Introduction to Industrial Control Systems Cybersecurity

Introduction to Industrial Control Systems

Cybersecurity

R. Minicucci, CCNP, CEH, Security+ GE Oil & Gas – Principal Cyber Security Engineer

2

Agenda

1

2

3

4

Context---30m

IT vs. SCADA---30m Threats & Attack surface---30m

Architecture and components ---3h

5 Overview of applicable standards---30m

6 Countermeasures ---30m

7 Horizon---10m

CONTEXT

Courtesy of GE Oil & Gas

Hiring practices

Access control

Training

Vulnerability monitoring & security

events

Incident report & response

Security software updates*

Information mgmt

Backup & restore

Documentation

Closed ports

Remote Connection*

Access & account management

Physical Security

CRITICAL CYBER ASSETS

Electronic Security

Incident Response

System Security

Mgmt

* Most critical areas

CONTEXT – Industry Landscape

Presenter

Regardless of the industry vertical, cybersec domain always spans across these areas.

5

CONTEXT - What are SCADA/ICS ?

• SCADA=Supervisory Control and Data Acquisition • ICS= Industrial Control Systems PCS=Process Control Systems, • DCS= Distributed Control Systems EMS=Energy Management System etc.

Similar technologies and names depending on application and history Typically DCS are single vendor solutions, with small footprint, fast rate/response, and emphasis on safety; SCADA may extend geographically, have a slower poll rate, interface with physical devices for DAQ and provide operations status

Generally refer to the systems which control, monitor, and manage critical infrastructures such as: • electric power generators, • subway systems • dams • telecommunication systems, • natural gas pipelines, and many others.

Simply stated, a control system gathers information and then performs a function based on established parameters and/or information it received. (DHS “Recommended Procurement Lang.”)

Traditionally, control systems were stand-alone devices, not connected to business networks or the outside world via the Internet.

Technologies involved, though quite old, are remarkably reliable

6

CONTEXT - But why do we need this now ?

• Evolution of Automation Technology towards Collaboration environments (Digitization, Connectedness, etc.)

• Collision course of Business and Industrial networks

• Rise of the Internet of Things

• Market forces of Mobility, Remote management & Cost reduction across Critical Infrastructure domains

• Legislation, Regulatory & Standards pressures

• Increasing pattern of attacks against Critical Infrastructures

7

CONTEXT - Examples of incidents

ICS security was a minor problem until Stuxnet… • Stuxnet (2010)

a worm struck Iranian nuclear facility. Initially spread thru removable media, used four ‘zero-day vulnerabilities’. Employs Siemens’ default passwords to access Windows operating systems that run WinCC and PCS7 programs, then hunts down frequency-converter drives used to power centrifuges used in the concentration of the uranium-235 isotope. Stuxnet altered the frequency of the electrical current to the drives causing them to switch between high and low speeds for which they were not designed hence causing the centrifuges to fail at a higher than normal rate…900+ damaged…

• Night Dragon (2011) five global energy firms were targeted by a combination of attacks including social engineering, Trojans and Windows-based exploits. The corporate network segments belonging to companies that operate SCADA infrastructures were attacked and exfiltrated data such as operational blueprints

• Flame (2012) malware operating in Iran, Lebanon, Syria, Sudan, the West Bank and other places in the Middle East and North Africa for at least two years. Designed to steal data, including documents, recorded conversations and keystrokes. It also opens a backdoor to infected systems to allow the attackers to tweak the toolkit and add new functionality

Presenter

STUXNET: Attacked Windows systems using an unprecedented four zero-day attacks. It is initially spread using infected removable drives and then uses other exploits and techniques such as shared print-spooler vulnerability to spread in networks with shared printers, peer-to-peer RPC to infect and update other computers inside private networks that are not directly connected to the Internet. Stuxnet is unusually large at half a megabyte in size, and written in several different programming languages which is also irregular for malware. The malware device drivers have been digitally signed with the private keys of two certificates that were stolen from separate well-known companies. The driver signing helped it install successfully without users being notified, and therefore to remain undetected for a relatively long period of time. Both compromised certificates have been revoked by VeriSign. Once installed on a Windows system, Stuxnet infects project files belonging to Siemens' WinCC/PCS 7 SCADA control software, and subverts a key communication library of WinCC called s7otbxdx.dll. Doing so it intercepts communications between the WinCC software running under Windows and the target Siemens PLC devices that the software is able to configure and program when the two are connected via a data cable. In this way, the malware is able to install itself on PLC devices unnoticed, and subsequently to mask its presence from WinCC if the control software attempts to read an infected block of memory from the PLC system. Affects the operation of the connected motors by changing their rotational speed. It also installs a rootkit that hides the malware on the system and masks the changes in rotational speed from monitoring systems. It was the first real threat with real-world political ramifications FLAME: While Stuxnet was meant to destroy things, Flame’s purpose was merely to spy on people. Spread over USB sticks, it could infect printers shared over the same network. Once Flame had compromised a machine, it could stealthily search for keywords on top-secret PDF files, then make and transmit a summary of the document—all without being detected. Data’s sent off in smaller chunks to avoid hogging available bandwidth for too long. Impressively, Flame could exchange data with any Bluetooth-enabled device. In fact, the attackers could steal information or install other malware not only within Bluetooth’s standard 30-meter range but also farther out. A “Bluetooth rifle”—a directional antenna linked to a Bluetooth-enabled computer, plans for which are readily available online—could do the job from nearly 2 kilometers away. But the most worrisome thing about Flame was how it got onto machines in the first place: via an update to the Windows 7 operating system. A user would think she was simply downloading a legitimate patch from Microsoft, only to install Flame instead. Flame spreading through Windows updates is more significant than Flame itself, because it broke world-class encryption. http://en.wikipedia.org/wiki/Stuxnet http://spectrum.ieee.org/telecom/security/the-real-story-of-stuxnet

8

CONTEXT – Interconnected world of Critical Infrastructures

Security is about the weakest link

IT vs. SCADA

10

IT vs. SCADA - Characteristics of SCADA/ICS

Designed for functionality Standalone systems

• Tight procedures control • Strict Management of Change process • Physical security • Safety and equipment protection

Deterministic

• Defined functions and traffic • Reliability first (“Treat Reliability like Safety”) • Very conservative approach (“no release 1, nor release 2, maybe rel. 3..”) • PRODUCTION is king

Ethernet is deterministic ? Serial ?

Presenter

Ethernet is not deterministic (CSMA/CD, Full duplex): fast but unpredictable time to get a response Serial communications are deterministic (half duplex) but slow (2.4kbaud) Profinet and Ethernet/IP are considered open standards deployed over Etehrnet and deterministic (Profibus more deterministic than Ethernet/IP). There are three different protocol levels in Profinet that are differentiated by speed:�• Profinet CBA, for a plant needing reaction times in the range of 100ms, uses TCP/IP.�• Profinet CBA and IO applications needing up to 10ms cycle times use the RT (Real-Time) protocol.�• Profinet IO applications in drive systems for motion control use the IRT (Isochronous Real-Time) protocol for cycle times of less than 1 ms

11

IT vs. SCADA – IT key points

Confidentiality & Performance • Data available to those with a right to know

– Third Party Agreements – Contractual Details – Commercial Advantage (IP protection) – High throughput (some delay acceptable) Typically protected by encryption/monitoring (SSL, IPsec, sFTP, DLP tools etc.)

Integrity • “Information protected against Unauthorized alteration” (Accidental or

Deliberate)

Availability • Information is usable when needed

– systems that provide it, can resist attacks and recover from failure

Presenter

Confidentiality/NDA clause are not enough, need to add in contracts a «right to audit» clause to verify inclusion of security requirements in SDLC, as well as change control and awareness. Risks may be also legal, financial and operational. One method of achieving high availability is through the use of redundancy. Additionally, if a component fails, it should fail in a manner that does not generate unnecessary traffic on the ICS, or does not cause another problem elsewhere, such as a cascading event.

12

IT vs. SCADA – ICS key points

Availability • No loss of view/control • No denial of service (DoS)

Safety • Predictable Failures to a Safe State • Independence of Control and Safety Systems

Integrity/Authentication • No unauthorized access • No data/configuration change

IT cyber attacks tend to focus on stealing Intellectual Property / Sensitive information, thus Confidentiality is high

ICS cyber attacks tend to focus on destabilization of assets/disruption of activities, thus Integrity and Availability are high

Presenter

The requirements on efficiency and safety are for example in conflict with rigid password protection, and cryptographic techniques might degrade the performance to an unacceptable level Access links not protected with authentication and/or encryption have the increased risk of adversaries using these unsecured connections to access remotely controlled systems. This could lead to an adversary compromising the integrity of the data in transit as well as the availability of the system, both of which can result in an impact to public and plant safety. Before deploying encryption, first determine if encryption is an appropriate solution for the specific ICS application. The IT world typically sees performance, confidentiality, and data integrity as paramount, while the ICS world sees human and plant safety as its primary responsibility, and thus system availability and data integrity are core priorities. Other distinctions include differences in reliability requirements, incident impacts, performance expectations, operating systems, communications protocols, and system architectures. This can mean significant differences in implementation of security practices

13

IT vs. SCADA – Comparison

Topic IT world ICS («OT» world)

Security triad CIA (Confid./Integrity/Availab.) AS (Availab. & Safety)

Lifecycle 20-40 months 20+ years

Antivirus Common Uncommon\impossible

Patching Widely used, weekly or faster Yearly or never

SW config Mgmt Yes Partly

Time critical Generally delays OK/ Best effort Critical/Deterministic (10-50ms)

Availability Interruptions generally tolerated Limited consequences

24x7x365xforever Catastrophic consequences

Sec. Awareness Good Poor

Security testing Mandatory Initial stage

Physical Security Yes Yes

Protocols Standardized Proprietary

..but at the end they will be convergent

THREATS and ATTACK SURFACE

15

THREATS AND ATTACK SURFACE - Trends

*Threat Trend

Drive-by Exploits

Ã injection of malicious code in HTML code of websites that exploits vulnerabilities in user web browsers. For Android as well.

Worms/Trojans Ã From USB keys, Social networks and mobile platforms

Code Injection Ã SQL injection, cross-site scripting, cross-site request forgery (CSRF)

Exploit Kits Ã ready-to-use software packages that “automate” tasks. Malware-as-a-Service (MaaS) emerging criminal business model

DoS Â Mostly work at the application layer. HTTP, DNS and SMTP are the most frequently targeted ones. Often used as “distraction”.

Phishing Â Fraudulent e-mails and legitimate looking websites

Data Steal Ã Key to many data breaches are web application vulnerabilities

Spam Ä increased pressures on spammers in the last 2 years (e.g. Rustock botnets takedown, etc.)

Targeted Attacks

Ã The energy sector reported most of these incidents. The rise in existing vulnerabilities in SCADA systems is an indication for success perspectives of this kind of threat

Top vulnerability by type: 1. Buffer Overflow 2. Input Validation 3. Authentication & XSS

Incidents by sector - 2012

*Source ENISA Threat Landscape report 2012 In RED top emerging threats for critical infrastructures

Energy; 41,0%

Dams; 0,5%

Critical Mfg; 4,2%

Communications; 2,1%

Commercial ; 9,5%

Chemical; 3,7%

Banking; 0,5%

Water; 14,5%

Internet-facing; 10,5%

Transportation; 2,7%

Nuclear; 3,1%

IT; 0,5%

HC; 2,6% Gov't; 3,7%

Food & Ag; 1,0%

Presenter

DDoS:average size of the attacks expressed in bits-per-second (bps) was in the 3-3.5 Gbps range, 50% under 1Gbps, 40% under 5 Gbps; avg duration less than 1 hr.

16

THREATS AND ATTACK SURFACE - ICS vulnerabilities trend

ICS vulnerabilities by Quarter*

*From Critical Intelligence Inc.

Sophisticated tools/techniques shifted from IT onto ICS, resulting in: 750+ % reported vulnerability disclosed in 2011 40% include working attack code 20000+ unauthorized internet access to ICS in 2012

Researches/Hackers paid to disclosure serious vulnerability to “brokers” who then sell exploits for as much as $75 - $120K….

Presenter

Nation States attacks happening today ($$$/sophisticated) Industrial Control Systems are behind the curve Attacks already moving faster than defense Some notes why “ICS are behind the curve”: 1) IT Security generally with little knowledge of ICS, and ICS Experts generally knowledgeable in operations but not security – expertize in both is rare. 2) Patching is frequent in IT, slow or impossible in ICS. System life cycle is 3-5 years in IT, 15 to 125 years in ICS 3) Legacy ICS not designed to be secure, self-diagnosed, with network logging. Insecure Protocols Reboots/halts not protected (and infrequent) Software, Firmware, System not protected Basic access control not available (default passwords) Binary transfer issues exceed current IDS technologies

17

THREATS AND ATTACK SURFACE - Typical Findings in ICS THREATS AND ATTACK SURFACE - Typical Findings in ICS

• VOIP software • Software license cracking executable • Online Dating services • AOL/MSN/Torrent clients • MP3/iTunes etc. • Gaming software servers (Quake etc.) • Anonymous FTP servers

+ ¾ Linux \ Windows hosts unpatched for years ¾ Unsupported OS (Win95/NT) ¾ No removable media control ¾ Flat networks ¾ Unauthenticated WLAN ¾ Unprotected switches ¾ APC battery vulnerable web interface .....

ARCHITECTURE and COMPONENTS

19

ARCHITECTURE AND COMPONENTS – ICS Network

BUSIN

ESS ZO

NE

Internet DMZ

Corporate LAN

DMZ (3.5)

OPERATIO

NS ZO

NE

OPS DMZ

PROCESS CONTROL / SCADA

ZONE

- Goal: secure segregation between Business Zone (L4-5) and Process Control Zone (L2-1-0) - L3 as a staging area between L2 and L4 - Any Internet access must be handled thru L4, not directly from L3 - VLAN and Virtual machines should not cross security zones - Firewall disjoint rules (except fo AV updates, patches, Historian traffic)

Presenter

Security Principles: Goal: secure segregation between neterprise network (L4-5) and Process Control Network (L2-1-0) L3 is a staging area between L2 and L4 VLAN and Virtual machines should not cross security zones Any Internet access must be handled thru L4, not directly from L3 Firewall disjoint rules (two successive firewall hops will not allow same protocol/port to go thru), except for AV updates, security patches and real time historian data BUSINESS ZONE: Lev5: Enterprise business network: corporate level applications used to support Enterprise Business and User Goals. Items typically found in this zone include: Internet access points, Email servers, customer facing/internal web servers, enterprise document/HR/CRM systems, remote access VPN endpoints Lev4:Business Unit/Plant Network: IT shared services for a local site or business units. Typically local file/print servers, local phone systems, site specific remote access solutions/Internet access points DMZ: Lev3.5 Provide functions specific zones where services and data can be shared between zones. Typically patch mgmt servers, AV servers, site specific application servers, BI systems, backend DB for site specific applications OPERATIONS ZONE Lev3: Operations Support DMZ: includes functions involved in managing ops environment. Typically Ops scheduling resources, Reliability tracking tools, Ops simulation and modeling tools, Replicated historian, Data visualization utilities. Also dedicated ops specific IT services such as DHCP, LDAP, DNS and file servers PROCESS CONTROL/SCADA ZONE: Lev2: Supervisory Control LAN: Include functions involved with operating real-time control system. Typically control center operation/engineering workstations, HMI, security event collectors, operations alarm systems, data historians, application admin workstations Lev1: Control Devices: Include functions involved in site specific operating environements. Typically dedicated operator workstations, PLCs, Controllers, programmable relays, RTU and process specific microcontrollers Lev0: Process Control Instrumentation Bus Network: Include functions involved in transforming from physical to cyber and viceversa. Typically sensors, actuators, motors, process specific automation machinery and field instrumentation devices SAFETY ZONE: safety specific systems engineered for specific protective functions.Typically items at Lev0 and Lev1 with dedicated purpose for safety control function, such as acoustic monitoring, liquid chemistry monitoring, vibration monitoring, emission monitoring, personnel protection

20

ARCHITECTURE AND COMPONENTS – Case Study

21


Lev0

Lev1

Lev2

Lev3

Lev4

Lev5

Presenter

Remarks: (OK) Logical separation based on functionality (OK) IDS placement: such to always have the true source IP address (before FW or GW)

22


Presenter

Data flow

OVERVIEW OF APPLICABLE STANDARDS

24

OVERVIEW OF APPLICABLE STANDARDS -Energy sector

CIP Rev. Rev. 5 (2014) • Generators • Distributors • Transmission Operators

NEI 08-09 Rev. 6 • Cyber Security Plan for Nuclear Reactors • North American nuclear plants

International Instrument Users’ Assoc., WIB 2.0 • Requirements for Vendors

ISA-99 / IEC 62443-4-1, -4-2, -2-4 • Asset owners • System Integrators • Automation component suppliers

800-53

Large N. America Power Gen

Nuclear

Int’l Oil Companies & Euro Power Gen

Int’l Oil Companies & Global Power Gen

Regardless of industry vertical, geo zone and application, all refer to the same originating one

Guide for assessing the security controls in Federal Information Systems

Presenter

Increasing # of cyber reqs in procurement language.

25

OVERVIEW OF APPLICABLE STANDARDS - Terminology

Standards Recommendations - Use is voluntary Available to Public - Approved by recognised standardisation body Provides rules, guidelines or characteristics for activities or results Example: QWERTY keyboard / ISA99

Regulations Legislation - Use is mandatory Available to Public - Developed by designated authority Specify product, process or service characteristics Enforced by authority. Penalties. Example: power plugs / NERC CIP

Most important goals of industry standardization are : • Setting a minimum acceptable level of quality for a given scope of a standard • Enabling technical interoperability of products from different vendors

A standard, given widespread use, may become practically mandatory Also, while it is voluntary, organizations that do not adopt them may face negligence, shareholder or breach of contract lawsuits if they suffer a breachÆ$$$

OVERVIEW OF APPLICABLE STANDARDS – NERC CIP (cont’d)

NERC Cybersecurity CIP-002 Critical Asset Identification

CIP-003 Security Management Controls

CIP-004 Personnel & Training

CIP-005 Electronic Security perimeter(s)

CIP-006 Physical Security of CCA

CIP-007 Systems Security management

CIP-008 Incident Reporting and Response Planning

CIP-009 Recovery Plans for CCA

1. Critical Asset Identification Method 2. Critical Asset identification 3. Critical Cyber Asset Identification 4. Annual Approval

1. Cyber Security Policy

2. Leadership

3. Exceptions

4. Information Protection

5. Access Controls

6. Change Control and Configuration mgmt

1. Awareness

2. Training 3. Personnel Risk Assessment 4. Access

1. Electronic Security Perimeter

2. Electronic Access controls

3. Monitoring Electronic Access

4. Cyber Vulnerability Assessment 5. Documentation review and maintenance

1. Physical Security Plan 2. Phisical Access controls 3. Monitoring physical access 4. Logging physical access 5. Access log retention 6. Maintenance and testing

1. Test procedures

2. Ports and Services 3. Security Patch mgmt 4. Malware protection 5.Account mgmt 6. Security status monitoring 7. Disposal or redeployment 8. Cyber Vuln. Assessment 9. Doc review and mainten.

1. Cyber Security Incident response Plan

2. Cyber Security Incident Documentation

1. Recovery Plans

2. Exercises 3. Change Control 4. Backup and restore 5. Testing backup media

27

OVERVIEW OF APPLICABLE STANDARDS – ISA99/IEC62443

28

OVERVIEW OF APPLICABLE STANDARDS – Certifications

Compliance towards standards created several industry automation certification schemes, e.g.:

• Achilles (ACC, APC, Lev 1, Lev2...) • ISASecure (EDSA, SDSA...) • Exida Etc. May test products properties, process capabilities (from Design to Commissioning to Maintenance) Some focus more on Risk Assessment, some on Product/Process assessment, some on Lifecycle

Limitations: o Buyer not involved in the certification process, which may lead to

intransparency o May generate false sense of security (no source authentication for basic

levels, no control system protocol fuzzing, relaxed SDL if environment «secure», etc..)

COUNTERMEASURES

Presenter

Source: 2012 Patient Safety Summit, TX. An example was given that included 17 distinct errors, none of which on their own would have caused the mistake to occur. When the holes line up, mistakes are more likely to happen. Checklists to ensure all precautions are followed, multidisciplinary teams, and many others. By making small changes, the holes can be shrunk to prevent alignment as long as everyone takes responsibility for their part.

30 Source: Recommended Practice: Improving Industrial Control Systems Cyber

security with Defense-In-Depth Strategies, DHS, October 2009.

Defense-in-Depth Strategy supports critical controls and related networks, which in turn can be applied to support compliance towards cyber security regulations & standards

30

COUNTERMEASURES – Defense in Depth

Presenter

Controller (physical layer): APT defenses with: - controller whitelisting - 2FA - encrypted access Host layer: - Secure supply chain - OS hardening - OS patching, HIDS & AV - Secure programming Network Layer: - DMZ - updated NIDS/switches - centralized RBAC - QoS - SIEM Operational (Policy & procedure) layer: - compliance - Listing of all ports/svcs - 24/7 support - Training - Physical access controls

31

COUNTERMEASURES – To patch or not to patch

#1 - SCADA products designed for safety, reliability, efficiency and ease-of-use. Not for Security. Until Stuxnet #2 - researchers, hackers etc. shifted from the IT environment, where multiple patching is extensively used to address vulnerabilities #3 - research shows that high quality SW has 0.03 vulnerabilities (not defects, which are 100x) per KLOC. Low quality SW has 0.5 vuln./KLOC Example: WinXP has 40 MLOC and displayed 1100+ vuln Æ 0.027 ratioÆgood # 4 - ICS/SCADA firmware have 1000-5000 KLOCÆ30-50 vuln ICS sw on control network has ~60MLOCÆ1800+ vuln #5 - 15-25% of patches impact users (hangs/functionalities etc.)Æneed validation #6 – Not all vendors release patches (50% of vuln have patches available) #7 – ICS users download 10% of released patch

CONTINUOUS PATCHING is DIFFICULT

32

COUNTERMEASURES – Compensating Controls

Workaround that does not correct the underlying vulnerability but help block known attack vectors before you apply the update . Compensating controls are a means to delay patching at first scheduled maintenance shutdown). Examples: 9 Product reconfiguration (e.g. port disabling etc.)

9 Use of industrial firewalls to filter specific traffic (e.g. allow OPC, deny any any)

9 Firewall configuration to deny specific actions within defined protocols (e.g. no RW)

9 SW enforced outbound data flow

9 HW enforced unidirectional data flow (data diodes)

Must be simple (plug in and walk away) and upgradable Must not impact operations

NEED COMBINED APPROACH

Prioritized Patching List Compensating controls

Presenter

Prioritized Patching List (Risk assessment based)

33

COUNTERMEASURES – (In)Secure by Design

� Vulnerabilities are many and easy to find in ICS � Often they are not even necessary: device or protocols features (protocols

that do not provide integrity, access control, or authentication) already ARE attack vectors

� Pass the buck: � Asset owners blame vendors for lack of features or strict reqs � Vendors blame lack of demand from asset owners � There is no way to stop sophisticated attackers to get in

Presenter

The Security Development Lifecycle (SDL) is a software development process that helps developers build more secure software and address security compliance requirements while reducing development cost. Most important elements of an SDL: -Threat Modeling: applying a structured approach to threat scenarios during design helps a team more effectively and less expensively identify security vulnerabilities, determine risks from those threats, and establish appropriate mitigations -Secure Coding standards -Fuzzing: Inducing program failure by deliberately introducing malformed or random data to an application helps reveal potential security issues prior to release while requiring modest resource investment.

34

9 Do not panic, risk is there, need be managed

9 Treat Security like a Technical and Operational risk

9 Most problem sources are tied with lack of cyber conditions control

9 Defense-in-depth & Detect-in-depth approach

9 Least Privilege

9 Start simple (AV, USB, Passwd/Roles, Patch, Unused ports, DMZ, Awareness, etc.)

9 Design with security in mind (Assumption of Breach):

Consider Security requirements as Functional reqs

Consider SDL in RFP (e.g. Microsoft, ISA Secure etc.) and in FAT

9 Security testing (Scans, Input verification, Fuzzing etc.)

9 Process whitelisting

9 Encrypt external communication ALWAYS

9 Incident Response team

COUNTERMEASURES – Ok, what can I do ?

HORIZON

A print-out of this Procedure is a non-controlled copy

36

HORIZON

¾ Cloud security enters teenage years Data will be safer but failures will have higher impacts Searching thru encrypted data problem remain Not only data, exploit clouds for quick-to-create botnets

¾ Cross platform malware, Leveraging smartphone novel features/sensors

¾ Healthcare security As data go online, risks are greater Securing doctors offices is problematic

¾ Leverage Social Networks Facebook is not your friend. LinkedIn and Twitter neither

¾ Internet of Things 50-500 billion «things» connected to Internet No traditional input/feedback channel (keyboard/screen) Internet of Malware (botnets)

Presenter

At the bottom line it is practically impossible to control what usage will be done of the data you have made available

37

Bibliography & Resources

¾ Resources ¾ SANS ICS homepage:www.sans.org ¾ DHS ICS-CERT: ics-cert.us-cert.gov ¾ NERC CIP standards: www.nerc.com/pa/Stand/pages/ReliabilityStandards.aspx ¾ ISA99: isa99.isa.org/ISA99%20Wiki/Home.aspx ¾ NIST SP 800-82: csrc.nist.gov/publications/800-82/SP800-82-final.pdf ¾ Microsoft SDL: http://www.microsoft.com/security/sdl/default.aspx

¾ Bibliography Miller B., Dale, C. -2012 - A Survey of SCADA and Critical Infrastructure Incidents BSI-CS 035, 2012 – Recommendation for Industrial System Security Byres, E. -2013 – Solving the SCADA/ICS Security Patch problem GeorgiaTech – Emerging cyber threats report 2013 NSS Labs – Vulnerability Threat report 2013

QUESTIONS ?

A print-out of this Procedure is a non-controlled copy

Documents

Introduction to Industrial Control Systems Cybersecurity