Test di sicurezza in ambienti Smart Grid e SCADA

Size: px
Start display at page:

Download "Test di sicurezza in ambienti Smart Grid e SCADA"

Transcription

1 Test di sicurezza in ambienti Smart Grid e SCADA Simone Riccetti, IBM Italy

2 Agenda SCADA/Smart Grid overview SCADA/Smart Grid security issues Security test challenges Testing approaches 2

3 Evolution of the Electricity Sector The energy industry uses Supervisory Control and Data Acquisition (SCADA) networks. SCADA systems are complex event driven systems with centralized monitoring of thousands of remotely managed points of process control equipment. This information infrastructure forms a grid of its own- a control grid. Control Grids are rapidly adopting IP addressable solutions to promote corporate connectivity for remote access of equipment Smart Grid implies overhauling both the Power system infrastructure and the Information Control Grid 3

4 EPCIP: EU Program for Protecting Critical Infrastructures Strategy The EU Context Summarized 4 The general objective of EPCIP (European Programme for Critical Infrastructure Protection) is to improve the protection of critical infrastructure in the European Union (EU). The legislative framework for the EPCIP consists of the following: a procedure for identifying and designating European critical infrastructure and a common approach to assessing the need to improve the protection of such infrastructure. This will be implemented by means of a directive; measures designed to facilitate the implementation of EPCIP, including an EPCIP action plan, the Critical Infrastructure Warning Information Network (CIWIN), CIP information sharing processes, and the identification and analysis of interdependencies; support for EU countries regarding National Critical Infrastructures (NCIs) that may optionally be used by a particular EU country, and contingency planning EU Funding available

5 Smart Grid Macro Components Cyber security of the Smart Grids European Commission (work package 1.1) 5

6 Substation Technologies Evolution 6

7 A TCP/IP Enabled World Process Control Systems (PCS) migrating to TCP/IP networks SCADA and DCS typically rely upon wrapped protocols Analog control and reporting protocols embedded in digital protocols Encryption and command integrity limitations Poor selection of TCP/IP protocols Problems with patching embedded operating systems Controllers typically running outdated OS s Security patches and updates not applied Difficulty patching the controllers 7

8 Proliferation of Networked Devices Switch from analog to digital controls Incorporation of network standards TCP/IP communications Wireless communications Wireless integration Replacement SKU parts include new features free Additional features may be on by default May be turned on by engineers From analog to digital (+ networked)

9 Bridging Networks Softest targets appear to be the control centers Greatest use of PC systems Frequent external connectivity Entry-point to critical plant systems Bridging control centers and the plant operational framework Network connectivity for ease of operational control Vulnerable to malware - proxy remote attacks

10 ICS-ALERT Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) ha emesso un alert riguardo al motore di ricerca SHODAN, che può essere utilizzato per identificare I sistemi SCADA che sono connessi a Internet. Questo può essere sfruttato da parte di attacker per compromettere questi sistemi. ICS- ALERT descrive una serie di raccomandazioni per ridurre questo rischio.

11 Motivated activists..not only Anonymous 11

12 Vulnerabilities disclosed in ICS/SCADA systems in 2012 affected over 2,600 products from 1,330 vendors Infosecurity Europe, 5/2/2013 Vulnerabilities in IT systems that underpin critical infrastructure like the energy grid, water supply facilities, oil and gas systems and transportation have skyrocketed 600% since 2010, NSS Labs reported a concerning state of affairs that may add yet more wind to the public rhetoric surrounding the potential for a major cyber-terrorist attack. The nation s infrastructure, largely administered by IT systems knows as SCADA, is firmly in the crosshairs of our enemies, public officials have increasingly warned. Last autumn, US Defense Secretary Leon Panetta talked about an impending Cyber Pearl Harbor, while newly confirmed US Secretary of State John Kerry commented last month that cyber-attacks are the equivalent of modern-day nuclear weapons. Meanwhile, Janet Napolitano, Secretary of the Department of Homeland Security, warned that a cyber- 9/11 is a very real possibility. 12

13 Impact of a breach to power control systems could be severe Serious disruption to national critical infrastructure Loss of system availability Process interruption Equipment damage Asset mis-configuration Loss of data and confidentiality Personal injury Penalties resulting from regulatory violations Loss of customer and public trust 13

14 Where are the specific areas concerns? Investors: downtime, fines, cost, investment and related impact on revenue Operators: optimization of asset management and, specifically: Emerging Smart Grid Issues Millions of new end points Massive amounts of data System security Vulnerable software Lack of access control Mis-configuration of options Data Vulnerability Weak/No encryption Inappropriate storage Installation of malcode Cyber security of the Smart Grids European Commission (work package 1.1) Potential Fraud Invalid credentials Weak authorization Insufficient tamper protection Smart Meters fraud Downtime Denial of service risk System corruption 14

15 Smart Grid typical critical areas C u s to m e r P re m is e M e te rs /H A N M e te r C o m m u n ic a tio n N e tw o rk S C E C e n tra l D a ta C e n te rs ` M e te r D a ta U s a g e W e b S e rv e r C u s to m e r N e ig h b o rh o o d A g g re g a to r P U B L IC W IR E L E S S N E T W O R K E A L o a d C o n tro l D C A M D M S I B illin g & C u s to m e r C a re O u ta g e M a n g e m e n t 15

16 SCADA: technolgies and protocols Field Devices RTU Remote Terminal Unit PLC Programmable Logic Controller IED Integrated Electronic Device PAC Programmable Automation Controller Protocols Modbus DNP3 DeviceNet IEC proprietary protocols Communication Technologies Serial connections (hardwire & dial-up) Ethernet & TCP/IP / Wireless RF & Microwave Cell: CDMA ZigBee HAN Middleware MS IIS,.Net SCADA Control Center HMI Human Machine Interface SCADA Controller Real time processing Historian database of events Control Center Protocols (es. OPC, ICCP, IEC 101/103 etc..) 16

17 Security for Industrial Control Systems (SCADA) ICS Security based on IEC Air-gap networks, apps and control data with firewalls, proxies 17

18 SCADA Security Comparisons A comparison of Security used in U.S. companies vs. Security used in process systems: Topic Corporate IT Process Systems Anti Virus Widely used Used with care Lifetime 3-5 years 5-20 years Outsourcing Widely used Rarely used for operations Patching Frequent Slow (requires vendor approval or extensive testing) Change Frequent Rare Security Skills & Awareness Medium to High Poor IT security, no awareness training Security Testing Widely used Must be used with care Physical Security Usually secure & manned Good controls but often remote & unmanned 18 18

19 Security tests challenges - Systems fragility - Non standard/unknown protocols - Non IP based protocols - Embedded devices - Unusual «IT» wireless spectrum - SCADA Applications knowledge - Critical Infrastructure threats - Specialized tools (even opensource but often need to be customized) - Specialized skills 19

20 This is a possible approach Requirements analysis Threat modeling Scope definition Attack surface Fragility/criticality analysis Test selection Attack scenarious 20

21 Target definition The goal of this activity is to identify which are the critical systems that, if compromised, can lead to major power outage: As an example: SCADA core systems DMS/OMS/EMS systems Real-time systems Batch systems Process critical applications Non critical process application (but critical for security!) Phone lines, LAN/WAN/HAN Networks Sensors, embedded systems And many others

22 Threat modeling The goal of threat modeling is to identify potential risks or attacks against your software and to make decisions about how to address these risks. I. Identify the attack surface II. Identify the potential threats III. Assign an impact for each threat IV. Determine the probability of compromise It is paramount to have a deep knowledge of the attack vectors and.. think as an attacker

23 Typical assessment findings

24 Common Security Assessment Findings Weak protocols leave systems vulnerable PCS networks lack overall segmentation PCS networks lack antivirus protection Standard operating systems leave the device open to well known security vulnerabilities Most IP-based communications within the PCS network are not encrypted Most PCS systems have limited-to-no logging enabled Patches are not, or cannot be installed on SCADA systems No host based security controls are configured on these devices Many organizations still rely heavily on physical security measures

SCADA / Smart Grid Security Who is really in control of our Control Systems?

SCADA / Smart Grid Security Who is really in control of our Control Systems? SCADA / Smart Grid Security Who is really in control of our Control Systems? Simone Riccetti Certified SCADA Security Architect Agenda Overview of Security landscape SCADA security problem How to protect

More information

OPC & Security Agenda

OPC & Security Agenda OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information

More information

A Strategic Approach to Protecting SCADA and Process Control Systems

A Strategic Approach to Protecting SCADA and Process Control Systems IBM Internet Security Systems White Paper A Strategic Approach to Protecting SCADA and Process Control Systems A Strategic Approach to Protecting SCADA and Process Control Systems 1 Table of Contents ABSTRACT..................................................................2

More information

IT Security and OT Security. Understanding the Challenges

IT Security and OT Security. Understanding the Challenges IT Security and OT Security Understanding the Challenges Security Maturity Evolution in Industrial Control 1950s 5/4/2012 # 2 Technology Sophistication Security Maturity Evolution in Industrial Control

More information

An Introduction to SCADA-ICS System Security. Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015

An Introduction to SCADA-ICS System Security. Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015 An Introduction to SCADA-ICS System Security Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015 Overview Supervisory Control And Data Acquisition (SCADA) for Industrial Control Systems

More information

Holistic View of Industrial Control Cyber Security

Holistic View of Industrial Control Cyber Security Holistic View of Industrial Control Cyber Security A Deep Dive into Fundamentals of Industrial Control Cyber Security Learning Goals o Understanding security implications involving industrial control systems

More information

Security Solutions to Meet NERC-CIP Requirements. Kevin Staggs, Honeywell Process Solutions

Security Solutions to Meet NERC-CIP Requirements. Kevin Staggs, Honeywell Process Solutions Kevin Staggs, Honeywell Process Solutions Table of Contents Introduction...3 Nerc Standards and Implications...3 How to Meet the New Requirements...4 Protecting Your System...4 Cyber Security...5 A Sample

More information

Security Testing in Critical Systems

Security Testing in Critical Systems Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base

More information

Security in SCADA solutions

Security in SCADA solutions Security in SCADA solutions Green Hills Software Peter Hoogenboom Engineering Manager - EMEA 2011 Green Hills Software D&E Event, 22 Sep 2011, Evoluon Eindhoven (NL) Slide 1 Security in SCADA solutions

More information

ISACA rudens konference

ISACA rudens konference ISACA rudens konference 8 Novembris 2012 Procesa kontroles sistēmu drošība Andris Lauciņš Ievads Kāpēc tēma par procesa kontroles sistēmām? Statistics on incidents Reality of the environment of industrial

More information

New Era in Cyber Security. Technology Development

New Era in Cyber Security. Technology Development New Era in Cyber New Era in Cyber Security Security Technology Technology Development Development Combining the Power of the Oil and Gas Industry, DHS, and the Vendor Community to Combat Cyber Security

More information

SCADA. The Heart of an Energy Management System. Presented by: Doug Van Slyke SCADA Specialist

SCADA. The Heart of an Energy Management System. Presented by: Doug Van Slyke SCADA Specialist SCADA The Heart of an Energy Management System Presented by: Doug Van Slyke SCADA Specialist What is SCADA/EMS? SCADA: Supervisory Control and Data Acquisition Retrieves data and alarms from remote sites

More information

Are you prepared to be next? Invensys Cyber Security

Are you prepared to be next? Invensys Cyber Security Defense In Depth Are you prepared to be next? Invensys Cyber Security Sven Grone Critical Controls Solutions Consultant Presenting on behalf of Glen Bounds Global Modernization Consultant Agenda Cyber

More information

AUDITOR GENERAL S REPORT. Protection of Critical Infrastructure Control Systems. Report 5 August 2005

AUDITOR GENERAL S REPORT. Protection of Critical Infrastructure Control Systems. Report 5 August 2005 AUDITOR GENERAL S REPORT Protection of Critical Infrastructure Control Systems Report 5 August 2005 Serving the Public Interest Serving the Public Interest THE SPEAKER LEGISLATIVE ASSEMBLY THE PRESIDENT

More information

Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks

Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Dale Peterson Director, Network Security Practice Digital Bond, Inc. 1580 Sawgrass Corporate Parkway, Suite 130 Sunrise, FL 33323

More information

The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808

The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808 cover_comp_01 9/9/02 5:01 PM Page 1 For further information, please contact: The President s Critical Infrastructure Protection Board Office of Energy Assurance U.S. Department of Energy 202/ 287-1808

More information

SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005

SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005 SCADA System Security ECE 478 Network Security Oregon State University March 7, 2005 David Goeke Hai Nguyen Abstract Modern public infrastructure systems

More information

Utility Telecom Forum. Robert Sill, CEO & President Aegis Technologies February 4, 2008

Utility Telecom Forum. Robert Sill, CEO & President Aegis Technologies February 4, 2008 Utility Telecom Forum Robert Sill, CEO & President Aegis Technologies February 4, 2008 1 Agenda Asked to describe his job, Mike Selves, director of Emergency Management and Homeland Security in Johnson

More information

Best Practices in ICS Security for System Operators. A Wurldtech White Paper

Best Practices in ICS Security for System Operators. A Wurldtech White Paper Best Practices in ICS Security for System Operators A Wurldtech White Paper No part of this document may be distributed, reproduced or posted without the express written permission of Wurldtech Security

More information

Keeping the Lights On

Keeping the Lights On Keeping the Lights On Fundamentals of Industrial Control Risks, Vulnerabilities, Mitigating Controls, and Regulatory Compliance Learning Goals o Understanding definition of industrial controls o Understanding

More information

Using ISA/IEC 62443 Standards to Improve Control System Security

Using ISA/IEC 62443 Standards to Improve Control System Security Tofino Security White Paper Version 1.2 Published May 2014 Using ISA/IEC 62443 Standards to Improve Control System Security Contents 1. Executive Summary... 1 2. What s New in this Version... 1 3. Why

More information

Innovative Defense Strategies for Securing SCADA & Control Systems

Innovative Defense Strategies for Securing SCADA & Control Systems 1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet

More information

The Advantages of an Integrated Factory Acceptance Test in an ICS Environment

The Advantages of an Integrated Factory Acceptance Test in an ICS Environment The Advantages of an Integrated Factory Acceptance Test in an ICS Environment By Jerome Farquharson, Critical Infrastructure and Compliance Practice Manager, and Alexandra Wiesehan, Cyber Security Analyst,

More information

Industrial Control Systems Vulnerabilities and Security Issues and Future Enhancements

Industrial Control Systems Vulnerabilities and Security Issues and Future Enhancements , pp.144-148 http://dx.doi.org/10.14257/astl.2015.95.27 Industrial Control Systems Vulnerabilities and Security Issues and Future Enhancements Hongseok Chae 1, AAmir Shahzad 1, Muhammad Irfan 2, HyangRan

More information

Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems. Enzo M. Tieghi etieghi@visionautomation.

Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems. Enzo M. Tieghi etieghi@visionautomation. Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems Enzo M. Tieghi etieghi@visionautomation.it Security IT & Control System Security: where are we?

More information

SCADA Security: Challenges and Solutions

SCADA Security: Challenges and Solutions SCADA Security: Challenges and Solutions June 2011 / White paper by Metin Ozturk, Philip Aubin Make the most of your energy Summary Executive Summary... p 2 Protecting Critical Infrastructure Includes

More information

Verve Security Center

Verve Security Center Verve Security Center Product Features Supports multiple control systems. Most competing products only support a single vendor, forcing the end user to purchase multiple security systems Single solution

More information

Claes Rytoft, ABB, 2009-10-27 Security in Power Systems. ABB Group October 29, 2009 Slide 1

Claes Rytoft, ABB, 2009-10-27 Security in Power Systems. ABB Group October 29, 2009 Slide 1 Claes Rytoft, ABB, 2009-10-27 Security in Power Systems October 29, 2009 Slide 1 A global leader in power and automation technologies Leading market positions in main businesses 120,000 employees in about

More information

PLCs and SCADA Systems

PLCs and SCADA Systems Hands-On Programmable Logic Controllers and Supervisory Control / Data Acquisition Course Description This extensive course covers the essentials of SCADA and PLC systems, which are often used in close

More information

White Paper. April 2006. Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks

White Paper. April 2006. Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks White Paper April 2006 Security Considerations for Utilities Utilities Tap Into the Power of SecureWorks According to a recent Harris Interactive survey, the country s leading business executives consider

More information

Dr. György Kálmán gyorgy@mnemonic.no

Dr. György Kálmán gyorgy@mnemonic.no COMMUNICATION AND SECURITY IN CURRENT INDUSTRIAL AUTOMATION Dr. György Kálmán gyorgy@mnemonic.no Agenda Connected systems historical overview Current trends, concepts, pre and post Stuxnet Risks and threats

More information

Session 14: Functional Security in a Process Environment

Session 14: Functional Security in a Process Environment Abstract Session 14: Functional Security in a Process Environment Kurt Forster Industrial IT Solutions Specialist, Autopro Automation Consultants In an ideal industrial production security scenario, the

More information

NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER

NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER Understanding what a PAC is starts from the understanding of PLC. A PLC is a Programmable Logic while

More information

i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors

i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors March 25-27, 2014 Steven A. Kunsman i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors ABB Inc. March 26, 2015 Slide 1 Cyber Security for Substation

More information

SCADA Protocols and Security

SCADA Protocols and Security WHITE PAPER ON SCADA Protocols and Security Prepared by Mohammed Samiuddin www.itmr.ac.in Contents INTRODUCTION... 2 SCADA PROTOCOL AND SECURITY... 3 SCADA PROTOCAL... 3 DISTRIBUTED NETWORK PROTOCAL (DNP)...

More information

ICS, SCADA, and Non-Traditional Incident Response. Kyle Wilhoit Threat Researcher, Trend Micro

ICS, SCADA, and Non-Traditional Incident Response. Kyle Wilhoit Threat Researcher, Trend Micro ICS, SCADA, and Non-Traditional Incident Response Kyle Wilhoit Threat Researcher, Trend Micro 1 $whoami Threat Researcher, FTR, Trend Micro Threat Researcher at Trend Micro- research and blogger on criminal

More information

From SCADA and ICS to the Internet of Things. Andy Swift Infrastructure Team Lead CNS Group

From SCADA and ICS to the Internet of Things. Andy Swift Infrastructure Team Lead CNS Group From SCADA and ICS to the Internet of Things. Andy Swift Infrastructure Team Lead CNS Group Industrial Systems They underpin many of the manufacturing process that make modern day life possible; water

More information

Understanding SCADA System Security Vulnerabilities

Understanding SCADA System Security Vulnerabilities Understanding SCADA System Security Vulnerabilities Talking Points Executive Summary Common Misconceptions about SCADA System Security Common Vulnerabilities Affecting SCADA Networks Tactics to Strengthen

More information

Cloak and Secure Your Critical Infrastructure, ICS and SCADA Systems

Cloak and Secure Your Critical Infrastructure, ICS and SCADA Systems Cloak and Secure Your Critical Infrastructure, ICS and SCADA Systems Building Security into Your Industrial Internet Phillip Allison Tempered Networks Discussion topics Threats to network security TCP/IP

More information

Service-Aware Security for Distributed Automation. Ilan Barda GRIPS SciREX Symposium February 2 nd 2015

Service-Aware Security for Distributed Automation. Ilan Barda GRIPS SciREX Symposium February 2 nd 2015 Service-Aware Security for Distributed Automation Ilan Barda GRIPS SciREX Symposium February 2 nd 2015 The market Securing the Industrial IoT Source: MarketsandMarkets, December 2014-2- Radiflow Mission

More information

This is a preview - click here to buy the full publication

This is a preview - click here to buy the full publication TECHNICAL REPORT IEC/TR 62443-3-1 Edition 1.0 2009-07 colour inside Industrial communication networks Network and system security Part 3 1: Security technologies for industrial automation and control systems

More information

Missing the Obvious: Network Security Monitoring for ICS

Missing the Obvious: Network Security Monitoring for ICS Missing the Obvious: Network Security Monitoring for ICS If ICS are so vulnerable, why haven t we seen more attacks? We aren t looking! Two Key Reasons Intent Visibility Intent Why are targeted attacks

More information

SCADA Systems Automate Electrical Distribution

SCADA Systems Automate Electrical Distribution SCADA Systems Automate Electrical Distribution PC-based supervisory control and data acquisition systems increase uptime, cut costs and improve utilization. A White Paper from InduSoft Fabio Terezinho

More information

Waterfall for NERC-CIP Compliance

Waterfall for NERC-CIP Compliance Waterfall for NERC-CIP Compliance Using Waterfall s Unidirectional Security Solution to Achieve True Security & NERC-CIP Compliance Date: Jul. 2009 The material in this document is proprietary to Waterfall

More information

Feature. SCADA Cybersecurity Framework

Feature. SCADA Cybersecurity Framework Feature Samir Malaviya, CISA, CGEIT, CSSA, works with the Global Consulting Practice-GRC practice of Tata Consultancy Services and has more than 17 years of experience in telecommunications, IT, and operation

More information

ICS CYBER SECURITY RKNEAL, INC. Protecting Industrial Control Systems: An Integrated Approach. Critical Infrastructure Protection

ICS CYBER SECURITY RKNEAL, INC. Protecting Industrial Control Systems: An Integrated Approach. Critical Infrastructure Protection Critical Infrastructure Protection Technical White Paper ICS CYBER SECURITY Protecting Industrial Control Systems: An Integrated Approach The purpose of this white paper is to present a novel cyber security

More information

Substation Automation Systems. Nicholas Honeth (nicholash@ics.kth.se)

Substation Automation Systems. Nicholas Honeth (nicholash@ics.kth.se) Substation Automation Systems Nicholas Honeth (nicholash@ics.kth.se) Contents of the series Lecture 5 - Introduction to SAS - Nice creative exercise Lecture 6 - A bit about information modelling - Data

More information

Digital Citizen Services & Security

Digital Citizen Services & Security Digital Citizen Services & Security Tony West Unisys May 2016 2016 Unisys Corporation. All Rights Reserved. Unisys provides a range of solutions to address the drive toward Digital Citizens and Government

More information

Security for. Industrial. Automation. Considering the PROFINET Security Guideline

Security for. Industrial. Automation. Considering the PROFINET Security Guideline Security for Industrial Considering the PROFINET Security Guideline Automation Industrial IT Security 2 Plant Security Physical Security Physical access to facilities and equipment Policies & Procedures

More information

Frost & Sullivan s. Aerospace, Defence & Security Practice. Global Industrial Cyber Security Trends

Frost & Sullivan s. Aerospace, Defence & Security Practice. Global Industrial Cyber Security Trends Frost & Sullivan s Aerospace, Defence & Security Practice Global Industrial Cyber Security Trends Presented by Philipp Reuter Director Frost & Sullivan, Turkey 1 Worth over $ 50 Billion globally in 2014

More information

THE FUTURE OF SMART GRID COMMUNICATIONS

THE FUTURE OF SMART GRID COMMUNICATIONS THE FUTURE OF SMART GRID COMMUNICATIONS KENNETH C. BUDKA CTO STRATEGIC INDUSTRIES MAY 2014 THE GRID OF THE FUTURE WIDE-SCALE DEPLOYMENT OF RENEWABLES INCREASED ENERGY EFFICIENCY PEAK POWER REDUCTION, DEMAND

More information

Robert Malmgren. Smart Grid. Security Challenges - Legacy and Infrastructure Burdens

Robert Malmgren. Smart Grid. Security Challenges - Legacy and Infrastructure Burdens Robert Malmgren Smart Grid Security Challenges - Legacy and Infrastructure Burdens Short bio Robert Malmgren Independent consultant that have worked with utility companies regarding IT- and info sec since

More information

Cyber Security Implications of SIS Integration with Control Networks

Cyber Security Implications of SIS Integration with Control Networks Cyber Security Implications of SIS Integration with Control Networks The LOGIIC SIS Project Standards Certification Education & Training Publishing Conferences & Exhibits Presenter Zach Tudor is a Program

More information

Industrial Security Solutions

Industrial Security Solutions Industrial Security Solutions Building More Secure Environments From Enterprise to End Devices You have assets to protect. Control systems, networks and software can all help defend against security threats

More information

GE Measurement & Control. Top 10 Cyber Vulnerabilities for Control Systems

GE Measurement & Control. Top 10 Cyber Vulnerabilities for Control Systems GE Measurement & Control Top 10 Cyber Vulnerabilities for Control Systems GE Proprietary Information: This document contains proprietary information of the General Electric Company and may not be used

More information

Effective Defense in Depth Strategies

Effective Defense in Depth Strategies Honeywell.com 2014 Honeywell Users Group Asia Pacific Effective Defense in Depth Strategies for Industrial Systems 1 Document control number Honeywell Proprietary Honeywell.com Chee Ban, Ngai About the

More information

Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative

Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative November 2014 Disclaimer Current SCADA Vulnerability Factors Industrial Control Systems 101 Proposed Countermeasures

More information

Privacy and Security in Healthcare

Privacy and Security in Healthcare 5 th 5 th th National HIPAA Summit National Strategy to Secure Cyberspace Privacy and Security in Healthcare October 31, 2002 Andy Purdy Senior Advisor, IT Security and Privacy The President s Critical

More information

Process Control and Automation using Modbus Protocol

Process Control and Automation using Modbus Protocol Process Control and Automation using Modbus Protocol Modbus is the fundamental network protocol used in most industrial applications today. It is universal, open and an easy to use protocol. Modbus has

More information

Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment

Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment Introduction 1 Distributed SCADA security 2 Radiflow Defense-in-Depth tool-set 4 Network Access

More information

Cyber Security nei prodotti di automazione

Cyber Security nei prodotti di automazione Cyber Security nei prodotti di automazione Marco Biancardi, ABB SpA, Power System Division 11 dicembre 2013, Roma Why is it an issue? Isolated devices Point to point interfaces Proprietary networks Standard

More information

How to Choose the Right Industrial Firewall: The Top 7 Considerations. Li Peng Product Manager

How to Choose the Right Industrial Firewall: The Top 7 Considerations. Li Peng Product Manager How to Choose the Right Industrial Firewall: The Top 7 Considerations Li Peng Product Manager The right industrial firewall can strengthen the safety and reliability of control systems Central to industrial

More information

Securing Distribution Automation

Securing Distribution Automation Securing Distribution Automation Jacques Benoit, Cooper Power Systems Serge Gagnon, Hydro-Québec Luc Tétreault, Hydro-Québec Western Power Delivery Automation Conference Spokane, Washington April 2010

More information

Goals. Understanding security testing

Goals. Understanding security testing Getting The Most Value From Your Next Network Penetration Test Jerald Dawkins, Ph.D. True Digital Security p. o. b o x 3 5 6 2 3 t u l s a, O K 7 4 1 5 3 p. 8 6 6. 4 3 0. 2 5 9 5 f. 8 7 7. 7 2 0. 4 0 3

More information

Cybersecurity considerations for electrical distribution systems

Cybersecurity considerations for electrical distribution systems White Paper WP152002EN Supersedes January 2014 electrical distribution systems Authors Max Wandera, Brent Jonasson, Jacques Benoit, James Formea, Tim Thompson, Zwicks Tang, Dennis Grinberg, Andrew Sowada,

More information

SECURING THE MOVE TO IP-BASED SCADA/PLC NETWORKS

SECURING THE MOVE TO IP-BASED SCADA/PLC NETWORKS SECURING THE MOVE TO IP-BASED SCADA/PLC NETWORKS November 2011 Purpose The purpose of this guide is to provide examples/types of SCADA and control systems and their typical use in industry. This document

More information

Securing Industrial Control Systems in the Chemical Sector. Roadmap Awareness Initiative Making the Business Case

Securing Industrial Control Systems in the Chemical Sector. Roadmap Awareness Initiative Making the Business Case Securing Industrial Control Systems in the Chemical Sector Roadmap Awareness Initiative Making the Business Case Developed by the Chemical Sector Coordinating Council in partnership with The U.S. Department

More information

NAVFAC EXWC Platform Information Technology (PIT) Cyber Security Initiatives

NAVFAC EXWC Platform Information Technology (PIT) Cyber Security Initiatives NAVFAC EXWC Platform Information Technology (PIT) Cyber Security Initiatives Center of excellence for secure integration, deployment and sustainment of Industrial Control Systems and Operational Technology

More information

INFRASTRUCTURE CONTROL SYSTEMS ENCRYPTION

INFRASTRUCTURE CONTROL SYSTEMS ENCRYPTION INFRASTRUCTURE CONTROL SYSTEMS ENCRYPTION solutions-paper INFRASTRUCTURE AND INDUSTRIAL PROCESS AND CONTROL SYSTEMS SECURITY ARE OF NATIONAL IMPORTANCE DUE TO THEIR ESSENTIAL SERVICES AND ECONOMIC IMPACT.

More information

Designing a security policy to protect your automation solution

Designing a security policy to protect your automation solution Designing a security policy to protect your automation solution September 2009 / White paper by Dan DesRuisseaux 1 Contents Executive Summary... p 3 Introduction... p 4 Security Guidelines... p 7 Conclusion...

More information

Honeywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014

Honeywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014 Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Process Solutions (HPS) June 4, Industrial Cyber Security Industrial Cyber Security is the leading provider of cyber security

More information

Network Cyber Security. Presented by: Motty Anavi RFL Electronics

Network Cyber Security. Presented by: Motty Anavi RFL Electronics Network Cyber Security Presented by: Motty Anavi RFL Electronics Agenda Cyber Security Threats Defense Strategy & Consequences Next Generation Networking ICS Vulnerabilities Liabilities Next Gen Networking

More information

SCADA Systems. Make the most of your energy. March 2012 / White paper. by Schneider Electric Telemetry & Remote SCADA Solutions

SCADA Systems. Make the most of your energy. March 2012 / White paper. by Schneider Electric Telemetry & Remote SCADA Solutions SCADA Systems March 2012 / White paper by Schneider Electric Telemetry & Remote SCADA Solutions Make the most of your energy Summary Executive Summary... p 2 Introduction... p 3 Field Instrumentation...

More information

Smart Substation Security

Smart Substation Security Smart Substation Security SmartSec Europe 2014 Amsterdam 29/01/2014 Agenda Context Elia Introduction to the substation environment in Elia Security design and measures in the substation Near and far future

More information

Cyber Security Compliance (NERC CIP V5)

Cyber Security Compliance (NERC CIP V5) Cyber Security Compliance (NERC CIP V5) Ray Wright NovaTech, LLC Abstract: In December 2013, the Federal Energy Regulatory Commission (FERC) issued Order No. 791 which approved the Version 5 CIP Reliability

More information

Cyber Security :: Insights & Recommendations for Secure Operations. N-Dimension Solutions, Inc.

Cyber Security :: Insights & Recommendations for Secure Operations. N-Dimension Solutions, Inc. Cyber Security :: Insights & Recommendations for Secure Operations N-Dimension Solutions, Inc. Cyber Security Protection for Critical Infrastructure Assets Agenda: Cyber Landscape Cyber Threats to Your

More information

External Supplier Control Requirements

External Supplier Control Requirements External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must

More information

The Importance of Cybersecurity Monitoring for Utilities

The Importance of Cybersecurity Monitoring for Utilities The Importance of Cybersecurity Monitoring for Utilities www.n-dimension.com Cybersecurity threats against energy companies, including utilities, have been increasing at an alarming rate. A comprehensive

More information

GE Measurement & Control. Cyber Security for NERC CIP Compliance

GE Measurement & Control. Cyber Security for NERC CIP Compliance GE Measurement & Control Cyber Security for NERC CIP Compliance GE Proprietary Information: This document contains proprietary information of the General Electric Company and may not be used for purposes

More information

Semaphore T BOX Applications in Data Center Facilities

Semaphore T BOX Applications in Data Center Facilities Semaphore T BOX Applications in Data Center Facilities Introduction Data centers must reliably provide 24/7/365 operation. For automation and monitoring of the facility, use of a rugged, reliable RTU is

More information

What Risk Managers need to know about ICS Cyber Security

What Risk Managers need to know about ICS Cyber Security What Risk Managers need to know about ICS Cyber Security EIM Risk Managers Conference February 18, 2014 Joe Weiss PE, CISM, CRISC, ISA Fellow (408) 253-7934 joe.weiss@realtimeacs.com ICSs What are they

More information

Cyber Risk Mitigation via Security Monitoring. Enhanced by Managed Services

Cyber Risk Mitigation via Security Monitoring. Enhanced by Managed Services Cyber Risk Mitigation via Security Monitoring Enhanced by Managed Services Focus: Up to But Not Including Corporate and 3 rd Party Networks Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance

More information

Efficient remote access to machines and plants with SIMATIC

Efficient remote access to machines and plants with SIMATIC Efficient remote access to machines and plants with SIMATIC Telecontrol and teleservice solutions modular, flexible and secure SIMATIC NET siemens.com/industrial-remote-access Industrial remote access

More information

Resilient and Secure Solutions for the Water/Wastewater Industry

Resilient and Secure Solutions for the Water/Wastewater Industry Insert Photo Here Resilient and Secure Solutions for the Water/Wastewater Industry Ron Allen DA/Central and Steve Liebrecht Rockwell Automation Detroit W/WW Team Leader Your slides here Copyright 2011

More information

Update On Smart Grid Cyber Security

Update On Smart Grid Cyber Security Update On Smart Grid Cyber Security Kshamit Dixit Manager IT Security, Toronto Hydro, Ontario, Canada 1 Agenda Cyber Security Overview Security Framework Securing Smart Grid 2 Smart Grid Attack Threats

More information

SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP

SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP Today s Topics SCADA Overview SCADA System vs. IT Systems Risk Factors Threats Potential Vulnerabilities Specific Considerations

More information

The SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices

The SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices The SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices Kyle Wilhoit Sr. Threat Researcher Trend Micro 1 Glossary HMI: Human Machine Interface IED: Intelligent Electronic Device SCADA:

More information

Securing Modern Substations With an Open Standard Network Security Solution. Kevin Leech Schweitzer Engineering Laboratories, Inc.

Securing Modern Substations With an Open Standard Network Security Solution. Kevin Leech Schweitzer Engineering Laboratories, Inc. Securing Modern Substations With an Open Standard Network Security Solution Kevin Leech Schweitzer Engineering Laboratories, Inc. Copyright SEL 2009 What Makes a Cyberattack Unique? While the resources

More information

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1 Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3

More information

The Advantages of Enterprise Historians vs. Relational Databases

The Advantages of Enterprise Historians vs. Relational Databases GE Intelligent Platforms The Advantages of Enterprise Historians vs. Relational Databases Comparing Two Approaches for Data Collection and Optimized Process Operations The Advantages of Enterprise Historians

More information

TRIPWIRE NERC SOLUTION SUITE

TRIPWIRE NERC SOLUTION SUITE CONFIDENCE: SECURED SOLUTION BRIEF TRIPWIRE NERC SOLUTION SUITE TAILORED SUITE OF PRODUCTS AND SERVICES TO AUTOMATE NERC CIP COMPLIANCE u u We ve been able to stay focused on our mission of delivering

More information

TNC is an open architecture for network access control. If you re not sure what NAC is, we ll cover that in a second. For now, the main point here is

TNC is an open architecture for network access control. If you re not sure what NAC is, we ll cover that in a second. For now, the main point here is 1 2 This slide shows the areas where TCG is developing standards. Each image corresponds to a TCG work group. In order to understand Trusted Network Connect, it s best to look at it in context with the

More information

Monitoring & Control of Small-scale Renewable Energy Sources

Monitoring & Control of Small-scale Renewable Energy Sources Small Scale Renewable Energy Sources and Energy Saving: 6-17 th July 2009 Monitoring & Control of Small-scale Renewable Energy Sources Dr G A Taylor Brunel Institute of Power Systems Brunel University,

More information

Cyber Security. Smart Grid

Cyber Security. Smart Grid Cyber Security for the Smart Grid Peter David Vickery Executive Vice President N-Dimension Solutions Inc. APPA National Conference June 21, 2010 Cyber Security Solutions For Cyber Security

More information

WHITE PAPER PROTECTING OUR CRITICAL UTILITIES WITH INTEGRATED CONTROL SYSTEMS PROTECTING OUR CRITICAL UTILITIES WITH INTEGRATED CONTROL SYSTEMS

WHITE PAPER PROTECTING OUR CRITICAL UTILITIES WITH INTEGRATED CONTROL SYSTEMS PROTECTING OUR CRITICAL UTILITIES WITH INTEGRATED CONTROL SYSTEMS PROTECTING OUR CRITICAL UTILITIES WITH INTEGRATED CONTROL SYSTEMS Critical Infrastructure Security The wellbeing and security of all nations depends on the availability of critical infrastructure, such

More information

Why Can t We Be Friends?

Why Can t We Be Friends? Why Can t We Be Friends? Monitoring the Server Room by Introducing Modbus to SNMP Stanley Liu Product Manager, Data Acquisition & Control Division Overview IA devices are very useful for monitoring server

More information

Security Measures Industrial Hackers Hope You Ignore

Security Measures Industrial Hackers Hope You Ignore usa.siemens.com/oil-gas Security Measures Industrial Hackers Hope You Ignore An overview for oil and gas industry executives on assessing and mitigating industrial network security risks nsu White Paper

More information

A 360 degree approach to security

A 360 degree approach to security June 2012, issue 1-1 SCADA communications A 360 degree approach to security Contents 1. The need for 360 degree security 2 2. Considerations in a 360 degree approach 3 3. Implementing a 360 degree approach

More information

future data and infrastructure

future data and infrastructure White Paper Smart Grid Security: Preparing for the Standards-Based Future without Neglecting the Needs of Today Are you prepared for future data and infrastructure security challenges? Steve Chasko Principal

More information

Decrease your HMI/SCADA risk

Decrease your HMI/SCADA risk Decrease your HMI/SCADA risk Key steps to minimize unplanned downtime and protect your organization. Are you running your plant operations with serious risk? Most industrial applications lack recommended

More information