupervisoryControlandDataAcquisition
SCADAunderliemuchoftheinfrastructurethatmakeseveryday lifepossibleinthefirstworld.
SCADAsystemssupportprocessesthatmanagewatersupply
andtreatmentplants;
Controlpipeslinedistributionsystemsandpowergrids; Operatechemicalandinothercountries,nuclearpowerplants; HVACsystemsHeating,Ventilation,AirConditioning Lift/ElevatorSystems TrafficSignals Masstransitsystems

WhatthehellisSCADA? SCADANetworksPastandPresent
Thesecouldbedescribedasprimitivewhencomparedtomost
modernnetworks
ProprietaryHardware&Software(Past) Manualsandproceduresnotwidelyavailable Closedsystemsconsideredtobeimmunetooutsidethreats InterconnectedNetworks(Present) UtilityNetworks,CorporateNetworks,Internet DNP3overTCP/IP

Modernstuffissusceptibletomodern(orperhapsnotsomodern) attacks(SYNFlood,Pingofdeath)
WhatthehellisSCADA?
Sowhatisitactually?
ASCADAsystemusuallyincludessignalhardware(inputand
output),controllers,networks,userinterface(HMI), communicationsequipmentandsoftware.Alltogether,theterm SCADAreferstotheentirecentralsystem.Thecentralsystem usuallymonitorsdatafromvarioussensorsthatareeitherin closeproximityoroffsite(sometimesmilesaway).
WhatthehellisSCADA? HowdoesSCADAwork?
MultitierSystems PhysicalMeasurement/controlendpoints RTU,PLC Measurevoltage,adjustvalve,flipswitch Intermediateprocessing UsuallybasedonacommonlyusedOSes *nix,Windows,VMS CommunicationInfrastructure Serial,Internet,Wifi Modbus,DNP3,OPC,ICCP
WhatthehellisSCADA?
WhatthehellisSCADA? ComponentsofaSCADAnetwork
RTU/PLCReadsinformationonvoltage,flow,thestatusof
switchesorvalves.Controlspumps,switches,valves
MTUMasterTerminalUnitProcessesdatatosendtoHMI HMIHumanMachineInterfaceGUI,WindowsInformation
traditionallypresentedintheformofamimicdiagram
CommunicationnetworkLAN,Wireless,Fiberetcetc
WhatthehellisSCADA?
WhatthehellisSCADA?
http://www.armfield.co.ukIndustrialFoodTechnology
WhatthehellisSCADA? ProtocolsofaSCADANetwork RawDataProtocolsModbus/DNP3
Forserialradiolinksmainly,butyoucanrunanythingover Readsdata(measuresvoltage/fluidflowetc)
anythingthesedays,especiallyTCP/IP(forbetterorworse)
Sendscommands(flipsswitches,startspumps)/alerts(its
broken!) HighLevelDataProtocolsICCP/OCP
Designedtosenddata/commandsbetweenapps/databases Providesinfoforhumans Theseprotocolsoftenbridgebetweenofficeandcontrol

networks
WhatthehellisSCADA?
Letsnotforget
WhatthehellisSCADA?
LetsnotforgetTheoperator.
Inkeepingwithtradition
Sohotrightnow LotsofResearchBeingPublished
BlackHatFederal2k6MaynorandGraham(ISS)SCADA
SecurityandTerrorism:Werenotcryingwolf.
HackintheBox2k7RaoulChiesaandMayhemHacking
SCADA:Howto0wnCriticalNationalInfrastructure Protocols:UsingSulleyFuzzer
Defcon2k7GaneshDevarajanUnravelingSCADA PetroleumSafetyGresserHackingSCADA/SASSystems
WhyisSCADAthehottopicofsecurity?
Virtualisationrootkitsarehardformostpeopletounderstand ThepossibleramificationsofaSCADAcompromiseare
widespread
NewthreatsApparentlywehavecyberterroristsnow
CyberTerrorist? Maybeinthisroom.
SoHotRightNow SCADAischanging
Fromproprietary,obscure,andisolatedsystems Towardsstandard,documentedandconnectedones
It'snotthattheseguysdon'tknowwhattheyaredoing.Partofitis thatthesesystemswereengineered20yearsago,andpartofitis thattheengineersdesignedthesethingsassumingtheywouldbe isolated.Butwham!theyarenotisolatedanymore.
AlanPaller,directorofresearch,SANSInstitute
SCADAProtocols TestingtheSecurityofSCADANetworks
Scada(in)Security
YoucantestthesecurityofSCADAnetworkswithwhatyouknow now Therestyoucanfindontheinternet YoudontneedSCADAfuzzersor(particularly)customtools
SCADA(in)Security
YoucantestthesecurityofSCADAnetworkswithwhatyouknow now Therestyoucanfindontheinternet YoudontneedSCADAfuzzersor(particularly)customtools OntocommonSCADAproblems
SCADA(in)Security LackofAuthentication
Idontmeanlackofstrongauthentication.ImeanNOAUTH!! Theresnousersonanautomatedsystem OPConWindowsrequiresanonymousloginrightsforDCOM

(XPSP2breaksSCADAbecauseanonymousDCOMoffby default) etcetcdonotapply
Normalpoliciesregardingusermanagement,passwordrotation
CantPatch,Wontpatch
SCADAsystemstraditionallyarentpatched Installthesystem,replacethesystemadecadelater Effectsofpatchingasystemcanbeworsethantheeffectsof

compromise?
Verylargevulnerabilitywindow
SCADA(in)Security ItsaBraveNewInterconnectWorld
ItwasacommonlyheldbeliefthatSCADAnetworkswere
isolated
InrealitytherearefrequentlyNUMEROUSconnections Dialinnetworks,radiobackdoors,wireless,LANconnections,
InsecureByDesign dualhomingviasupportlaptops,connectedtocorporateLANfor easeofmanagementandconvenientdataflow
Anonymousservicestelnet/ftp(nousersremember?) Passwordsdefaultorsimple,NEVERchanged AccesscontrolsnotusedasFirewallscausedelayswhichcan

impactresponseswhichmusthappeninrealtime
Allprotocolscleartext.Speedmoreimportantconfidentiality
SCADA(in)Security
JustMisunderstood SCADAhasadifferentsecuritymodeltotraditionalITNetworks
JustMisunderstood SCADAhasadifferentsecuritymodeltotraditionalITNetworks
TimeforsomeF.U.D. SecurityRiskdefinedlargelybythreat
Massivepowerblackout OilRefineryexplosion Wastemixedinwithdrinkingwater Damopenscausingflooding TrafficChaos NuclearExplosion?
TimeforsomeF.U.D. SecurityRiskdefinedlargelybythreat
Massivepowerblackout OilRefineryexplosion Wastemixedinwithdrinkingwater Damopenscausingflooding TrafficChaos NuclearExplosion? Lackofcreaturecomforts?(whenHVACSCADAfails)
TimeforsomeF.U.D. RiskisworsethesedaysbecausehackingisEASY!
TimeforsomeF.U.D. RiskisworsethesedaysbecausehackingisEASY!
Bustoutyouraircrack,nmap,nessus,metasploit,wicrawl,buy yourselfaRussian0daypackandyourereadytobepartofthe problem
IwaspromisedsomeFUD
RichardClarkantiterroradvisortotheBushadministration cybersecurityczarandterrorismexpert
Mockintrusionscenarioshavealwayssucceeded
IwaspromisedsomeFUD
RichardClarkantiterroradvisortotheBushadministration cybersecurityczarandterrorismexpert
Mockintrusionscenarioshavealwayssucceeded
Wheresmydigitalarmageddon???
Letswatchavideothenwellhaveacoupleofcasestudies
IwaspromisedsomeFUD WhenGoodSCADAGoesSERIOUSLYWRONG
About3:28p.m.,Pacificdaylighttime,onJune10,1999,a16
inchdiametersteelpipelineownedbyOlympicPipeLine Companyrupturedandreleasedabout237,000gallonsof gasolineintoacreekthatflowedthroughWhatcomFallsParkin Bellingham,Washington.About1.5hoursaftertherupture,the gasolineignitedandburnedapproximately1.5milesalongthe creek.Two10yearoldboysandan18yearoldyoungman diedasaresultoftheaccident.Eightadditionalinjurieswere documented.Asinglefamilyresidenceandthecityof Bellingham'swatertreatmentplantwereseverelydamaged.As ofJanuary2002,Olympicestimatedthattotalpropertydamages wereatleast$45million.
10thJune,1999
IwaspromisedsomeFUD Thiswasanaccident
TheOlympicPipelineSCADAsystemconsistedofTeledyne
BrownEngineeringSCADAVectorsoftware,version3.6.1., runningontwoDigitalEquipmentCorporation(DEC)VAXModel 4000300computerswithVMSoperatingsystemVersion7.1.In additiontothetwomainSCADAcomputers(OLY01and02),a similarlyconfiguredDECAlpha300computerrunning Alpha/VMSwasusedasahostfortheseparateModisette Associates,Inc.,pipelineleakdetectionsystemsoftware package.
IwaspromisedsomeFUD WormAttack
InAugust2003Slammerinfectedaprivatecomputernetworkat
theidledDavisBessenuclearpowerplantinOakHarbor,Ohio, disablingasafetymonitoringsystemfornearlyfivehours. NIST,GuidetoSCADA
SlammerwormcrashedOhionukeplantnetworkKevin
Poulson http://www.securityfocus.com/news/6767
IwaspromisedsomeFUD WormAttack
TheSlammerwormenteredtheDavisBesseplantthrougha
circuitousroute.Itbeganbypenetratingtheunsecurednetwork ofanunnamedDavisBessecontractor,thensquirmedthrough aT1linebridgingthatnetworkandDavisBesse'scorporate network.TheT1line,investigatorslaterfound,wasoneof multipleingressesintoDavisBesse'sbusinessnetworkthat completelybypassedtheplant'sfirewall,whichwasprogrammed toblocktheportSlammerusedtospread.
IwaspromisedsomeFUD DigruntledEmployee
VitekBoden,in2000,wasarrested,convictedandjailed
becausehereleasedmillionsoflitersofuntreatedsewageusing hiswirelesslaptop.IthappenedinMaroochyShire,Queensland, asrevengeagainsthisaformeremployer.
http://www.theregister.co.uk/2001/10/31/hacker_jailed_for_reven
ge_sewage/
IwaspromisedsomeFUD DigruntledEmployee
"Marinelifedied,thecreekwaterturnedblackandthestenchwas
unbearableforresidents,"saidJanelleBryantoftheAustralian EnvironmentalProtectionAgency. TheMaroochydoreDistrictCourtheardthat49yearoldVitekBoden hadconductedaseriesofelectronicattacksontheMaroochyShire sewagecontrolsystemafterajobapplicationhehadmadewasrejected bythearea'sCouncil.Atthetimehewasemployedbythecompanythat hadinstalledthesystem.Bodenmadeatleast46attemptstotake controlofthesewagesystemduringMarchandApril2000. On23April,thedateofBoden'slasthackingattempt,policewhopulled overhiscarfoundradioandcomputerequipment. LaterinvestigationsfoundBoden'slaptophadbeenusedatthetimeof theattacksandhisharddrivecontainedsoftwareforaccessingand controllingthesewagemanagementsystem.
IwaspromisedsomeFUD Sabotage
ThomasC.Reed,RonaldRegansSecretary,describedinhis
bookAttheabysshowtheU.S.arrangedfortheSovietsto receiveintentionallyflawedSCADAsoftwaretomanagetheir naturalgaspipelines."Thepipelinesoftwarethatwastorunthe pumps,turbines,andvalueswasprogrammedtogohaywire, afteradecentinterval,toresetpumpspeedsandvalvesettings toproducepressuresfarbeyondthoseacceptabletopipeline jointsandwelds."A3kilotonexplosionwastheresult,in1982in Siberia.
http://www.themoscowtimes.ru/stories/2004/03/18/014.html
IwaspromisedsomeFUD Otherincidents
In1992,aformerChevronemployeedisableditsemergency
alertsystemin22states.Thiswasntdiscovereduntilan emergencydidnotraisetheappropriatealarms
In1997,ateenagerbrokeintoNYNEXandcutoffWorcester
AirportinMassachusettsfor6hoursbyaffectinggroundandair communications managedtocontroltheworldslargestnaturalgaspipeline (Gazprom) WhiletheBlasterwormwasnotthecause,manyrelated systemswerefoundtobeinfected
In2000theRussiangovernmentannouncedthathackershad In2003,theeastcoastofAmericaexperiencedablackout. ComputersandmanualsseizedinAlQaeda(allegedly)training
campswerefullofSCADAinformationrelatedtodamsandother suchstructures
O.K.toomuchFUD
ThedigitalArmageddonhasnthappenedyet
Storiesareobviouslyexaggeratedtostirupoutrage Blasterdidnotcausetheeastcoastpoweroutage Storiesofteenagedhackersarefrequentlyexaggerated WhileAlQaedahadSCADAinformation,nothingindictateda

planinvolvingSCADA Nobodyhaseverbeenkilledbyacyberterrorist Direpredictionshavethusfarbeenincorrect.
IDCnamed2003theyearofcyberterrorism,predictingthata
majorcyberterrorismeventwouldbringtheinternettoitsknees.
TheWayForward GoodthingshappeninginSCADAsecurity
ThereareagrowingnumberofstandardsinSCADASecurity
SomeexcellentpracticalguidesalaNISTfromNSAandother criticalinfrastructuregroups. Letsdosomegood!

SecuringSCADA
SecuringYourSCADA
SecuringSCADA
SecuringYourSCADA
Notanallinclusivelist!!
SecuringSCADA
SecuringYourSCADA
Notanallinclusivelist!! Lotsofgoodinformationonline
SecuringSCADA
SecuringYourSCADA
Notanallinclusivelist!! Lotsofgoodinformationonline Muchofitiscommonsense/IndustryBestPractice
Somepracticalsteps
SecuringSCADA IdentifyAllConnectionstoSCADANetworks
InternalLAN,WANconnections,includingbusinessnetworks TheInternet Wirelessnetworkdevices,includingradio,satelliteetc Modemordialupconnections Connectionstovendors,regulatoryservicesorbusiness

partners
InternalLAN,WANconnections,includingbusinessnetworks TheInternet Wirelessnetworkdevices,includingradio,satelliteetc Modemordialupconnections Connectionstovendors,regulatoryservicesorbusiness

partners
Conductathoroughriskanalysistoassesstheriskandnecessityof eachconnectiontotheSCADAnetwork Developacomprehensiveunderstandingofhowtheseconnections areprotected
SecuringSCADA DisconnectUnnecessaryConnectionstoSCADANetworks
SecuringSCADA DisconnectUnnecessaryConnectionstoSCADANetworks IsolatetheSCADAnetworkfromothernetworkconnectionstoget thehighestdegreeofsecuritypossible.
Whileconnectionstoothernetworksallowefficientand
convenientpassingofdata,itssimplynotworththerisk.
UtilisationofDMZsanddatawarehousingcanfacilitatethesecure transferofdatafromSCADAtobusinessnetworks.
SecuringSCADA EnsureSecurityBestPracticeisFollowedonanyRemaining Connections
SecuringSCADA EnsureSecurityBestPracticeisFollowedonanyRemaining Connections Conductpenetrationtesting
Theresnosubstituteforhavinganactualhumanattemptan
intrusionintoyournetwork Implement:
Firewalls IntrusionDetection/PreventionSystems(IDS/IPS) VulnerabilityAssessment RegularAudits
SecuringSCADA HardenYourSCADANetworks!
SecuringSCADA HardenYourSCADANetworks! SCADAcontrolserversbuiltoncommercialoropensource operatingsystemsfrequentlyrundefaultservices
ThisissueiscompoundedwhenSCADAnetworksare
interconnectedwithothernetworks Removeunusedservicesespeciallythoseinvolvinginternetaccess, emailservices,remotemaintenanceetc WorkwithSCADAvendorsinordertoindentify(in)secure configurations
SecuringSCADA HardenYourSCADANetworks! SCADAcontrolserversbuiltoncommercialoropensource operatingsystemsfrequentlyrundefaultservices
ThisissueiscompoundedwhenSCADAnetworksare
interconnectedwithothernetworks Removeunusedservicesespeciallythoseinvolvinginternetaccess, emailservices,remotemaintenanceetc WorkwithSCADAvendorsinordertoindentify(in)secure configurations Thespooks(NSA)haveasomeusefulguidelinesinthisarea
SecuringSCADA DontRelyonSecurityThroughObscurity
SecuringSCADA DontRelyonSecurityThroughObscurity SomeSCADAsystemsuseunique,proprietaryprotocols
Relyingontheseforsecurityisnotagoodidea
SecuringSCADA DontRelyonSecurityThroughObscurity SomeSCADAsystemsuseunique,proprietaryprotocols
Relyingontheseforsecurityisnotagoodidea
Demandthatvendorsdisclosethenatureofvendorbackdoorsor interfacestoyourSCADAsystems Demandthatvendorsprovidesystemsthatcanbesecured!
SecuringSCADA ImplementSecurityfeatureprovidedbySCADAvendors
WhilemostolderSCADAsystemshavenosecurityfeatures
newerSCADAsystemsoftendo
newerSCADAsystemsoftendo easeofinstallation security
Moreoftenthannotthough,theseareturnedoffbydefaultfor Factorydefaultsoftenprovidemaximumusabilityandminimum Ensurethatstrongauthenticationisusedforcommunications.

Connectionsviamodems,wireless,andwirednetworks representasignificantvulnerabilitytoSCADAnetworks
newerSCADAsystemsoftendo easeofinstallation security
Moreoftenthannotthough,theseareturnedoffbydefaultfor Factorydefaultsoftenprovidemaximumusabilityandminimum Ensurethatstrongauthenticationisusedforcommunications.

Connectionsviamodems,wireless,andwirednetworks representasignificantvulnerabilitytoSCADAnetworks. accesscontrols!!!!@#$@#$
^^^^Successfulwardialing/wardrivingcouldbypassallother
SecuringSCADA ConductPhysicalSecuritySurveys
AnylocationwhichhasaconnectiontotheSCADAnetwork Inventoryaccesspoints.Thisincludes: Remotetelephone Cables/FiberOpticLinksthatcouldbetapped Terminals Wireless/Radio
mustbeconsideredatarget(especiallyunmannedorunguarded sites)
AnylocationwhichhasaconnectiontotheSCADAnetwork Inventoryaccesspoints.Thisincludes: Remotetelephone Cables/FiberOpticLinksthatcouldbetapped Terminals Wireless/Radio
mustbeconsideredatarget(especiallyunmannedorunguarded sites)
EnsurethatthisincludesALLremotesitesconnectedtotheSCADA network
SecuringSCADA IntrusionDetectionandIncidentResponse
Tobeabletorespondtocyberattacksyouneedtobeableto
detectthem essential
Alertingofsuspiciousactivityfornetworkadministratorsis Loggingonallsystems Incidentresponseproceduresmustbeinplacetoalloweffect

responsetoanattack
SecuringSCADA Allthegoodstuffthatyouknowandlove(withcatchphrasesthat youveheardamilliontimesbefore)
Backups/DisasterRecovery Backgroundchecks Limitnetworkaccess(principleofleastprivilege) Defenseindepth Trainingforstaff(avoidsocialengineering)
Conclusion AttacksareeasierthanbeforeandSCADAisimportant TheWorldisntgoingtoexplodetomorrow DontlettheFUDoverwhelmyou DOsecureyourSCADAnetworks WhiletherearemanybigproblemstobesolvedwithSCADA security,thisfieldisinitsinfancywhereITsecurityiscomparatively teenaged. Usecommonsense

GreetingsandThanks SecurityAssessment.com SoSD InsomniaSec TheKiwiconCrue ISIGNZ NZISF
Questions?
http://www.securityassessment.com morgan@securityassessment.com

SCADA - Fear, Uncertainty, and The Digital Arm Aged Don

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SCADA - Fear, Uncertainty, and The Digital Arm Aged Don

Uploaded by

Copyright:

Available Formats

Fear,Uncertainty,andtheDigitalArmageddon

Hi,MyNameisMorgan Imasecurityguy SecurityAssessment.com

Hi,MyNameisMorgan Imasecurityguy SecurityAssessment.com Kiwicon

Whatisit? Whyisitsohiprightnow? Howdowebustit? WhengoodSCADAgoesbad Aretherecyberterroristslurkinginthebushesoutsidemy

Controlpipeslinedistributionsystemsandpowergrids; Operatechemicalandinothercountries,nuclearpowerplants; HVACsystemsHeating,Ventilation,AirConditioning Lift/ElevatorSystems TrafficSignals Masstransitsystems

ProprietaryHardware&Software(Past) Manualsandproceduresnotwidelyavailable Closedsystemsconsideredtobeimmunetooutsidethreats InterconnectedNetworks(Present) UtilityNetworks,CorporateNetworks,Internet DNP3overTCP/IP

output),controllers,networks,userinterface(HMI), communicationsequipmentandsoftware.Alltogether,theterm SCADAreferstotheentirecentralsystem.Thecentralsystem usuallymonitorsdatafromvarioussensorsthatareeitherin closeproximityoroffsite(sometimesmilesaway).

WhatthehellisSCADA? ProtocolsofaSCADANetwork RawDataProtocolsModbus/DNP3

Designedtosenddata/commandsbetweenapps/databases Providesinfoforhumans Theseprotocolsoftenbridgebetweenofficeandcontrol

YoucantestthesecurityofSCADAnetworkswithwhatyouknow now Therestyoucanfindontheinternet YoudontneedSCADAfuzzersor(particularly)customtools

YoucantestthesecurityofSCADAnetworkswithwhatyouknow now Therestyoucanfindontheinternet YoudontneedSCADAfuzzersor(particularly)customtools OntocommonSCADAproblems

Idontmeanlackofstrongauthentication.ImeanNOAUTH!! Theresnousersonanautomatedsystem OPConWindowsrequiresanonymousloginrightsforDCOM

SCADAsystemstraditionallyarentpatched Installthesystem,replacethesystemadecadelater Effectsofpatchingasystemcanbeworsethantheeffectsof

Anonymousservicestelnet/ftp(nousersremember?) Passwordsdefaultorsimple,NEVERchanged AccesscontrolsnotusedasFirewallscausedelayswhichcan

Massivepowerblackout OilRefineryexplosion Wastemixedinwithdrinkingwater Damopenscausingflooding TrafficChaos NuclearExplosion?

Massivepowerblackout OilRefineryexplosion Wastemixedinwithdrinkingwater Damopenscausingflooding TrafficChaos NuclearExplosion? Lackofcreaturecomforts?(whenHVACSCADAfails)

Bustoutyouraircrack,nmap,nessus,metasploit,wicrawl,buy yourselfaRussian0daypackandyourereadytobepartofthe problem

becausehereleasedmillionsoflitersofuntreatedsewageusing hiswirelesslaptop.IthappenedinMaroochyShire,Queensland, asrevengeagainsthisaformeremployer.

AirportinMassachusettsfor6hoursbyaffectinggroundandair communications managedtocontroltheworldslargestnaturalgaspipeline (Gazprom) WhiletheBlasterwormwasnotthecause,manyrelated systemswerefoundtobeinfected

In2000theRussiangovernmentannouncedthathackershad In2003,theeastcoastofAmericaexperiencedablackout. ComputersandmanualsseizedinAlQaeda(allegedly)training

Storiesareobviouslyexaggeratedtostirupoutrage Blasterdidnotcausetheeastcoastpoweroutage Storiesofteenagedhackersarefrequentlyexaggerated WhileAlQaedahadSCADAinformation,nothingindictateda

SomeexcellentpracticalguidesalaNISTfromNSAandother criticalinfrastructuregroups. Letsdosomegood!

Notanallinclusivelist!! Lotsofgoodinformationonline Muchofitiscommonsense/IndustryBestPractice

InternalLAN,WANconnections,includingbusinessnetworks TheInternet Wirelessnetworkdevices,includingradio,satelliteetc Modemordialupconnections Connectionstovendors,regulatoryservicesorbusiness

InternalLAN,WANconnections,includingbusinessnetworks TheInternet Wirelessnetworkdevices,includingradio,satelliteetc Modemordialupconnections Connectionstovendors,regulatoryservicesorbusiness

Conductathoroughriskanalysistoassesstheriskandnecessityof eachconnectiontotheSCADAnetwork Developacomprehensiveunderstandingofhowtheseconnections areprotected

SecuringSCADA DisconnectUnnecessaryConnectionstoSCADANetworks IsolatetheSCADAnetworkfromothernetworkconnectionstoget thehighestdegreeofsecuritypossible.

SecuringSCADA EnsureSecurityBestPracticeisFollowedonanyRemaining Connections

SecuringSCADA EnsureSecurityBestPracticeisFollowedonanyRemaining Connections Conductpenetrationtesting

Firewalls IntrusionDetection/PreventionSystems(IDS/IPS) VulnerabilityAssessment RegularAudits

SecuringSCADA HardenYourSCADANetworks! SCADAcontrolserversbuiltoncommercialoropensource operatingsystemsfrequentlyrundefaultservices

SecuringSCADA HardenYourSCADANetworks! SCADAcontrolserversbuiltoncommercialoropensource operatingsystemsfrequentlyrundefaultservices

SecuringSCADA DontRelyonSecurityThroughObscurity SomeSCADAsystemsuseunique,proprietaryprotocols

SecuringSCADA DontRelyonSecurityThroughObscurity SomeSCADAsystemsuseunique,proprietaryprotocols

Moreoftenthannotthough,theseareturnedoffbydefaultfor Factorydefaultsoftenprovidemaximumusabilityandminimum Ensurethatstrongauthenticationisusedforcommunications.

Moreoftenthannotthough,theseareturnedoffbydefaultfor Factorydefaultsoftenprovidemaximumusabilityandminimum Ensurethatstrongauthenticationisusedforcommunications.

AnylocationwhichhasaconnectiontotheSCADAnetwork Inventoryaccesspoints.Thisincludes: Remotetelephone Cables/FiberOpticLinksthatcouldbetapped Terminals Wireless/Radio

AnylocationwhichhasaconnectiontotheSCADAnetwork Inventoryaccesspoints.Thisincludes: Remotetelephone Cables/FiberOpticLinksthatcouldbetapped Terminals Wireless/Radio

Alertingofsuspiciousactivityfornetworkadministratorsis Loggingonallsystems Incidentresponseproceduresmustbeinplacetoalloweffect

SecuringSCADA Allthegoodstuffthatyouknowandlove(withcatchphrasesthat youveheardamilliontimesbefore)

Backups/DisasterRecovery Backgroundchecks Limitnetworkaccess(principleofleastprivilege) Defenseindepth Trainingforstaff(avoidsocialengineering)

Conclusion AttacksareeasierthanbeforeandSCADAisimportant TheWorldisntgoingtoexplodetomorrow DontlettheFUDoverwhelmyou DOsecureyourSCADAnetworks WhiletherearemanybigproblemstobesolvedwithSCADA security,thisfieldisinitsinfancywhereITsecurityiscomparatively teenaged. Usecommonsense

GreetingsandThanks SecurityAssessment.com SoSD InsomniaSec TheKiwiconCrue ISIGNZ NZISF

You might also like