Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks
|
|
- Dominic Hampton
- 1 years ago
- Views:
Transcription
1 Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Dale Peterson Director, Network Security Practice Digital Bond, Inc Sawgrass Corporate Parkway, Suite 130 Sunrise, FL KEYWORDS: Intrusion Detection, IDS, SCADA, MSSP, Cyber Security ABSTRACT: Governments and industry organizations, including ISA, have recognized that Supervisory Control and Data Acquisition (SCADA), Distributed Control Systems (DCS), and other process control networks, referred to as SCADA networks in this paper, are potential targets of attack from hackers, disgruntled insiders, cyber terrorists, and others who want to disrupt the critical infrastructure. This paper describes how current intrusion detection and cyber security monitoring products and services used in IT enterprise networks can provide early identification of attacks from the most common threat agents. The deficiencies of the current general IT solutions are discussed, and future SCADA specific solutions are described. Special emphasis is placed on how intrusion detection can serve as a compensating security control for the lack of security in field communications. INTRODUCTION: In a recent GAO report 1, the US Government identified five trends that have escalated the risks to SCADA networks: 1. adoption of standardized technologies with known vulnerabilities, 2. connectivity of control systems to other networks, 3. constraints on the use of existing security technologies and practices, 4. insecure remote connections, and
2 5. widespread availability of technical information about control systems. These trends have moved the SCADA networks from proprietary, closed networks to the arena of Information Technology (IT) with all its cost and performance benefits and IT security challenges. The transformation continues to be gradual and may take ten or more years to complete as expensive legacy systems cannot be replaced overnight. This leaves the SCADA community with a large challenge of providing the appropriate IT security for a mission critical network with systems and applications that were not designed for the general IT environment and its inherent security risks. New SCADA systems are being designed with better security features and this improvement is likely to continue as customers demand certified secure solutions. A number of efforts are underway to retrofit security onto legacy systems, but these efforts are having limited success and can be expensive. The SCADA community will need to find compensating security controls until secure systems are available and insecure legacy systems are replaced. The intrusion detection and security monitoring discussed in this paper is one possible compensating control. INTRUSION DETECTION AND SECURITY MONITORING OF NETWORKS: A strong information security program will include a variety of technical and administrative controls designed to prevent intrusions and unauthorized activities from both internal and external threat agents. However, even with a set of strong security products and security policies it is impossible to insure that a network is secure. For this reason, networks that are mission critical or contain sensitive information are deploying intrusion detection and cyber security monitoring systems. Consider the physical analogy to this cyber situation. A critical building will have locks on the doors, safes, and other mechanisms to prevent unauthorized access. This same building will also deploy a set of physical monitoring systems, such as cameras and motion detectors, just in case the security is breached. The monitoring systems identify breaches and enable a quick response. A variety of product and service solutions have been developed to create the cyber equivalent of cameras and motion detectors. These include: Network Intrusion Detection Sensor (NIDS) Products A device that sits on the network and evaluates data traveling over the network. NIDS are typically connected to SPAN ports on switches so a single sensor can evaluate all or most of the traffic on a subnet. The data is compared to data related to a hacking exploit, called a signature. A NIDS may have over 1,000 signatures, and a new signature is typically developed for each new exploit. Host Intrusion Detection Sensor (HIDS) Products Software that is loaded on a host computer system. A HIDS system identifies attacks using signatures or behavior analysis and attempts to prevent the attack. HIDS are generally an active defense that combines attack identification and response.
3 Audit Log Analysis Products Computer systems, applications, infrastructure equipment, and most other IT hardware and software has the capability of generating an audit log. Some of these entries will identify successful and failed intrusion attempts. There are a variety of systems available that will gather log information from various sources and present it in a useful format to a network administrator or security officer. Managed Security System Provider (MSSP) Services Security incidents occur on a 24x7 basis. It requires a team of security experts working around the clock to monitor, evaluate, and quickly respond to information gathered from NIDS, HIDS, audit logs, and other sources. Many companies outsource these tasks to MSSPs. In addition to the manpower, MSSPs have developed sophisticated correlation and analysis engines to process the massive amount of data received on a daily basis. As an example, MSSP engines will reduce five million events a day to two hundred or fewer events that require human evaluation. A small number of product vendors are selling the correlation and analysis engines for large organizations that want to keep this function in house. There are a number of commercial NIDS and HIDS vendors, and the open source NIDS and HIDS solutions are well respected and widely used. In general, the commercial vendors offer better support and are easier to use, while the open source solutions are more flexible and the software is available for free. Special care needs to be taken when selecting an MSSP. The industry is in transition and a number of vendors have gone out of business or have been acquired. When selecting an MSSP consider the following: Formal, documented processes for analyzing and acting on an event Technical skill of the Secure Operations Center (SOC) staff MSSP portal and other tools to look at the events in real time Financial stability and focus on the MSSP business Vendor neutral or at least support for your systems Vertical markets associated with high value information and networks are currently implementing these solutions. Financial service, pharmaceutical, e-commerce, and government organizations are some of the early adopters of these solutions. USE OF CURRENT SOLUTIONS IN SCADA NETWORKS: In recent years, a number of SCADA systems have deployed intrusion detection and security monitoring products and services that were designed for a general purpose IT environment. An
4 example of a very comprehensive deployment using currently available products and services is shown in Figure 1. The NIDS are placed on the Control Center LAN, to identify attacks against the control servers and HMI, and on the demilitarized zone (DMZ), to identify attacks against decision support servers (DSS), Web servers, and other systems that can be accessed by users on the enterprise. The firewalls provide perimeter security for the SCADA network, and their audit logs provide information on enterprise users attempting to access the SCADA system. Similarly, audit logs of routers, switches, and other infrastructure systems could be monitored. Perhaps most importantly, the operating system audit logs of the control servers and other key systems are monitored for security events. Some organizations also monitor web server and database application logs.
5 HMI Stations Monitor Network IDS Servers NIDS Monitor Firewall & VPN Logs and Alerts NIDS Enterprise DMZ DSS Web Server Backup Control Center Monitor Critical High Risk Servers Alerts, Operating System, and Application Logs: RealTime, Historical, DSS, Active Directory and Web Servers Web HMI FIGURE 1 Cyber Security Monitoring With Currently Available Systems The monitored information from all of the above logs and the NIDS are sent to a MSSP or evaluated in house. Monitoring the network at various points allows the MSSP to better remove false positive indicators and to more accurately classify the severity of an attack. Below are a few examples to illustrate the benefits: Enterprise Attack Stopped At The Firewall A firewall with a well designed ruleset will stop most attackers on the enterprise network from accessing the Control Center. By monitoring the firewall logs, a security officer will be able to identify attempts to penetrate the firewall and can deal with the disgruntled insider. This also is an early warning mechanism. Perhaps the first attempts fail, but a persistent attacker may eventually get through. By monitoring the logs, the security officer has the ability to limit the time window for an attacker.
6 Enterprise Attack Stopped At The DMZ An attacker on the enterprise network may attack a web server or DSS server on the DMZ. In the Figure 1 monitoring example, the attack would be seen in the firewall logs, the NIDS on the DMZ, and on the server log. Not only would the multiple data points confirm the attack, they could also indicate whether the attack was successful. Buffer Overflow Attack On Control Server A variety of systems, such as HMI, PLCs, and other control servers, need to access control servers. An attacker can access a system or send spoofed buffer overflow messages to a control server. The NIDS will identify the attack, and the control server audit logs will often identify if the attack was successful or not. This also could be true for denial of service attacks and a variety of other attacks. Hacking Reconnaissance By A Disgruntled Insider An attacker typically begins an attack by scanning the network and servers to identify vulnerabilities. The NIDS will identify these scanning attempts, and the attacker can be stopped before he is successful. A best practice deployment of NIDS and audit log analysis that is performed 24x7 will help identify the intrusion attempts that are most commonly found on TCP/IP networks. Since most of the script kiddies and low to moderate skilled hackers do not develop exploits and lack knowledge of SCADA systems, these technical and administrative controls will stop the most common threat agents. The HIDS were left off of Figure 1 and not included in this discussion because of the risks involved with adding software to a control server and automated response. The added software issue is the same as anti-virus software. Some of the HIDS software inserts itself in the TCP/IP stack and acts as an intermediary. There could be a number of performance and timing issues with this type of product. Vendors and users must certify the HIDS agent will not conflict with the SCADA application. Automated response is a more contentious issue in the information security industry today. Both NIDS and HIDS have the ability to automatically reconfigure systems if an intrusion attempt is identified. This automated and fast reaction is designed to prevent exploits. The danger with an automated response is an attacker can potentially force an IDS system to shut down key parts of the network or server. In effect, the attacker can fool the IDS system into attacking itself. The author s recommendation at this point in time is to use log analysis with 24x7 monitoring rather than HIDS or any other type of automated action. Certainly any use of an automated action should be carefully considered prior to implementation. LIMITATIONS OF CURRENT SOLUTIONS The primary limitation of the current intrusion detection and cyber security monitoring solutions is they have no knowledge or intelligence of SCADA applications and protocols. While attacks against a Microsoft IIS web server using the http protocol are addressed well, an attack on a SCADA control server using the Modbus protocol is not even considered. So the current systems are excellent against script kiddie hackers and other novices that use exploits easily available on the Internet; they are not
7 adequate to detect attacks by a cyber terrorist, disgruntled insider, or skilled hacker with knowledge of SCADA systems. SCADA application and protocol intelligence needs to be added to all of the products and services mentioned earlier in this paper. FUTURE SOLUTIONS MONITORING OF SCADA APPLICATION AUDIT LOGS SCADA applications typically log a great deal of information. In fact, many of these logs are written to historian servers and maintained for a variety of important business purposes such as billing, maintenance, and regulatory compliance. The majority of the log entries are operational in nature and are based on sensor information or actuator actions. However, there is a subset of events in the SCADA audit logs that could help identify intrusions or other unauthorized actions. Some examples of useful security information in these SCADA logs are: Escalation of user privilege in the SCADA application Changing of a display (perhaps to fool an operator) Failed login attempts indicating a password cracking effort Disabling alarms to hide a physical attack (an example of a blended threat) The transport of the SCADA logs to a MSSP or correlation engine is straightforward and available today. Control servers generally support syslog or other simple log transport protocols. This could be used to transfer the entire log. Ideally the SCADA application, or an agent program certified by the SCADA vendor, would identify and send only security related entries to save bandwidth and reduce the amount of data a MSSP would need to analyze. The MSSP and correlation engines will need to be modified to understand the implications of the SCADA logs. Additionally the security staff in the SOC will need to understand SCADA networks and the log formats to gain the full value of this information. In summary, it will take cooperation between the vendors, users, and MSSPs to be successful. This has already occurred for the more mainstream applications such as databases and web servers. SCADA SIGNATURE SET FOR NIDS A second type of customization required for SCADA systems is the addition of specialized signatures for NIDS. These signatures will relate to SCADA protocols such as Modbus, PROFIBUS, OPC, and FF. As known vulnerabilities are uncovered for a SCADA application, corresponding signatures can also be developed. Note that it is naïve to expect that vulnerabilities will not be found in SCADA
8 systems when they have been found in virtually every enterprise application. SCADA vendors could also be proactive in developing signatures that would identify the most common attacks on their particular systems. The SCADA signature set could also be an effective compensating control for a major security problem: field communications. There is virtually no security for control center to field, RTU or PLC, communications. It is simple to fool a field device to take a dangerous command. Conversely, access to a TCP/IP based field device could be used by a cyber-terrorist to attack the SCADA control servers and take down the entire SCADA system. Since field devices have a typical lifetime of ten to twenty years, this problem will be around for a long time even if solutions embedded into SCADA systems were available today. A SCADA signature set could identify unauthorized or unusual field communication. With the right user interface, a SCADA user could characterize expected field communications in terms of IP addresses, protocols, parameters, and frequency into NIDS signatures. The NIDS would then identify potential attacks via the SCADA field communications. With the right user interface it would be a simple matter to deploy these additional signatures. Since NIDS is a passive system, there would be no negative impact on the network or performance. INTEGRATION AND SUMMARY Today, SCADA users can deploy sophisticated intrusion detection and cyber monitoring products and services that will help identify attacks from the most common threat agents. This early identification will help stop the attacks before they are successful or at least limit the damage. In the future, SCADA specific signature sets for NIDS systems and SCADA application log analysis can be added to the existing IT systems. Ideally, this information and corresponding SCADA knowledge will be integrated into the correlation engines and learned by the SOC staff to provide a true SCADA security monitoring solution. REFERENCES: 1 Critical Infrastructure Protection: Challenges in Securing Control, GAO T, United States General Accounting Office (GAO), Washington D.C., October 1, 2003
Security Event Monitoring (SEM) Working Group
Security Event Monitoring (SEM) Working Group Dale Peterson, SEM WG Chair Digital Bond, Inc. Collaborating to Advance Control System Security Control Systems Are Being Monitored Detecting Intrusions and
Architecture Overview
Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and
Security Solutions to Meet NERC-CIP Requirements. Kevin Staggs, Honeywell Process Solutions
Kevin Staggs, Honeywell Process Solutions Table of Contents Introduction...3 Nerc Standards and Implications...3 How to Meet the New Requirements...4 Protecting Your System...4 Cyber Security...5 A Sample
Defense-in-Depth Strategies for Secure, Open Remote Access to Control System Networks
Defense-in-Depth Strategies for Secure, Open Remote Access to Control System Networks A look at multi-vendor access strategies Joel Langill TÜV FSEng ID-1772/09, CEH, CPT, CCNA Security Consultant / Staff
Designing a security policy to protect your automation solution
Designing a security policy to protect your automation solution September 2009 / White paper by Dan DesRuisseaux 1 Contents Executive Summary... p 3 Introduction... p 4 Security Guidelines... p 7 Conclusion...
SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP
SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP Today s Topics SCADA Overview SCADA System vs. IT Systems Risk Factors Threats Potential Vulnerabilities Specific Considerations
INTRUSION DETECTION SYSTEMS and Network Security
INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS
IT Security and OT Security. Understanding the Challenges
IT Security and OT Security Understanding the Challenges Security Maturity Evolution in Industrial Control 1950s 5/4/2012 # 2 Technology Sophistication Security Maturity Evolution in Industrial Control
Understanding SCADA System Security Vulnerabilities
Understanding SCADA System Security Vulnerabilities Talking Points Executive Summary Common Misconceptions about SCADA System Security Common Vulnerabilities Affecting SCADA Networks Tactics to Strengthen
DeltaV Cyber Security Solutions
TM DeltaV Cyber Security Solutions A Guide to Securing Your Process A long history of cyber security In pioneering the use of commercial off-the-shelf technology in process control, the DeltaV digital
Innovative Defense Strategies for Securing SCADA & Control Systems
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet
ITEC441- IS Security. Chapter 15 Performing a Penetration Test
1 ITEC441- IS Security Chapter 15 Performing a Penetration Test The PenTest A penetration test (pentest) simulates methods that intruders use to gain unauthorized access to an organization s network and
AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE
AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
HACKING RELOADED. Hacken IS simple! Christian H. Gresser cgresser@nesec.de
HACKING RELOADED Hacken IS simple! Christian H. Gresser cgresser@nesec.de Agenda About NESEC IT-Security and control Systems Hacking is easy A short example where we currently are Possible solutions IT-security
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Security Issues with Integrated Smart Buildings
Security Issues with Integrated Smart Buildings Jim Sinopoli, Managing Principal Smart Buildings, LLC The building automation industry is now at a point where we have legitimate and reasonable concern
Security Testing in Critical Systems
Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base
AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE
AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,
Managed Intrusion, Detection, & Prevention Services (MIDPS) Why E-mail Sorting Solutions? Why ProtectPoint?
Managed Intrusion, Detection, & Prevention Services (MIDPS) Why E-mail Sorting Solutions? Why ProtectPoint? Why? Focused on Managed Intrusion Security Superior-Architected Hardened Technology Security
CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System
CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System Purpose CIP-005-5 R2 is focused on ensuring that the security of the Bulk Energy System is not compromised
Guideline on Auditing and Log Management
CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
This chapter covers the following topics: Why Network Security Is Necessary Secure Network Design Defined Categorizing Network Security Threats How
This chapter covers the following topics: Why Network Security Is Necessary Secure Network Design Defined Categorizing Network Security Threats How Network Security Is Breached Network Security Policy
GE Measurement & Control. Cyber Security for NEI 08-09
GE Measurement & Control Cyber Security for NEI 08-09 Contents Cyber Security for NEI 08-09...3 Cyber Security Solution Support for NEI 08-09...3 1.0 Access Contols...4 2.0 Audit And Accountability...4
Name. Description. Rationale
Complliiance Componentt Description DEEFFI INITION Network-Based Intrusion Detection Systems (NIDS) Network-Based Intrusion Detection Systems (NIDS) detect attacks by capturing and analyzing network traffic.
Outline Intrusion Detection CS 239 Security for Networks and System Software June 3, 2002
Outline Intrusion Detection CS 239 Security for Networks and System Software June 3, 2002 Introduction Characteristics of intrusion detection systems Some sample intrusion detection systems Page 1 Page
Taxonomy of Intrusion Detection System
Taxonomy of Intrusion Detection System Monika Sharma, Sumit Sharma Abstract During the past years, security of computer networks has become main stream in most of everyone's lives. Nowadays as the use
N4SECURE SERVICES TECHNICAL DESCRIPTION PUBLIC NODE4 LIMITED 25/04/2016
N4SECURE SERVICES TECHNICAL DESCRIPTION PUBLIC NODE4 LIMITED 25/04/2016 INTRODUCTION N4Secure is a Threat Intelligence managed service. By monitoring network traffic, server traffic, scanning for internal
Anomaly Detection For Process Control Systems. Ron Derynck Director, Product Strategies, Verano
Anomaly Detection For Process Systems Ron Derynck Director, Product Strategies, Verano About Verano Industrial software company Headquarters in Mansfield, Mass. Software development in Calgary, Canada
SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005
SCADA System Security ECE 478 Network Security Oregon State University March 7, 2005 David Goeke Hai Nguyen Abstract Modern public infrastructure systems
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell Mandiant, a FireEye company [2014 SANS European ICS Summit] About me Currently: Principal Consultant on Mandiant s Industrial
Cyber Security for SCADA/ICS Networks
Cyber Security for SCADA/ICS Networks GANESH NARAYANAN HEAD-CONSULTING CYBER SECURITY SERVICES www.thalesgroup.com Increasing Cyber Attacks on SCADA / ICS Systems 2 What is SCADA Supervisory Control And
Security Frameworks. An Enterprise Approach to Security. Robert Belka Frazier, CISSP belka@att.net
Security Frameworks An Enterprise Approach to Security Robert Belka Frazier, CISSP belka@att.net Security Security is recognized as essential to protect vital processes and the systems that provide those
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security
Introduction to Network Discovery and Identity
The following topics provide an introduction to network discovery and identity policies and data: Host, Application, and User Detection, page 1 Uses for Host, Application, and User Discovery and Identity
Computer System Security Updates
Why patch? If you have already deployed a network architecture, such as the one recommended by Rockwell Automation and Cisco in the Converged Plantwide Ethernet Design and Implementation Guide (http://www.ab.com/networks/architectures.html),
CYBER SECURITY. Is your Industrial Control System prepared?
CYBER SECURITY Is your Industrial Control System prepared? Presenter: Warwick Black Security Architect Operation & Optimization Software Activity Schneider-Electric Challenges What challenges are there
A Decision Maker s Guide to Securing an IT Infrastructure
A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose
BluVector Cyber Threat Detection and Hunting Platform
BluVector Cyber Threat Detection and Hunting Platform DR160205D June 2016 Miercom www.miercom.com Contents Executive Summary... 3 Overview... 4 Product Tested... 4 Test Focus... 4 How We Did It... 5 Detection...
Protecting Critical Infrastructure
Protecting Critical Infrastructure SCADA Network Security Monitoring March 20, 2015 Table of Contents Introduction... 4 SCADA Systems... 4 In This Paper... 4 SCADA Security... 4 Assessing the Security
Ranch Networks for Hosted Data Centers
Ranch Networks for Hosted Data Centers Internet Zone RN20 Server Farm DNS Zone DNS Server Farm FTP Zone FTP Server Farm Customer 1 Customer 2 L2 Switch Customer 3 Customer 4 Customer 5 Customer 6 Ranch
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
Network Security and Firewall 1
Department/program: Networking Course Code: CPT 224 Contact Hours: 96 Subject/Course WEB Access & Network Security: Theoretical: 2 Hours/week Year Two Semester: Two Prerequisite: NET304 Practical: 4 Hours/week
Industrial Firewalls Endpoint Security
Industrial Firewalls Endpoint Security Is there a need for a new type of industrial firewall? Industries have a huge park of different management and control systems to monitor their production. These
DeltaV System Cyber-Security
January 2013 Page 1 This paper describes the system philosophy and guidelines for keeping your DeltaV System secure from Cyber attacks. www.deltav.com January 2013 Page 2 Table of Contents Introduction...
Passive Logging. Intrusion Detection System (IDS): Software that automates this process
Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
8. Firewall Design & Implementation
DMZ Networks The most common firewall environment implementation is known as a DMZ, or DeMilitarized Zone network. A DMZ network is created out of a network connecting two firewalls; i.e., when two or
MANAGED SECURITY SERVICES
MANAGED SECURITY SERVICES Security first Safety first! Security is becoming increasingly important for companies, especially for the extension of networking to mission-critical environments, with new intranet
INTRUSION DETECTION SYSTEM (IDS) D souza Adam Jerry Joseph 0925910 I MCA
INTRUSION DETECTION SYSTEM (IDS) D souza Adam Jerry Joseph 0925910 I MCA OVERVIEW Introduction Overview The IDS Puzzle Current State of IDS Threats I have a good firewall, why do I need an IDS? Expectations
Recommended IP Telephony Architecture
Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 SNAC.Guides@nsa.gov This Page Intentionally Left Blank ii Warnings
Using the Nessus Vulnerability Scanner on Control Systems
Using the Nessus Vulnerability Scanner on Control Systems By Dale Peterson All too often we hear stories about the IT Department or some consultant running a vulnerability scan that takes down a key control
CYBER SECURITY: SYSTEM SERVICES FOR THE SAFEGUARD OF DIGITAL SUBSTATION AUTOMATION SYSTEMS. Massimo Petrini (*), Emiliano Casale TERNA S.p.A.
21, rue d Artois, F-75008 PARIS D2-102 CIGRE 2012 http : //www.cigre.org CYBER SECURITY: SYSTEM SERVICES FOR THE SAFEGUARD OF DIGITAL SUBSTATION AUTOMATION SYSTEMS Massimo Petrini (*), Emiliano Casale
Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2
Report No. 13-35 September 27, 2013 Appalachian Regional Commission Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning
Payment Card Industry Data Security Standard Payment Card Industry Data Security Standard (PCI / DSS)
Payment Card Industry Data Security Standard (PCI / DSS) InterSect Alliance International Pty Ltd Page 1 of 12 Intersect Alliance International Pty Ltd. All rights reserved worldwide. Intersect Alliance
Building Energy Security Framework
Building Energy Security Framework Philosophy, Design, and Implementation Building Energy manages multiple subsets of customer data. Customers have strict requirements for regulatory compliance, privacy
1. Thwart attacks on your network.
An IDPS can secure your enterprise, track regulatory compliance, enforce security policies and save money. 10 Reasons to Deploy an Intrusion Detection and Prevention System Intrusion Detection Systems
Intrusion Detection and Prevention Systems in the Industrial Automation and Control Systems Environment
Intrusion Detection and Prevention Systems in the Industrial Automation and Control Systems Environment Chris Martin Senior Director Product Strategy Industrial Defender Inc. Agenda Overview of IDS/IPS
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION Prepared for the NRC Fuel Cycle Cyber Security Threat Conference Presented by: Jon Chugg, Ken Rohde Organization(s): INL Date: May 30, 2013 Disclaimer
Firewall Security. Presented by: Daminda Perera
Firewall Security Presented by: Daminda Perera 1 Firewalls Improve network security Cannot completely eliminate threats and a=acks Responsible for screening traffic entering and/or leaving a computer network
Security for. Industrial. Automation. Considering the PROFINET Security Guideline
Security for Industrial Considering the PROFINET Security Guideline Automation Industrial IT Security 2 Plant Security Physical Security Physical access to facilities and equipment Policies & Procedures
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
a) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN)
MIS5206 Week 12 Your Name Date 1. Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)? a) User from within could send a file
Threat Center. Real-time multi-level threat detection, analysis, and automated remediation
Threat Center Real-time multi-level threat detection, analysis, and automated remediation Description Advanced targeted and persistent threats can easily evade standard security, software vulnerabilities
Honeywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014
Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Process Solutions (HPS) June 4, Industrial Cyber Security Industrial Cyber Security is the leading provider of cyber security
SCADA SYSTEMS AND SECURITY WHITEPAPER
SCADA SYSTEMS AND SECURITY WHITEPAPER Abstract: This paper discusses some of the options available to companies concerned with the threat of cyber attack on their critical infrastructure, who as part of
SCADA virtual test environment development
SCADA virtual test environment development Ciprian Nicolae BOLDEA Abstract Control systems are potential targets of cyber attacks. SCADA networks are usually seen as industrial equipment, not affected
Tk20 Network Infrastructure
Tk20 Network Infrastructure Tk20 Network Infrastructure Table of Contents Overview... 4 Physical Layout... 4 Air Conditioning:... 4 Backup Power:... 4 Personnel Security:... 4 Fire Prevention and Suppression:...
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
Cyber Threats in Physical Security Understanding and Mitigating the Risk
Cyber Threats in Physical Security Understanding and Mitigating the Risk Synopsis Over the last few years, many industrial control systems, including security solutions, have adopted digital technology.
Internet Scanner 7.0 Frequently Asked Questions
Frequently Asked Questions Internet Scanner 7.0 Frequently Asked Questions April 2003 6303 Barfield Road Atlanta, GA 30328 Tel: 404.236.2600 Fax: 404.236.2626 Internet Security Systems (ISS) Internet Scanner
Performance Evaluation of Intrusion Detection Systems
Performance Evaluation of Intrusion Detection Systems Waleed Farag & Sanwar Ali Department of Computer Science at Indiana University of Pennsylvania ABIT 2006 Outline Introduction: Intrusion Detection
Intrusion Detection System (IDS)
Intrusion Detection System (IDS) Characteristics Systems User, Process predictable actions describing process under that actions what pattern subvert actions attack of correspond the systems processes
Course Title: Penetration Testing: Security Analysis
Course Title: Penetration Testing: Security Analysis Page 1 of 9 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics in advanced
Using Ranch Networks for Internal LAN Security
Using Ranch Networks for Internal LAN Security The Need for Internal LAN Security Many companies have secured the perimeter of their network with Firewall and VPN devices. However many studies have shown
Firewall VPN Router. Quick Installation Guide M73-APO09-380
Firewall VPN Router Quick Installation Guide M73-APO09-380 Firewall VPN Router Overview The Firewall VPN Router provides three 10/100Mbit Ethernet network interface ports which are the Internal/LAN, External/WAN,
Considerations In Developing Firewall Selection Criteria. Adeptech Systems, Inc.
Considerations In Developing Firewall Selection Criteria Adeptech Systems, Inc. Table of Contents Introduction... 1 Firewall s Function...1 Firewall Selection Considerations... 1 Firewall Types... 2 Packet
Presented By: Holes in the Fence. Agenda. IPCCTV Attack. DDos Attack. Why Network Security is Important
Presented By: Holes in the Fence Dave Engebretson, Contributing Technology writer, SDM Magazine Industry Instructor in Fiber and Networking Prevention of Security System breaches of networked Edge Devices
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
Building Secure Networks for the Industrial World
Building Secure Networks for the Industrial World Anders Felling Vice President, International Sales Westermo Group Managing Director Westermo Data Communication AB 1 Westermo What do we do? Robust data
IntruPro TM IPS. Inline Intrusion Prevention. White Paper
IntruPro TM IPS Inline Intrusion Prevention White Paper White Paper Inline Intrusion Prevention Introduction Enterprises are increasingly looking at tools that detect network security breaches and alert
FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.
1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams
SCADA Supervisory Control And Data Acquisition
Ramtin Raji Kermani Fall 2005 Computer Sciences & Engineering Department Shiraz University Road Map: What is a Control System? What is SCADA? Where and why SCADA is used? SCADA architecture Components
Advanced Threat Protection
Advanced Threat Protection DR151026D December 2015 Miercom www.miercom.com Contents Executive Summary... 3 Overview... 4 Methodology... 5 Results Summary... 9 Fair Test Notification... 13 About Miercom...
IS TEST 3 - TIPS FOUR (4) levels of detective controls offered by intrusion detection system (IDS) methodologies. First layer is typically responsible for monitoring the network and network devices. NIDS
Secure Software Programming and Vulnerability Analysis
Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Operations and Denial of Service Secure Software Programming 2 Overview
National Cyber League Certified Ethical Hacker (CEH) TM Syllabus
National Cyber League Certified Ethical Hacker (CEH) TM Syllabus Note to Faculty This NCL Syllabus is intended as a supplement to courses that are based on the EC- Council Certified Ethical Hacker TM (CEHv8)
THE ROLE OF IDS & ADS IN NETWORK SECURITY
THE ROLE OF IDS & ADS IN NETWORK SECURITY The Role of IDS & ADS in Network Security When it comes to security, most networks today are like an egg: hard on the outside, gooey in the middle. Once a hacker
Closing Wireless Loopholes for PCI Compliance and Security
Closing Wireless Loopholes for PCI Compliance and Security Personal information is under attack by hackers, and credit card information is among the most valuable. While enterprises have had years to develop
An IT Perspective of Control Systems Security
An IT Perspective of Control Systems Security Abstract Enterprises with industrial operations typically utilize at least two types of computer networks Information Technology (IT) - a network that supports
Enterprise Cybersecurity: Building an Effective Defense
: Building an Effective Defense Chris Williams Scott Donaldson Abdul Aslam 1 About the Presenters Co Authors of Enterprise Cybersecurity: How to Implement a Successful Cyberdefense Program Against Advanced
Cyber assessment methods
Page 1 of 8 ISA InTech Home 1 November 2005 Cyber assessment methods Here is the plan for enhancing control system security. By May Robin Permann and Kenneth Rohde The terrorist attacks of 11 September
Analyzing Security for Retailers An analysis of what retailers can do to improve their network security
Analyzing Security for Retailers An analysis of what retailers can do to improve their network security Clone Systems Business Security Intelligence Properly Secure Every Business Network Executive Summary
Advance Malware protection in distribution and manufacturing environments. Rob Dolci, April 2016, copyright aizoon USA.
Advance Malware protection in distribution and manufacturing environments Rob Dolci, April 2016, copyright aizoon USA. aizoon at a glance Bologna New York, NY Cuneo USA Troy, MI Lewiston, ME Cambridge,
OPC & Security Agenda
OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information
TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY
IT FIREWALL POLICY TABLE OF CONTENT 1. INTRODUCTION... 3 2. TERMS AND DEFINITION... 3 3. PURPOSE... 5 4. SCOPE... 5 5. POLICY STATEMENT... 5 6. REQUIREMENTS... 5 7. OPERATIONS... 6 8. CONFIGURATION...