AUP28. Implementing Security In Integrated Architecture Practical security solutions for Industrial Control System (ICS)

Transcription

1 AUP28 Implementing Security In Integrated Architecture Practical security solutions for Industrial Control System (ICS) Clive Barwise, Rockwell Automation European Product Manager Networks and Security 9 th and 10 th September 2014 PUBLIC INFORMATION Copyright 2014 Rockwell Automation, Inc. All Rights Reserved.

2 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 2 Agenda Trends in Security of Industrial Control Systems Rockwell CISCO Panduit Partnership for Industrial Security Defense in Depth Remote Access Conclusion

5 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 5 Recently reported by customer New Havex malware variants target industrial control system and SCADA users During the spring, attackers began distributing new versions of a remote access Trojan (RAT) program called Havex by hacking Following into the websites the discovery of industrial of control the Stuxnet system (ICS) manufacturers and poisoning their legitimate software industrial downloads sabotage malware in 2010, which is believed to have destroyed up to 1,000 F-Secure did not name the affected vendors, but said that two of them develop ICS remote management uranium enrichment centrifuges in Iran, software and the third supplies high-precision industrial cameras and related software. According to the security researchers sounded the alarm security firm, the vendors are based in Germany, Switzerland and Belgium. about the insecurity of industrial control The attackers modified systems the legitimate and software the ease installers with which to drop they and execute can an additional file on computers. The file is called be targeted mbcheck.dll by and attackers. is actually Despite the Havex those malware. That conclusion is also supported concerns, by widespread the existence of malware a new malicious attacks Havex component whose purpose is to scan local area networks against for ICS devices and that SCADA respond systems to OPC (Open never Platform Communications) requests. became a reality, making the new Havex campaigns a rare occurrence, but possibly The Havex component leverages the OPC standard to gather information about industrial control devices an indication of things to come. and then sends that information back to its command-and-control (C&C) server for the attackers to analyze, the F-Secure researchers said. It appears that this component is used as a tool for intelligence gathering. So far, we have not seen any payloads that attempt to control the connected hardware.

6 Security Why is it so critical now? Source: ARC Survey of Control System Engineers 2009 Nearly 65% of facilities allow remote access to their control systems. Source: ARC Strategies, Dec 2013 Source: 2011 Annual Report on Cyber Security Incidents And Trends Affecting Industrial Control Systems. Industrial Control Systems are part of the Enterprise and no longer islands of automation. Copyright 2014 Rockwell Automation, Inc. All Rights Reserved.

9 What is Industrial Cyber Security Risk Management? Reduce risks associated with unintended or malicious actions Improve ability to be free from danger, injury or loss Enhance protection of key assets from disruption, loss or damage The use of proven technologies, policies & procedures to RISK = Threat Vulnerability Consequence Protect & limit potential exposure or damage to key assets Protect of People, Property & Proprietary Information from unintended or malicious actions taken against it Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 9

10 Partners Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 10 Rockwell Automation Focus on Industrial Cyber Security Reduce risks to safe and reliable operation Control system architecture with layered security to help maintain operational integrity under threat Data Protection and Confidentiality Network IP protection Role-based Security Data Protection Anti- Tamper and Detection Remote Access Supply-chain Protect assets & information Product and system features to help control access, tamper-proof and limit information exposure Government and Standards Alignment Responsible disclosure with control system solutions that follow global standards and help fulfill independent & regulatory security requirements

11 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. Industrial Network Security Trends Established Industrial Security Standards International Society of Automation ISO/IEC (Formerly ISA-99) Industrial Automation and Control Systems (IACS) Security Defense-in-Depth IDMZ Deployment National Institute of Standards and Technology NIST Industrial Control System (ICS) Security Defense-in-Depth IDMZ Deployment Department of Homeland Security / Idaho National Lab DHS INL/EXT Control Systems Cyber Security: Defense-in-Depth Strategies Defense-in-Depth IDMZ Deployment

12 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 12 Collaboration of Partners Wireless, Security, Switching/Routing Leader in Industrial Network Infrastructure The Established #1 Industrial Ethernet Physical Layer Network Infrastructure Reduce Risk Simplify Design Speed Deployment

13 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 13 Defense-in-Depth No single product, technology or methodology can fully secure Industrial Automation and Control System (IACS) applications. Protecting IACS assets requires a defense-in-depth security approach, which addresses internal and external security threats. This approach utilizes multiple layers of defense (physical, procedural and electronic) at separate IACS levels by applying policies and procedures that address different types of threats.

16 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 16 Defense-in-Depth Industrial Security Policies Drive Technical Controls Physical limit physical access to authorized personnel Cells/Areas, control panels, devices, cabling, and control room Network security framework e.g. firewall policies, access control list (ACL) policies for switches and routers, AAA, intrusion detection and prevention systems (IDS/IPS) Computer Hardening patch management, Anti-X software, removal of unused applications/ protocols/services, closing unnecessary logical ports, protecting physical ports Application authentication, authorization, and accounting (AAA) software Device Hardening change management, communication encryption, and restrictive access

17 Defense-in-Depth Computer Hardening - Examples Security Patch Management: establish and document a security patch management program for tracking, evaluating, testing, and installing applicable cyber security software patches Keep computers up-to-date on service packs and hot fixes Disable automatic updates Check software vendor website Test patches before implementing Schedule patching during downtime Deploy and maintain Anti-X (antivirus, antispyware, etc.) and malware detection software Disable automatic updates and automatic scanning Test definition updates before implementing Schedule manually initiated scanning during downtime Uninstall unused Windows components Protocols and Services Protect unused or infrequently used USB, parallel or serial interfaces 17 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. Funda

18 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 18 Computer Hardening Examples Software Restriction Policies (SRP) Software Restriction Policies (SRP) is Group Policy-based feature that identifies software programs running on computers in a domain, and controls the ability of those programs to run. Software restriction policies are part of the Microsoft security and management strategy to assist enterprises in increasing the reliability, integrity, and manageability of their computers. You can also use software restriction policies to create a highly restricted configuration for computers, in which you allow only specifically identified applications to run. Software restriction policies are integrated with Microsoft Active Directory and Group Policy. You can define these policies through the Software Restriction Policies extension of the Local Group Policy Editor or the Local Security Policies snap-in to the Microsoft Management Console (MMC).

20 Computer Hardening Examples Registry Setting to Disable USB Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 20 Start Value = 4 to disable HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

21 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 21 Network Security Framework Physical Port Security Keyed solutions for copper and fiber Lock-in, Blockout products secure connections Data Access Port (keyed cable and jack)

23 Security Quality Product Resiliency & Robustness (R&R) Testing 23 Copyright 2013 Rockwell Automation, Inc. All rights reserved. Key part of our Industrial Security Team Help reduce customer risk Critical to our Industrial Security Goals Identify weaknesses and vulnerabilities Improve product resiliency & robustness Evaluation of all company products Leveraging ISA Security Compliance Institute (ISCI) approved tools and test suites Achilles test tool & Level-2 test suite fulfills technical aspects of ISA-99 and IEC standard for ICS cyber security Evaluates resiliency of Ethernet protocol suite Results provide concrete facts about product resiliency to simplistic attacks driving continuous improvement.

24 Defense-in-Depth Controller Hardening - Examples Electronic design Firmware Digital Signatures Purpose of digital signature Protect firmware from accidental and malicious corruption Ensure firmware was generated by Rockwell Automation How they re being introduced ControlLogix L7x and V18 SoftLogix firmware is digitally signed More devices will have signed firmware in the future ControlFlash itself may check the signature How they work Rockwell Automation digitally signs firmware kits with a private key when they are released Devices locally check the signature with a corresponding public key Any change to the firmware kit will cause the signature check to fail in device 24 Copyright 2013 Rockwell Automation, Inc. All rights reserved. Funda

25 Controller Security Tools Turn the Switch Lock the Program Protect the Source Embedded Change Log FactoryTalk Security Data Access Control Copyright 2011 Rockwell Automation, Inc. All rights reserved. Copyright 2013 Rockwell Automation, Inc. All rights reserved. 25

26 Copyright 2013 Rockwell Automation, Inc. All rights reserved. 26 Tools for a Secure Application Controller Change Detection Every Logix PAC exposes a Change Detection Audit Value When something happens that can impact the behavior of the controller, the value changes Audit Value is available in RSLogix 5000 and Studio 5000 Logix Designer, in other software applications and in other controllers via a message instruction The set of events that causes the Audit Value to change can be configured

27 Defense-in-Depth Controller Hardening - Examples Electronic design - Logix Controller Data Access Control Users can assign External Access settings of Read/Write, Read Only, or None to tags Useful to control which tags can be modified from an HMI or other external application A cryptographically licensed trusted connection is established between RSLogix 5000 and the Logix controller Ensures tags designated as Read-Only or None can only by changed by RSLogix 5000 Users can also define tags as Constants. Constants can not be modified by controller logic Improves security of tags especially when used in conjunction with FactoryTalk Security or the CPU Lock tool 27 Copyright 2013 Rockwell Automation, Inc. All rights reserved. Funda

29 Copyright 2013 Rockwell Automation, Inc. All rights reserved. 29 Tools for a Secure Application FactoryTalk Security Use FactoryTalk Security to Manage the insider threat by authenticating the user and authorizing the use of Rockwell Automation software applications to access automation devices How does it work? Provides a centralized authority to verify identity of each user and grants or deny user's requests to perform a particular set of actions on resources within the system. FactoryTalk Directory Authenticate the User Authorize Use of Applications Authorize Access to Specific Devices (All FactoryTalk Security enabled software)

30 Copyright 2013 Rockwell Automation, Inc. All rights reserved. 30 The Purdue Model and Rockwell Automation Rockwell Automation and CISCO Systems have defined a manufacturing framework to created a foundation for network segmentation, management and policy enforcement maximising the seamless of the Industrial Cyber Security Technical Countermeasures and minimising the risks to be assumed by our customers:

31 Copyright 2013 Rockwell Automation, Inc. All rights reserved. 31 Network Security Framework Industrial Demilitarized Zone Level 5 Level 4 , Intranet, etc. Enterprise Network Site Business Planning and Logistics Network Enterprise Security Zone Remote Gateway Services Application Mirror Patch Management Web Services Operations AV Server Application Server Firewall Firewall Web CIP Industrial DMZ Level 3 Level 2 Level 1 FactoryTalk Application Server FactoryTalk Client Batch Control FactoryTalk Directory Operator Interface Discrete Control Engineering Workstation FactoryTalk Client Drive Control Remote Access Server Engineering Workstation Continuous Process Control Site Operations and Control Area Supervisory Control Operator Interface Safety Control Basic Control Industrial Security Zone Cell/Area Zone Level 0 Sensors Drives Actuators Robots Process Logical Model Industrial Automation and Control System (IACS) Converged Multi-discipline Industrial Network No Direct Traffic Flow between Enterprise and Industrial Zone

32 Copyright 2012 Rockwell Automation, Inc. All rights reserved. 32 Tools for a Secure Network Network Segmentation Enterprise-wide Network Enterprise-wide Network Enterprise-wide Network Enterprise-wide Network Plant-wide Network Switch with VLANs Plant-wide Network Plant-wide Network Plant-wide Network Not Recommended Recommended Enterprise-wide Network Enterprise-wide Network Enterprise-wide Network Router (Zone Based FW) Firewall IDMZ Plant-wide Network Plant-wide Network Plant-wide Network Good Better Best

33 Segmentation Structure and Hierarchy - Logical Framework Layer 2 Access Switch Layer 3 Distribution Switch Layer 3 Inter VLAN Catalyst Routing 3750 StackWise Switch Stack Building Block Manages what traffic can pass from one VLAN to the next Cell/Area Zones Levels 0 2 Level 2 HMI Layer 2 Drive Building Controller Block HMI VLAN 102 VLAN 102 Traffic I/O Media & Connectors Rockwell Automation Layer 2Stratix 8000 Layer 2 Access Switch Building Block Cell/Area Zone #2 Level 1 Controller Cell/Area Zone #1 VLAN Ring Topology 103 Traffic Cell/Area VLAN 104 Zone Traffic #3 stays Redundant in this Star Topology block stays Resilient in Ethernet this block Protocol (REP) Bus/Star Flex Links Resiliency stays in Topology this block The Cell/Area zone is a Layer 2 network for a functional area of the plant floor. Key network considerations include: Structure and hierarchy using smaller Layer 2 building blocks I/O VLAN 103 Controller Drive I/O VLAN 104 Level 0 Drive Logical segmentation for traffic management and policy enforcement (e.g. QoS, Security) to accommodate time-sensitive applications HMI HMI Layer 2 Controller Drive Building Block Copyright 2012 Rockwell Automation, Inc. All rights reserved.

34 Copyright 2012 Rockwell Automation, Inc. All rights reserved. 34 Network Security Framework VLANs, Segmenting Domains of Trust Plant-wide IACS VLAN 10 IP Subnet /24 Plant-wide IACS VLAN 10 IP Subnet /24 Plant-wide IACS Stratix 8300 Plant-wide IACS Stratix 8300 Layer 3 Ring Ring Stratix 8000 Stratix 8000 Stratix 8000 Stratix 8000 Machine #1 OEM #1 Machine #2 OEM #2 Machine #1 OEM #1 Machine #2 OEM #2 Layer 2 Layer 2 Layer 2 Flat and Open IACS Network Infrastructure Machine #1 (OEM #1) VLAN 20 IP Subnet /24 Machine #2 (OEM #2) VLAN 30 IP Subnet /24 Structured and Hardened IACS Network Infrastructure

35 Copyright 2012 Rockwell Automation, Inc. All rights reserved. 35 Network Security Framework Cisco / Rockwell Automation Reference Architectures Structured and hardened network infrastructure Scalable framework utilizing holistic defense-in-depth approach Security is pervasive, not a bolt-on component Alignment with industrial security standards (e.g. ISA, NIST) Industrial security policy: A-I-C vs. C-I-A Industrial DMZ implementation Remote partner access policy, with robust & secure implementation Network Security Services Must Not Compromise Plant Operations Standard DMZ Design Best Practices AAA FactoryTalk Authentication Server, Active Directory (AD), AAA Radius / ISE Enterprise Zone Levels 4-5 Remote Access Server Level 3 Site Operations Industrial Demilitarized Zone (IDMZ) FactoryTalk Client OS Hardening Level 2 Area Supervisory Control Controller Hardening, Encrypted Communications Controller Hardening Physical Security Procedural VLANs, Segmenting Domains of Trust Zone Firewall Controller Hardening, Electronic Level 1 - Controller VLANs Catalyst 3750 StackWise Switch Stack Enterprise WAN Cisco ASA 5500 Firewall (Active) Network Status and Monitoring Catalyst 6500/4500 Controller Controller Controllers, I/O, Drives I/O Physical or Virtualized Servers Patch Management Remote Gateway Services Application Mirror AV Server Firewall (Standby) HMI Level 0 - Process Plant Firewall: Inter-zone traffic segmentation ACLs, IPS and IDS VPN Services Portal and Remote Desktop Services proxy Network Device Resiliency Network Infrastructure Hardening Access Control Drive Physical Port Security MCC Soft Starter

36 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 36 Network Security Framework Unified Threat Management (UTM) Stratix 5900 The Stratix 5900 UTM security appliance is a ruggedized all-inclusive UTM with features such as firewall, secure routing, VPN (virtual private network), intrusion prevention, NAT (network address translation) and content filtering. Site-to-Site Connection, tunnels the Industrial Zone trusted network to a remote site over an untrusted network using a site-to-site VPN connection. Cell/Area Zone Firewall, to protect a Cell/Area Zone from the greater Industrial Zone. Physical features RJ-45 Gigabit WAN 4 10/100Base-Tx LAN ports Shock /Vibration & Extended Temperature DIN rail mount Network features ACL / Firewall DHCP QoS VLAN NAT Stratix 5900 Security Appliance

37 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 37 Network Security Framework Unified Threat Management (UTM) Enterprise-wide Business Systems Levels 4 & 5 Data Center Enterprise Zone Level IDMZ Plant-wide Site-wide Operation Systems Level 3 - Site Operations Physical or Virtualized Servers Industrial Zone FactoryTalk Application Servers & Services Platform Network Services e.g. DNS, AD, DHCP, AAA Remote Access Server (RAS) Call Manager Storage Array Site-to-Site Connection Stratix ) Site-to-Site Connection Stratix ) Cell/Area Zone Firewall Stratix ) OEM Integration Levels 0-2 Cell/Area Zones UTM UTM UTM Remote Site #1 Local Cell/Area Zone #1 Local OEM Skid / Machine #1

39 Remote Access Best Practice Application Requirements Remote connection into the Plant Indirect access Enterprise centric IT involvement Common IT Infrastructure Following emerging Industrial Automation and Control System security standards Defense-in-depth DMZ Strict Change Management Requirements Patch Management Application Mirror AV Server FactoryTalk Application Servers View Historian AssetCentre Transaction Manager FactoryTalk Services Platform Directory Security/Audit Data Servers Remote Engineer or Partner Enterprise Data Center Enterprise WAN Gbps Link Failover Detection Firewall (Standby) SSL VPN Catalyst 6500/4500 IPSEC VPN Enterprise Edge Firewall Firewall (Active) Catalyst 3750 StackWise Switch Stack VPN Client EtherNet/IP Enterprise Connected Engineer Internet Enterprise Zone Levels 4 and 5 Enterprise Zone Levels 4 and 5 Demilitarized Zone (DMZ) Demilitarized Zone (DMZ) Remote Access Server Remote Desktop Services RSLogix 5000 FactoryTalk View Studio Industrial Zone Site Operations and Control Level 3 Cell/Area Zones Levels 0 2 Fundamentals of Securing EtherNet/IP Networks Copyright 2012 Rockwell Automation, Inc. All rights reserved. Copyright 2014 Rockwell Automation, Inc. All Rights Reserved.

40 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. Funda Remote Desktop Gateway Network and Security Services Implementation Secure remote access for employees and trusted partners Meeting the security requirements of IT while enabling plant personnel to leverage trusted partners and shared, distributed company resources Common IT Infrastructure Following established Industrial Automation and Control System (IACS) security standards Defense-in-depth DMZ Enables remote asset management: monitoring, configuration and audit Helps simplify change management, version control, regulatory compliance and software license management Helps simplify remote client health management One size does not fit all need a scalable secure solutions Remote Desktop Protocol (RDP) over RCP/HTTPS Patch Management Application Mirror AV Server Remote Gateway Services FactoryTalk Application Servers View Historian AssetCentre Transaction Manager FactoryTalk Services Platform Directory Security/Audit Data Servers Remote Engineer or Partner Enterprise Data Center Enterprise WAN Gbps Link Failover Detection Firewall (Active) SSL VPN Catalyst 6500/4500 IPSEC VPN Generic VPN Client Enterprise Edge Firewall Catalyst 3750 StackWise Switch Stack Firewall (Standby) Enterprise Connected Engineer Internet Enterprise Zone Levels 4 and 5 Enterprise Zone Levels 4 and 5 Demilitarized Zone (DMZ) Remote Desktop Protocol (RDP) Demilitarized Zone (DMZ) Remote Access Server Remote Desktop Services RSLogix 5000 FactoryTalk View Studio Industrial Zone Site Operations and Control Level 3 EtherNet/IP Cell/Area Zones Levels 0 2

42 Putting it Together Secure Remote Access Good, Better, Best Scenario/Recognizing an Issue An employee, or 3 rd party, needs access to the control system from a network outside the production zone to assist in troubleshooting and maintenance Good Solution Stratix 5900 Better Solution Risk/Threat Good solution + expanded technical enforcement of the security perimeter-using FactoryTalk Security Best Solution Better solution + expanded technical enforcement of the security perimerter-though the implementation of Remote Access Gateways with in an Industrial DMZ Unauthorized remote access Worms and viruses Theft Sabotage $$$ Unplanned Downtime Quality Issues-Brand Image Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 47

43 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 48 Putting it Together Unintended Action Protection Good, Better, Best Scenario/Recognizing an Issue Contractor connecting to plant network to make change or integrate new line- causes downtime by introducing virus or unintentional configuration changes Good Solution Detect unauthorized changes with change detection audit value Use managed switches to segment the architecture with VLANs Scan contractor devices Better Solution Good solution + Enforce VLAN access with Access Control Lists Best Solution Better solution + limit access with FactoryTalk Security with Security Authority Binding enabled Risk/Threat Unauthorized actions by employees Unintended employee actions Lost $$$ Damage to product or assets

44 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 49 IACS Security Design and Implementation Considerations Align with Industrial Automation and Control System Security Standards DHS External Report # INL/EXT , NIST , ISO/IEC (Formerly ISA- 99) Implement Defense-in-Depth approach: no single product, methodology, nor technology fully secures IACS networks Establish an open dialog between Industrial Automation and IT groups Establish an industrial security policy Establish an IDMZ between the Enterprise and Industrial Zones Work with trusted partners knowledgeable in automation & security "Good enough" security now, is better than "perfect" security...never. (Tom West, Data General)

45 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 50 What Can You Do Now to Mitigate Risk? Practice these 8 Simple, Actionable Steps to enhance industrial reliability and security 1. Control who has network access 2. Employ firewalls and intrusion detection/prevention 3. Use Anti Virus Protection and patch your system 4. Manage & protect your passwords 5. Turn the processor key(s) to the Run Mode 6. Utilize features embedded in Rockwell Automation products today (example: FactoryTalk Security) 7. Develop a process to manage removable media 8. Block access ports (example: key connectors)

46 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 51 A new go-to resource for educational, technical and thought leadership information about industrial communications Standard Internet Protocol (IP) for Industrial Applications Coalition of like-minded companies

47 Copyright 2014 Rockwell Automation, Inc. All Rights Reserved. 52 Additional Material Cisco and Rockwell Automation Alliance Website Design Guides CPwE DIG Education Series Whitepapers Securing Manufacturing Computer and Controller Assets Production Software within Manufacturing Reference Architectures Achieving Secure Remote Access to Plant Floor Applications and Data