Test di sicurezza in ambienti Smart Grid e SCADA
|
|
- Gilbert Garrison
- 8 years ago
- Views:
Transcription
1 Test di sicurezza in ambienti Smart Grid e SCADA Simone Riccetti, IBM Italy simone.riccetti@it.ibm.com
2 Agenda SCADA/Smart Grid overview SCADA/Smart Grid security issues Security test challenges Testing approaches 2
3 Evolution of the Electricity Sector The energy industry uses Supervisory Control and Data Acquisition (SCADA) networks. SCADA systems are complex event driven systems with centralized monitoring of thousands of remotely managed points of process control equipment. This information infrastructure forms a grid of its own- a control grid. Control Grids are rapidly adopting IP addressable solutions to promote corporate connectivity for remote access of equipment Smart Grid implies overhauling both the Power system infrastructure and the Information Control Grid 3
4 EPCIP: EU Program for Protecting Critical Infrastructures Strategy The EU Context Summarized 4 The general objective of EPCIP (European Programme for Critical Infrastructure Protection) is to improve the protection of critical infrastructure in the European Union (EU). The legislative framework for the EPCIP consists of the following: a procedure for identifying and designating European critical infrastructure and a common approach to assessing the need to improve the protection of such infrastructure. This will be implemented by means of a directive; measures designed to facilitate the implementation of EPCIP, including an EPCIP action plan, the Critical Infrastructure Warning Information Network (CIWIN), CIP information sharing processes, and the identification and analysis of interdependencies; support for EU countries regarding National Critical Infrastructures (NCIs) that may optionally be used by a particular EU country, and contingency planning EU Funding available
5 Smart Grid Macro Components Cyber security of the Smart Grids European Commission (work package 1.1) 5
6 Substation Technologies Evolution
7 A TCP/IP Enabled World Process Control Systems (PCS) migrating to TCP/IP networks SCADA and DCS typically rely upon wrapped protocols Analog control and reporting protocols embedded in digital protocols Encryption and command integrity limitations Poor selection of TCP/IP protocols Problems with patching embedded operating systems Controllers typically running outdated OS s Security patches and updates not applied Difficulty patching the controllers 7
8 Proliferation of Networked Devices Switch from analog to digital controls Incorporation of network standards TCP/IP communications Wireless communications Wireless integration Replacement SKU parts include new features free Additional features may be on by default May be turned on by engineers From analog to digital (+ networked)
9 Bridging Networks Softest targets appear to be the control centers Greatest use of PC systems Frequent external connectivity Entry-point to critical plant systems Bridging control centers and the plant operational framework Network connectivity for ease of operational control Vulnerable to malware - proxy remote attacks
10 ICS-ALERT Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) ha emesso un alert riguardo al motore di ricerca SHODAN, che può essere utilizzato per identificare I sistemi SCADA che sono connessi a Internet. Questo può essere sfruttato da parte di attacker per compromettere questi sistemi. ICS- ALERT descrive una serie di raccomandazioni per ridurre questo rischio.
11 Motivated activists..not only Anonymous 11
12 Vulnerabilities disclosed in ICS/SCADA systems in 2012 affected over 2,600 products from 1,330 vendors Infosecurity Europe, 5/2/2013 Vulnerabilities in IT systems that underpin critical infrastructure like the energy grid, water supply facilities, oil and gas systems and transportation have skyrocketed 600% since 2010, NSS Labs reported a concerning state of affairs that may add yet more wind to the public rhetoric surrounding the potential for a major cyber-terrorist attack. The nation s infrastructure, largely administered by IT systems knows as SCADA, is firmly in the crosshairs of our enemies, public officials have increasingly warned. Last autumn, US Defense Secretary Leon Panetta talked about an impending Cyber Pearl Harbor, while newly confirmed US Secretary of State John Kerry commented last month that cyber-attacks are the equivalent of modern-day nuclear weapons. Meanwhile, Janet Napolitano, Secretary of the Department of Homeland Security, warned that a cyber- 9/11 is a very real possibility. 12
13 Impact of a breach to power control systems could be severe Serious disruption to national critical infrastructure Loss of system availability Process interruption Equipment damage Asset mis-configuration Loss of data and confidentiality Personal injury Penalties resulting from regulatory violations Loss of customer and public trust 13
14 Where are the specific areas concerns? Investors: downtime, fines, cost, investment and related impact on revenue Operators: optimization of asset management and, specifically: Emerging Smart Grid Issues Millions of new end points Massive amounts of data System security Vulnerable software Lack of access control Mis-configuration of options Data Vulnerability Weak/No encryption Inappropriate storage Installation of malcode Cyber security of the Smart Grids European Commission (work package 1.1) Potential Fraud Invalid credentials Weak authorization Insufficient tamper protection Smart Meters fraud Downtime Denial of service risk System corruption 14
15 Smart Grid typical critical areas C u s to m e r P re m is e M e te rs /H A N M e te r C o m m u n ic a tio n N e tw o rk S C E C e n tra l D a ta C e n te rs ` M e te r D a ta U s a g e W e b S e rv e r C u s to m e r N e ig h b o rh o o d A g g re g a to r P U B L IC W IR E L E S S N E T W O R K E A L o a d C o n tro l D C A M D M S I B illin g & C u s to m e r C a re O u ta g e M a n g e m e n t 15
16 SCADA: technolgies and protocols Field Devices RTU Remote Terminal Unit PLC Programmable Logic Controller IED Integrated Electronic Device PAC Programmable Automation Controller Protocols Modbus DNP3 DeviceNet IEC proprietary protocols Communication Technologies Serial connections (hardwire & dial-up) Ethernet & TCP/IP / Wireless RF & Microwave Cell: CDMA ZigBee HAN Middleware MS IIS,.Net SCADA Control Center HMI Human Machine Interface SCADA Controller Real time processing Historian database of events Control Center Protocols (es. OPC, ICCP, IEC 101/103 etc..) 16
17 Security for Industrial Control Systems (SCADA) ICS Security based on IEC Air-gap networks, apps and control data with firewalls, proxies 17
18 SCADA Security Comparisons A comparison of Security used in U.S. companies vs. Security used in process systems: Topic Corporate IT Process Systems Anti Virus Widely used Used with care Lifetime 3-5 years 5-20 years Outsourcing Widely used Rarely used for operations Patching Frequent Slow (requires vendor approval or extensive testing) Change Frequent Rare Security Skills & Awareness Medium to High Poor IT security, no awareness training Security Testing Widely used Must be used with care Physical Security Usually secure & manned Good controls but often remote & unmanned 18 18
19 Security tests challenges - Systems fragility - Non standard/unknown protocols - Non IP based protocols - Embedded devices - Unusual «IT» wireless spectrum - SCADA Applications knowledge - Critical Infrastructure threats - Specialized tools (even opensource but often need to be customized) - Specialized skills 19
20 This is a possible approach Requirements analysis Threat modeling Scope definition Attack surface Fragility/criticality analysis Test selection Attack scenarious 20
21 Target definition The goal of this activity is to identify which are the critical systems that, if compromised, can lead to major power outage: As an example: SCADA core systems DMS/OMS/EMS systems Real-time systems Batch systems Process critical applications Non critical process application (but critical for security!) Phone lines, LAN/WAN/HAN Networks Sensors, embedded systems And many others
22 Threat modeling The goal of threat modeling is to identify potential risks or attacks against your software and to make decisions about how to address these risks. I. Identify the attack surface II. Identify the potential threats III. Assign an impact for each threat IV. Determine the probability of compromise It is paramount to have a deep knowledge of the attack vectors and.. think as an attacker
23 Typical assessment findings
24 Common Security Assessment Findings Weak protocols leave systems vulnerable PCS networks lack overall segmentation PCS networks lack antivirus protection Standard operating systems leave the device open to well known security vulnerabilities Most IP-based communications within the PCS network are not encrypted Most PCS systems have limited-to-no logging enabled Patches are not, or cannot be installed on SCADA systems No host based security controls are configured on these devices Many organizations still rely heavily on physical security measures
SCADA / Smart Grid Security Who is really in control of our Control Systems?
SCADA / Smart Grid Security Who is really in control of our Control Systems? Simone Riccetti Certified SCADA Security Architect Agenda Overview of Security landscape SCADA security problem How to protect
More informationOPC & Security Agenda
OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information
More informationA Strategic Approach to Protecting SCADA and Process Control Systems
IBM Internet Security Systems White Paper A Strategic Approach to Protecting SCADA and Process Control Systems A Strategic Approach to Protecting SCADA and Process Control Systems 1 Table of Contents ABSTRACT..................................................................2
More informationIT Security and OT Security. Understanding the Challenges
IT Security and OT Security Understanding the Challenges Security Maturity Evolution in Industrial Control 1950s 5/4/2012 # 2 Technology Sophistication Security Maturity Evolution in Industrial Control
More informationAn Introduction to SCADA-ICS System Security. Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015
An Introduction to SCADA-ICS System Security Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015 Overview Supervisory Control And Data Acquisition (SCADA) for Industrial Control Systems
More informationHolistic View of Industrial Control Cyber Security
Holistic View of Industrial Control Cyber Security A Deep Dive into Fundamentals of Industrial Control Cyber Security Learning Goals o Understanding security implications involving industrial control systems
More informationISACA rudens konference
ISACA rudens konference 8 Novembris 2012 Procesa kontroles sistēmu drošība Andris Lauciņš Ievads Kāpēc tēma par procesa kontroles sistēmām? Statistics on incidents Reality of the environment of industrial
More informationSecurity Solutions to Meet NERC-CIP Requirements. Kevin Staggs, Honeywell Process Solutions
Kevin Staggs, Honeywell Process Solutions Table of Contents Introduction...3 Nerc Standards and Implications...3 How to Meet the New Requirements...4 Protecting Your System...4 Cyber Security...5 A Sample
More informationSecurity Testing in Critical Systems
Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base
More informationNew Era in Cyber Security. Technology Development
New Era in Cyber New Era in Cyber Security Security Technology Technology Development Development Combining the Power of the Oil and Gas Industry, DHS, and the Vendor Community to Combat Cyber Security
More informationSecurity in SCADA solutions
Security in SCADA solutions Green Hills Software Peter Hoogenboom Engineering Manager - EMEA 2011 Green Hills Software D&E Event, 22 Sep 2011, Evoluon Eindhoven (NL) Slide 1 Security in SCADA solutions
More informationAre you prepared to be next? Invensys Cyber Security
Defense In Depth Are you prepared to be next? Invensys Cyber Security Sven Grone Critical Controls Solutions Consultant Presenting on behalf of Glen Bounds Global Modernization Consultant Agenda Cyber
More informationUtility Telecom Forum. Robert Sill, CEO & President Aegis Technologies February 4, 2008
Utility Telecom Forum Robert Sill, CEO & President Aegis Technologies February 4, 2008 1 Agenda Asked to describe his job, Mike Selves, director of Emergency Management and Homeland Security in Johnson
More informationSCADA. The Heart of an Energy Management System. Presented by: Doug Van Slyke SCADA Specialist
SCADA The Heart of an Energy Management System Presented by: Doug Van Slyke SCADA Specialist What is SCADA/EMS? SCADA: Supervisory Control and Data Acquisition Retrieves data and alarms from remote sites
More informationAUDITOR GENERAL S REPORT. Protection of Critical Infrastructure Control Systems. Report 5 August 2005
AUDITOR GENERAL S REPORT Protection of Critical Infrastructure Control Systems Report 5 August 2005 Serving the Public Interest Serving the Public Interest THE SPEAKER LEGISLATIVE ASSEMBLY THE PRESIDENT
More informationKeeping the Lights On
Keeping the Lights On Fundamentals of Industrial Control Risks, Vulnerabilities, Mitigating Controls, and Regulatory Compliance Learning Goals o Understanding definition of industrial controls o Understanding
More informationThe President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
cover_comp_01 9/9/02 5:01 PM Page 1 For further information, please contact: The President s Critical Infrastructure Protection Board Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
More informationIntrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks
Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Dale Peterson Director, Network Security Practice Digital Bond, Inc. 1580 Sawgrass Corporate Parkway, Suite 130 Sunrise, FL 33323
More informationUsing ISA/IEC 62443 Standards to Improve Control System Security
Tofino Security White Paper Version 1.2 Published May 2014 Using ISA/IEC 62443 Standards to Improve Control System Security Contents 1. Executive Summary... 1 2. What s New in this Version... 1 3. Why
More informationBest Practices in ICS Security for System Operators. A Wurldtech White Paper
Best Practices in ICS Security for System Operators A Wurldtech White Paper No part of this document may be distributed, reproduced or posted without the express written permission of Wurldtech Security
More informationInnovative Defense Strategies for Securing SCADA & Control Systems
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet
More informationSCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005
SCADA System Security ECE 478 Network Security Oregon State University March 7, 2005 David Goeke Hai Nguyen Abstract Modern public infrastructure systems
More informationIntegrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems. Enzo M. Tieghi etieghi@visionautomation.
Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems Enzo M. Tieghi etieghi@visionautomation.it Security IT & Control System Security: where are we?
More informationVerve Security Center
Verve Security Center Product Features Supports multiple control systems. Most competing products only support a single vendor, forcing the end user to purchase multiple security systems Single solution
More informationSession 14: Functional Security in a Process Environment
Abstract Session 14: Functional Security in a Process Environment Kurt Forster Industrial IT Solutions Specialist, Autopro Automation Consultants In an ideal industrial production security scenario, the
More informationi-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors
March 25-27, 2014 Steven A. Kunsman i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors ABB Inc. March 26, 2015 Slide 1 Cyber Security for Substation
More informationIndustrial Control Systems Vulnerabilities and Security Issues and Future Enhancements
, pp.144-148 http://dx.doi.org/10.14257/astl.2015.95.27 Industrial Control Systems Vulnerabilities and Security Issues and Future Enhancements Hongseok Chae 1, AAmir Shahzad 1, Muhammad Irfan 2, HyangRan
More informationSCADA Security: Challenges and Solutions
SCADA Security: Challenges and Solutions June 2011 / White paper by Metin Ozturk, Philip Aubin Make the most of your energy Summary Executive Summary... p 2 Protecting Critical Infrastructure Includes
More informationThe Advantages of an Integrated Factory Acceptance Test in an ICS Environment
The Advantages of an Integrated Factory Acceptance Test in an ICS Environment By Jerome Farquharson, Critical Infrastructure and Compliance Practice Manager, and Alexandra Wiesehan, Cyber Security Analyst,
More informationWhite Paper. April 2006. Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks
White Paper April 2006 Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks According to a recent Harris Interactive survey, the country s leading business executives consider
More informationPLCs and SCADA Systems
Hands-On Programmable Logic Controllers and Supervisory Control / Data Acquisition Course Description This extensive course covers the essentials of SCADA and PLC systems, which are often used in close
More informationDr. György Kálmán gyorgy@mnemonic.no
COMMUNICATION AND SECURITY IN CURRENT INDUSTRIAL AUTOMATION Dr. György Kálmán gyorgy@mnemonic.no Agenda Connected systems historical overview Current trends, concepts, pre and post Stuxnet Risks and threats
More informationNEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER
NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER Understanding what a PAC is starts from the understanding of PLC. A PLC is a Programmable Logic while
More informationSCADA Protocols and Security
WHITE PAPER ON SCADA Protocols and Security Prepared by Mohammed Samiuddin www.itmr.ac.in Contents INTRODUCTION... 2 SCADA PROTOCOL AND SECURITY... 3 SCADA PROTOCAL... 3 DISTRIBUTED NETWORK PROTOCAL (DNP)...
More informationICS, SCADA, and Non-Traditional Incident Response. Kyle Wilhoit Threat Researcher, Trend Micro
ICS, SCADA, and Non-Traditional Incident Response Kyle Wilhoit Threat Researcher, Trend Micro 1 $whoami Threat Researcher, FTR, Trend Micro Threat Researcher at Trend Micro- research and blogger on criminal
More informationMissing the Obvious: Network Security Monitoring for ICS
Missing the Obvious: Network Security Monitoring for ICS If ICS are so vulnerable, why haven t we seen more attacks? We aren t looking! Two Key Reasons Intent Visibility Intent Why are targeted attacks
More informationWaterfall for NERC-CIP Compliance
Waterfall for NERC-CIP Compliance Using Waterfall s Unidirectional Security Solution to Achieve True Security & NERC-CIP Compliance Date: Jul. 2009 The material in this document is proprietary to Waterfall
More informationUnderstanding SCADA System Security Vulnerabilities
Understanding SCADA System Security Vulnerabilities Talking Points Executive Summary Common Misconceptions about SCADA System Security Common Vulnerabilities Affecting SCADA Networks Tactics to Strengthen
More informationCloak and Secure Your Critical Infrastructure, ICS and SCADA Systems
Cloak and Secure Your Critical Infrastructure, ICS and SCADA Systems Building Security into Your Industrial Internet Phillip Allison Tempered Networks Discussion topics Threats to network security TCP/IP
More informationFrom SCADA and ICS to the Internet of Things. Andy Swift Infrastructure Team Lead CNS Group
From SCADA and ICS to the Internet of Things. Andy Swift Infrastructure Team Lead CNS Group Industrial Systems They underpin many of the manufacturing process that make modern day life possible; water
More informationService-Aware Security for Distributed Automation. Ilan Barda GRIPS SciREX Symposium February 2 nd 2015
Service-Aware Security for Distributed Automation Ilan Barda GRIPS SciREX Symposium February 2 nd 2015 The market Securing the Industrial IoT Source: MarketsandMarkets, December 2014-2- Radiflow Mission
More informationCyber Security Implications of SIS Integration with Control Networks
Cyber Security Implications of SIS Integration with Control Networks The LOGIIC SIS Project Standards Certification Education & Training Publishing Conferences & Exhibits Presenter Zach Tudor is a Program
More informationRobert Malmgren. Smart Grid. Security Challenges - Legacy and Infrastructure Burdens
Robert Malmgren Smart Grid Security Challenges - Legacy and Infrastructure Burdens Short bio Robert Malmgren Independent consultant that have worked with utility companies regarding IT- and info sec since
More informationThis is a preview - click here to buy the full publication
TECHNICAL REPORT IEC/TR 62443-3-1 Edition 1.0 2009-07 colour inside Industrial communication networks Network and system security Part 3 1: Security technologies for industrial automation and control systems
More informationClaes Rytoft, ABB, 2009-10-27 Security in Power Systems. ABB Group October 29, 2009 Slide 1
Claes Rytoft, ABB, 2009-10-27 Security in Power Systems October 29, 2009 Slide 1 A global leader in power and automation technologies Leading market positions in main businesses 120,000 employees in about
More informationSCADA Systems Automate Electrical Distribution
SCADA Systems Automate Electrical Distribution PC-based supervisory control and data acquisition systems increase uptime, cut costs and improve utilization. A White Paper from InduSoft Fabio Terezinho
More informationFeature. SCADA Cybersecurity Framework
Feature Samir Malaviya, CISA, CGEIT, CSSA, works with the Global Consulting Practice-GRC practice of Tata Consultancy Services and has more than 17 years of experience in telecommunications, IT, and operation
More informationICS CYBER SECURITY RKNEAL, INC. Protecting Industrial Control Systems: An Integrated Approach. Critical Infrastructure Protection
Critical Infrastructure Protection Technical White Paper ICS CYBER SECURITY Protecting Industrial Control Systems: An Integrated Approach The purpose of this white paper is to present a novel cyber security
More informationSecuring Distribution Automation
Securing Distribution Automation Jacques Benoit, Cooper Power Systems Serge Gagnon, Hydro-Québec Luc Tétreault, Hydro-Québec Western Power Delivery Automation Conference Spokane, Washington April 2010
More informationFrost & Sullivan s. Aerospace, Defence & Security Practice. Global Industrial Cyber Security Trends
Frost & Sullivan s Aerospace, Defence & Security Practice Global Industrial Cyber Security Trends Presented by Philipp Reuter Director Frost & Sullivan, Turkey 1 Worth over $ 50 Billion globally in 2014
More informationGoals. Understanding security testing
Getting The Most Value From Your Next Network Penetration Test Jerald Dawkins, Ph.D. True Digital Security p. o. b o x 3 5 6 2 3 t u l s a, O K 7 4 1 5 3 p. 8 6 6. 4 3 0. 2 5 9 5 f. 8 7 7. 7 2 0. 4 0 3
More informationSECURING THE MOVE TO IP-BASED SCADA/PLC NETWORKS
SECURING THE MOVE TO IP-BASED SCADA/PLC NETWORKS November 2011 Purpose The purpose of this guide is to provide examples/types of SCADA and control systems and their typical use in industry. This document
More informationSubstation Automation Systems. Nicholas Honeth (nicholash@ics.kth.se)
Substation Automation Systems Nicholas Honeth (nicholash@ics.kth.se) Contents of the series Lecture 5 - Introduction to SAS - Nice creative exercise Lecture 6 - A bit about information modelling - Data
More informationTHE FUTURE OF SMART GRID COMMUNICATIONS
THE FUTURE OF SMART GRID COMMUNICATIONS KENNETH C. BUDKA CTO STRATEGIC INDUSTRIES MAY 2014 THE GRID OF THE FUTURE WIDE-SCALE DEPLOYMENT OF RENEWABLES INCREASED ENERGY EFFICIENCY PEAK POWER REDUCTION, DEMAND
More informationGE Measurement & Control. Top 10 Cyber Vulnerabilities for Control Systems
GE Measurement & Control Top 10 Cyber Vulnerabilities for Control Systems GE Proprietary Information: This document contains proprietary information of the General Electric Company and may not be used
More informationIndustrial Security Solutions
Industrial Security Solutions Building More Secure Environments From Enterprise to End Devices You have assets to protect. Control systems, networks and software can all help defend against security threats
More informationHoneywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014
Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Process Solutions (HPS) June 4, Industrial Cyber Security Industrial Cyber Security is the leading provider of cyber security
More informationSecurity for. Industrial. Automation. Considering the PROFINET Security Guideline
Security for Industrial Considering the PROFINET Security Guideline Automation Industrial IT Security 2 Plant Security Physical Security Physical access to facilities and equipment Policies & Procedures
More informationRoger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative
Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative November 2014 Disclaimer Current SCADA Vulnerability Factors Industrial Control Systems 101 Proposed Countermeasures
More informationNetwork Cyber Security. Presented by: Motty Anavi RFL Electronics
Network Cyber Security Presented by: Motty Anavi RFL Electronics Agenda Cyber Security Threats Defense Strategy & Consequences Next Generation Networking ICS Vulnerabilities Liabilities Next Gen Networking
More informationCyber Security Compliance (NERC CIP V5)
Cyber Security Compliance (NERC CIP V5) Ray Wright NovaTech, LLC Abstract: In December 2013, the Federal Energy Regulatory Commission (FERC) issued Order No. 791 which approved the Version 5 CIP Reliability
More informationSmart Substation Security
Smart Substation Security SmartSec Europe 2014 Amsterdam 29/01/2014 Agenda Context Elia Introduction to the substation environment in Elia Security design and measures in the substation Near and far future
More informationSecure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment
Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment Introduction 1 Distributed SCADA security 2 Radiflow Defense-in-Depth tool-set 4 Network Access
More informationProcess Control and Automation using Modbus Protocol
Process Control and Automation using Modbus Protocol Modbus is the fundamental network protocol used in most industrial applications today. It is universal, open and an easy to use protocol. Modbus has
More informationEffective Defense in Depth Strategies
Honeywell.com 2014 Honeywell Users Group Asia Pacific Effective Defense in Depth Strategies for Industrial Systems 1 Document control number Honeywell Proprietary Honeywell.com Chee Ban, Ngai About the
More informationCybersecurity considerations for electrical distribution systems
White Paper WP152002EN Supersedes January 2014 electrical distribution systems Authors Max Wandera, Brent Jonasson, Jacques Benoit, James Formea, Tim Thompson, Zwicks Tang, Dennis Grinberg, Andrew Sowada,
More informationExternal Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
More informationTNC is an open architecture for network access control. If you re not sure what NAC is, we ll cover that in a second. For now, the main point here is
1 2 This slide shows the areas where TCG is developing standards. Each image corresponds to a TCG work group. In order to understand Trusted Network Connect, it s best to look at it in context with the
More informationCyber Security nei prodotti di automazione
Cyber Security nei prodotti di automazione Marco Biancardi, ABB SpA, Power System Division 11 dicembre 2013, Roma Why is it an issue? Isolated devices Point to point interfaces Proprietary networks Standard
More informationNAVFAC EXWC Platform Information Technology (PIT) Cyber Security Initiatives
NAVFAC EXWC Platform Information Technology (PIT) Cyber Security Initiatives Center of excellence for secure integration, deployment and sustainment of Industrial Control Systems and Operational Technology
More informationSecuring Industrial Control Systems in the Chemical Sector. Roadmap Awareness Initiative Making the Business Case
Securing Industrial Control Systems in the Chemical Sector Roadmap Awareness Initiative Making the Business Case Developed by the Chemical Sector Coordinating Council in partnership with The U.S. Department
More informationHow to Choose the Right Industrial Firewall: The Top 7 Considerations. Li Peng Product Manager
How to Choose the Right Industrial Firewall: The Top 7 Considerations Li Peng Product Manager The right industrial firewall can strengthen the safety and reliability of control systems Central to industrial
More informationWhat Risk Managers need to know about ICS Cyber Security
What Risk Managers need to know about ICS Cyber Security EIM Risk Managers Conference February 18, 2014 Joe Weiss PE, CISM, CRISC, ISA Fellow (408) 253-7934 joe.weiss@realtimeacs.com ICSs What are they
More informationDesigning a security policy to protect your automation solution
Designing a security policy to protect your automation solution September 2009 / White paper by Dan DesRuisseaux 1 Contents Executive Summary... p 3 Introduction... p 4 Security Guidelines... p 7 Conclusion...
More informationIndustrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
More informationResilient and Secure Solutions for the Water/Wastewater Industry
Insert Photo Here Resilient and Secure Solutions for the Water/Wastewater Industry Ron Allen DA/Central and Steve Liebrecht Rockwell Automation Detroit W/WW Team Leader Your slides here Copyright 2011
More informationPrivacy and Security in Healthcare
5 th 5 th th National HIPAA Summit National Strategy to Secure Cyberspace Privacy and Security in Healthcare October 31, 2002 Andy Purdy Senior Advisor, IT Security and Privacy The President s Critical
More informationUpdate On Smart Grid Cyber Security
Update On Smart Grid Cyber Security Kshamit Dixit Manager IT Security, Toronto Hydro, Ontario, Canada 1 Agenda Cyber Security Overview Security Framework Securing Smart Grid 2 Smart Grid Attack Threats
More informationSCADA Systems. Make the most of your energy. March 2012 / White paper. by Schneider Electric Telemetry & Remote SCADA Solutions
SCADA Systems March 2012 / White paper by Schneider Electric Telemetry & Remote SCADA Solutions Make the most of your energy Summary Executive Summary... p 2 Introduction... p 3 Field Instrumentation...
More informationSecuring Modern Substations With an Open Standard Network Security Solution. Kevin Leech Schweitzer Engineering Laboratories, Inc.
Securing Modern Substations With an Open Standard Network Security Solution Kevin Leech Schweitzer Engineering Laboratories, Inc. Copyright SEL 2009 What Makes a Cyberattack Unique? While the resources
More informationCyber Security. Smart Grid
Cyber Security for the Smart Grid Peter David Vickery Executive Vice President N-Dimension Solutions Inc. APPA National Conference June 21, 2010 Cyber Security Solutions For Cyber Security
More informationGE Measurement & Control. Cyber Security for NERC CIP Compliance
GE Measurement & Control Cyber Security for NERC CIP Compliance GE Proprietary Information: This document contains proprietary information of the General Electric Company and may not be used for purposes
More informationCyber Security :: Insights & Recommendations for Secure Operations. N-Dimension Solutions, Inc.
Cyber Security :: Insights & Recommendations for Secure Operations N-Dimension Solutions, Inc. Cyber Security Protection for Critical Infrastructure Assets Agenda: Cyber Landscape Cyber Threats to Your
More informationIndustrial Security in the Connected Enterprise
Industrial Security in the Connected Enterprise Presented by Rockwell Automation 2008 Cisco Systems, Inc. and Rockwell Automation, Inc. All rights reserved. THE CONNECTED ENTERPRISE Optimized for Rapid
More informationUNIDIRECTIONAL SECURITY GATEWAYS. Utilizing Unidirectional Security Gateways to Achieve Cyber Security for Industrial Environments
UNIDIRECTIONAL SECURITY GATEWAYS Utilizing Unidirectional Security Gateways to Achieve Cyber Security for Industrial Environments 2010 Introducing: Waterfall Security Solutions Ltd Located in Rosh-Ha ayin,
More informationElectricity for Free? The Dirty Underbelly of SCADA and Smart Meters
sorry Electricity for Free? The Dirty Underbelly of SCADA and Smart Meters Jonathan Pollet, CISSP, CAP, PCIP July 2010 Table of Contents Introduction...3 Power Generation, Transmission, and Distribution...4
More informationSemaphore T BOX Applications in Data Center Facilities
Semaphore T BOX Applications in Data Center Facilities Introduction Data centers must reliably provide 24/7/365 operation. For automation and monitoring of the facility, use of a rugged, reliable RTU is
More informationA Concise Model to Evaluate Security of SCADA Systems based on Security Standards
A Concise Model to Evaluate Security of SCADA Systems based on Security Standards Nasser Aghajanzadeh School of Electrical and Computer Engineering, Shiraz University, Shiraz, Iran Alireza Keshavarz-Haddad
More informationIndustrial Cyber Security 101. Mike Spear
Industrial Cyber Security 101 Mike Spear Introduction Mike Spear Duluth, GA USA Global Operations Manager, Industrial Cyber Security Mike.spear@honeywell.com Responsible for the Global Delivery of Honeywell
More informationEfficient remote access to machines and plants with SIMATIC
Efficient remote access to machines and plants with SIMATIC Telecontrol and teleservice solutions modular, flexible and secure SIMATIC NET siemens.com/industrial-remote-access Industrial remote access
More informationSCADA Security Training
SCADA Security Training 1-Day Course Outline Wellington, NZ 6 th November 2015 > Version 3.1 web: www.axenic.co.nz phone: +64 21 689998 page 1 of 6 Introduction Corporate Background Axenic Ltd Since 2009,
More informationCyber Risk Mitigation via Security Monitoring. Enhanced by Managed Services
Cyber Risk Mitigation via Security Monitoring Enhanced by Managed Services Focus: Up to But Not Including Corporate and 3 rd Party Networks Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance
More information1. Cyber Security. White Paper Data Communication in Substation Automation System (SAS) Cyber security in substation communication network
WP 1004HE Part 5 1. Cyber Security White Paper Data Communication in Substation Automation System (SAS) Cyber security in substation communication network Table of Contents 1. Cyber Security... 1 1.1 What
More informationSCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP
SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP Today s Topics SCADA Overview SCADA System vs. IT Systems Risk Factors Threats Potential Vulnerabilities Specific Considerations
More informationARC INDUSTRY FORUM 2015
ARC INDUSTRY FORUM PRESENTATION TOPIC: MANAGING INDUSTRIAL CYBER SECURITY RISK Tyler Williams Manager, Industrial Cyber Security Shell Global Solutions tyler.williams@shell.com 1 THE TRADITIONAL APPROACH
More informationa Post-Stuxnet World The Future of Critical Infrastructure Security Eric Byres, P.Eng.
SCADA and CIP Security in a Post-Stuxnet World The Future of Critical Infrastructure Security Eric Byres, P.Eng. CTO, Byres Security Inc. What is Stuxnet? The Stuxnet Worm July, 2010: Stuxnet worm was
More informationThe SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices
The SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices Kyle Wilhoit Sr. Threat Researcher Trend Micro 1 Glossary HMI: Human Machine Interface IED: Intelligent Electronic Device SCADA:
More informationChallenges in Industrial IT-Security Dr. Rolf Reinema, Head of Technology Field IT-Security, Siemens AG Siemens AG 2015. All rights reserved
Siemens AG - Corporate Technology - IT Security Challenges in Industrial IT-Security Dr. Rolf Reinema, Head of Technology Field IT-Security, Siemens AG Siemens AG 2015. All rights reserved Not a single
More informationINFRASTRUCTURE CONTROL SYSTEMS ENCRYPTION
INFRASTRUCTURE CONTROL SYSTEMS ENCRYPTION solutions-paper INFRASTRUCTURE AND INDUSTRIAL PROCESS AND CONTROL SYSTEMS SECURITY ARE OF NATIONAL IMPORTANCE DUE TO THEIR ESSENTIAL SERVICES AND ECONOMIC IMPACT.
More informationIncreasing Situational Awareness and Multi-zone Protection of Utility Infrastructure
Increasing Situational Awareness and Multi-zone Protection of Utility Infrastructure Reference implementation demonstrates a comprehensive end-to-end security solution based on leading McAfee* and Intel
More information