Holistic View of Industrial Control Cyber Security
|
|
|
- Roland Dean
- 10 years ago
- Views:
Transcription
1 Holistic View of Industrial Control Cyber Security A Deep Dive into Fundamentals of Industrial Control Cyber Security
2 Learning Goals o Understanding security implications involving industrial control systems and environments o Understanding design considerations for industrial control networks o Understanding differences between traditional IT networks vs. industrial networks o Understanding solutions and techniques to harden security of industrial networks
3 What is Industrial Control?
4 Industrial Control Defined o A system that controls a process o Industrial Control System traditionally a general term defining several types of control systems used in industrial production o Distributed Control System (DCS) o Supervisory Control and Data Acquisition System (SCADA) o Remote Terminal Units (RTU) o Programmable Logic Controllers (PLC)
5 Why learn about this topic? o Industrial controls are everywhere! o Utilities o Factories o Automobiles o Military o Data Centers o Appliances o Industrial controls are being networked like traditional IT networks.
6 Some industrial controls that might surprise you o Environmental controls in your data center o Missiles launched by the military o Assembly line controller in a factory o SCADA systems at utilities o Gasoline pumps at a convenience store
7 Distributed Control System Basic DCS Configuration
8 Distributed Control System Example of a DCS HMI Display
9 Distributed Control System Functional Levels of DCS Example
10 SCADA Example of a SCADA Network
11 SCADA Example of a Electric SCADA Network
12 SCADA Example of a SCADA HMI Display
13 Evolution 1 o Transition from mechanical switches or relays to Programmable Logic or Relay Logic
14 Programmable Logic Controllers (PLC) Example of a PLC Panel
15 Programmable Logic Controllers (PLC) Example of PLC Programming
16 PLC vs. RTU o RTUs are utilize to collect data over a wide geographic area as input to SCADA. o Such as with a network of electric substations o PLCs are utilized in a localize fashion to control a process. o Such as with a local area network on a factory floor
17 Industrial Control Evolution 2 o Transition from Standard Serial Communications (e.g. RS-232, RS-485, Async 2 wire) to higher performance non-ethernet Fieldbus communications (e.g. BACnet MS/TP, ModBus RTU, CAN, ProfiBus, InterBus, LonWorks, SERCOS).
18 T-shirt Question 1 owhat has been considered the first Industrial Control virus? owhat did it do?
19 Industrial Control Evolution 3 o Transition from Non-Ethernet Fieldbuses to Ethernet-based Communications (e.g. EtherCAT, Ethernet POWERLink).
20 Industrial Ethernet vs. Non-Ethernet Fieldbuses Advantages o Better performance o Greater bandwidth and larger data packages for communications with intelligent industrial devices o Faster real-time communications and synchronization for demanding control applications o Simple to integrate with networks that already exist in the business office environment
21 Industrial Ethernet vs. Non-Ethernet Fieldbuses Disadvantages o It is collision-based and not inherently deterministic and process controls demand real-time operation. o Universal acceptance of Ethernet tempts users to try to do too many things that could generate security issues. o Standard telephone-type connectors do not meet the physical demands of industrial equipment.
22 Impact of Industrial Internet o GE reported that enabling Internet-connected machines to communicate and operate automatically can bring substantial efficiency gains. o According to GE, the Industrial Internet will help eliminate hundreds of billions of dollars of wasted time and resources across critical industries. o The Industrial Internet has the potential to add $10 to 15 trillion U.S. dollars to the global GDP by 2030.
23 Rise of Industrial Internet o IMS Research predicts that in 2016, Ethernet will account for over 30 percent of all new nodes installed in industrial applications. o Ethernet TCP/IP was estimated to account for over one-third of new Ethernet nodes installed in o Wireless networking to grow 75% by 2017 compared to o Fieldbus protocols still have the high ground but Industrial Ethernet adoption is on the rise.
24 Evolution 4 o Transition from Ethernet-based Non-TCP/IP Communications to Ethernet-based TCP/IP Communications (e.g. BACnet/I, ModBus-TCP, EtherNet-IP, PROFINET-IO).
25 Cyber Security Implications
26 Cyber Security Implications o Cybersecurity failures have the potential to cause physical consequences. o Cybersecurity issues can manifest as process anomalies. o Cybersecurity is hard to manage. o Cybersecurity threats or issues can be complex.
27 Cybersecurity Implication Physical Consequences o Electric Power Blackouts o September 2007 cyber attack in Brazil o 2003 Northeast blackout o 1999 Southern Brazil blackout o 1965 Northeast blackout o 1979 Three Mile Island Nuclear Plant Accident o 2000 Maroochy Shire cyber event o 2007 Aurora Generator Test o 2009 Stuxnet o 2010 San Bruno natural gas pipeline explosion
28 Aurora Generator Test
29 Implications Process Anomalies o Actual cyber security issue vs. real process problem o Can be difficult to distinguish a real cyber security issue from a process anomaly. o Inadequate cyber security training for operators could lead to an attack not being recognized.
30 Implications Security Management Difficulties o Introduced latency and jitter o Measurement of time for packets to travel between nodes. o Variation in time between packets arriving to be process. o Difference in managing IT vs. OT
31 Implications Complexities o Non-typical network protocols o Commands that cannot be blocked due to safety or production issues. o Attackers using valid communications in invalid ways.
32 IT Cyber Security vs. OT Cyber Security
33 IT Cyber Security vs. OT Cyber Security - Performance Requirements Source: Derived from the NIST Standard
34 IT Cyber Security vs. OT Cyber Security - Availability Requirements Source: Derived from the NIST Standard
35 IT Cyber Security vs. OT Cyber Security - Risk Management Requirements Source: Derived from the NIST Standard
36 IT Cyber Security vs. OT Cyber Security - Change Management Requirements Source: Derived from the NIST Standard
37 IT Cyber Security vs. OT Cyber Security - Unintended Consequences Requirements Source: Derived from the NIST Standard
38 Survey of Specialized Communications Protocols
39 Modbus o Open protocol standard o Moves raw bits or words without placing many restrictions on vendors. o TCP/IP packet may look perfectly normal but the Modbus frame could crafted to carry malicious code.
40 DNP3 (Distributed Network Protocol) o Open Standard o Designed to be reliable but not secure. o Header may look perfectly normal but the data payload could crafted to carry malicious code. o No authentication mechanism in basic DNP3. o Secure DNP3
41 OPC (Open Platform Communications o Based on the OLE, COM, and DCOM technologies developed by Microsoft. o Any vulnerabilities in these technologies is carried into this protocol. o OPC is firewall unfriendly because OPC servers dynamically assign TCP ports. o DCOM and RPC are extremely complicated protocols that can be translated into attack surfaces for malicious actors. o OPC is complicated to setup so some vendors leave exposures in their products.
42 Cyber Security Problems and Issues
43 Cyber Security Problems and Issues - TCP/IP Stack and Industrial Protocols o Problems exist due to original design and purpose for Internet. o Poor software design o Fragility caused by deviation from RFC o Internet Protocol (IP version 4) (RFC 791) o User Datagram Protocol (UDP) (RFC 768) o Transmission Control Protocol (TCP) (RFC 793) o Address Resolution Protocol (ARP) (RFC 826) o Internet Control Messaging Protocol (ICMP) (RFC 792) o Internet Group Management Protocol (IGMP) (RFC 1112 & 2236) o IEEE (Ethernet) as defined in RFC 894 o Protocol Complexity o o ModBus TCP adds additional fields to standard TCP (Function Codes) Session Manipulation
44 Cyber Security Problems and Issues - Lack of Strong Authentication o Risk of compromise o Spoofing o Brute Force Attacks o Session Hijacking
45 Cyber Security Problems and Issues - Lack of Strong Authorization Practices o Malicious actors could gain access or perform a function that they are not entitled to perform.
46 Cyber Security Problems and Issues - Lack of Strong Encryption Practices o Commands and addresses passed in clear text; which can be captured and spoofed or manipulated. o Some encryption mandates are making it into regulations in some industrial control using industries.
47 Cyber Security Problems and Issues - Programmability o ICS devices are meant to be programmable; which makes them inherently vulnerable. o A whole lot of Fuzzing going on.
48 Cyber Security Problems and Issues - Lack of Message Checksum o Ability to spoofed commands is easier since the checksum is generated at the Transmission Layer and not the Application Layer.
49 Cyber Security Problems and Issues - Accessibility o Some protocols are meant to be used for Wide Area networks making them highly accessible and susceptible to many kinds of attacks.
50 Cyber Security Controls
51 Cyber Security Controls - Firewall o A firewall can become a sieve. o Not a catch all, be all security control but still a necessity. o Protocol recognition. o Don t forget a secure default rule; Deny All.
52 Cyber Security Controls - Intrusion Detection and Prevention o Intrusion Prevention vs. Intrusion Detection o Why is IPS a necessity? o Behavior recognition
53 Cyber Security Controls - ICS Honeypots o Sets a trap o Decoy o ICS Capable o SCADA HoneyNet Project o
54 Cyber Security Controls - Anti-Malware o If you cannot install host-based anti-malware software on any particular ICS system, implement network-based anti-malware. o Implement and configure host-based firewalls; if possible.
55 Cyber Security Controls - Security Information and Event Management o Log, Log, Log! o Real-Time or Near Real-Time Alerts
56 Cyber Security Recommendations
57 Industrial Control Network Cyber Security Recommendations o Defend against the unknown o Advanced Persistent Threats (APTs) o Advanced Evasion Techniques (AETs) o Alternative threat detection or prevention o Situational Awareness o Behavior Analysis and Detection o Practice Defense in Depth o Patch, Patch, Patch o Whitelisting o Collect and analyze logs
58 Industrial Control Network Cyber Security Recommendations o Avoid misconceptions o Avoid the Air Gap Myth o We have a firewall! o We re just a small site, we re not a target
59 Industrial Control Network Cyber Security Recommendations o Utilize Egress Filtering o Change Default Accounts and Passwords o Check your IP addresses with Shodan
60 Shodan o An industrial control system and network search engine. o
61 Shodan
62 Netsecuris o A leading Managed Security Service Provider specializing in protecting Industrial Control, Financial Services, Healthcare, and Government network environments. o Contact Information o Leonard Jacobs, MBA, CISSP o President/CEO o [email protected] o
63 Questions and Answers Thank you
Keeping the Lights On
Keeping the Lights On Fundamentals of Industrial Control Risks, Vulnerabilities, Mitigating Controls, and Regulatory Compliance Learning Goals o Understanding definition of industrial controls o Understanding
How to Choose the Right Industrial Firewall: The Top 7 Considerations. Li Peng Product Manager
How to Choose the Right Industrial Firewall: The Top 7 Considerations Li Peng Product Manager The right industrial firewall can strengthen the safety and reliability of control systems Central to industrial
Network Security Infrastructure Testing
Network Security Infrastructure Testing Version 1.2 October 12, 2005 Prepared by: Sandia National Laboratories Center for SCADA Security Project Lead Ray Parks Technical Lead Jason Hills Technical Support
Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative
Roger W. Kuhn, Jr. Advisory Director Education Fellow Cyber Security Forum Initiative November 2014 Disclaimer Current SCADA Vulnerability Factors Industrial Control Systems 101 Proposed Countermeasures
The Advantages of an Integrated Factory Acceptance Test in an ICS Environment
The Advantages of an Integrated Factory Acceptance Test in an ICS Environment By Jerome Farquharson, Critical Infrastructure and Compliance Practice Manager, and Alexandra Wiesehan, Cyber Security Analyst,
Security Testing in Critical Systems
Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base
Securing Modern Substations With an Open Standard Network Security Solution. Kevin Leech Schweitzer Engineering Laboratories, Inc.
Securing Modern Substations With an Open Standard Network Security Solution Kevin Leech Schweitzer Engineering Laboratories, Inc. Copyright SEL 2009 What Makes a Cyberattack Unique? While the resources
SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005
SCADA System Security ECE 478 Network Security Oregon State University March 7, 2005 David Goeke Hai Nguyen Abstract Modern public infrastructure systems
Defending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
From Fieldbus to toreal Time Ethernet
Process Automation From Fieldbus to toreal Time Ethernet Safety, reliability IEC61158-2 as the physical layer too slow for Ethernet/IP frames Unsafe cables towards wireless solutions Factory automation
OPC & Security Agenda
OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information
An Introduction to SCADA-ICS System Security. Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015
An Introduction to SCADA-ICS System Security Document Number IG-101 Document Issue 0.1 Issue date 03 February 2015 Overview Supervisory Control And Data Acquisition (SCADA) for Industrial Control Systems
SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP
SCADA and Security Are they Mutually Exclusive? Terry M. Draper, PE, PMP Today s Topics SCADA Overview SCADA System vs. IT Systems Risk Factors Threats Potential Vulnerabilities Specific Considerations
Innovative Defense Strategies for Securing SCADA & Control Systems
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: [email protected] Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet
IT Security and OT Security. Understanding the Challenges
IT Security and OT Security Understanding the Challenges Security Maturity Evolution in Industrial Control 1950s 5/4/2012 # 2 Technology Sophistication Security Maturity Evolution in Industrial Control
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment
Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment Introduction 1 Distributed SCADA security 2 Radiflow Defense-in-Depth tool-set 4 Network Access
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
Securing EtherNet/IP Using DPI Firewall Technology
Securing EtherNet/IP Using DPI Firewall Technology www.odva.org Technical Track About Us Erik Schweigert Leads device firmware development at Tofino Security BSc in Computer Science from VIU Michael Thomas
SCADA Systems. Make the most of your energy. March 2012 / White paper. by Schneider Electric Telemetry & Remote SCADA Solutions
SCADA Systems March 2012 / White paper by Schneider Electric Telemetry & Remote SCADA Solutions Make the most of your energy Summary Executive Summary... p 2 Introduction... p 3 Field Instrumentation...
20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
Generic term for using the Ethernet standard in automation / industrial applications
Seite 24 Industrial Ethernet Generic term for using the Ethernet standard in automation / industrial applications Specific Quality of Service requirements Real-time Cycle time (e.g. < 1 ms for motion control
How To Protect Your Firewall From Attack From A Malicious Computer Or Network Device
Ch.9 Firewalls and Intrusion Prevention Systems Firewalls: effective means of protecting LANs Internet connectivity is essential for every organization and individuals introduces threats from the Internet
ISACA rudens konference
ISACA rudens konference 8 Novembris 2012 Procesa kontroles sistēmu drošība Andris Lauciņš Ievads Kāpēc tēma par procesa kontroles sistēmām? Statistics on incidents Reality of the environment of industrial
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute
Using Tofino to control the spread of Stuxnet Malware
technical datasheet Application Note Using Tofino to control the spread of Stuxnet Malware This application note describes how to use the Tofino Industrial Security Solution to prevent the spread of the
DNP Serial SCADA to SCADA Over IP: Standards, Regulations Security and Best Practices
DNP SCADA to SCADA Over : Standards, Regulations Security and Best Practices Earl Emerson, Director Systems Engineering RAD Data Communications 2014 Utilities Telecom Council of Canada Motivations for
Secure Networks for Process Control
Secure Networks for Process Control Leveraging a Simple Yet Effective Policy Framework to Secure the Modern Process Control Network An Enterasys Networks White Paper There is nothing more important than
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
Why Leaks Matter. Leak Detection and Mitigation as a Critical Element of Network Assurance. A publication of Lumeta Corporation www.lumeta.
Why Leaks Matter Leak Detection and Mitigation as a Critical Element of Network Assurance A publication of Lumeta Corporation www.lumeta.com Table of Contents Executive Summary Defining a Leak How Leaks
Benefits of Network Level Security at the RTU Level. By: Kevin Finnan and Philippe Willems
By: Kevin Finnan and Philippe Willems Introduction New security capabilities at the remote terminal unit (RTU) level are substantially easing implementation of cyber security measures in SCADA systems.
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Dr. György Kálmán [email protected]
COMMUNICATION AND SECURITY IN CURRENT INDUSTRIAL AUTOMATION Dr. György Kálmán [email protected] Agenda Connected systems historical overview Current trends, concepts, pre and post Stuxnet Risks and threats
PLCs and SCADA Systems
Hands-On Programmable Logic Controllers and Supervisory Control / Data Acquisition Course Description This extensive course covers the essentials of SCADA and PLC systems, which are often used in close
Missing the Obvious: Network Security Monitoring for ICS
Missing the Obvious: Network Security Monitoring for ICS If ICS are so vulnerable, why haven t we seen more attacks? We aren t looking! Two Key Reasons Intent Visibility Intent Why are targeted attacks
New Era in Cyber Security. Technology Development
New Era in Cyber New Era in Cyber Security Security Technology Technology Development Development Combining the Power of the Oil and Gas Industry, DHS, and the Vendor Community to Combat Cyber Security
What happens when you use nmap or a fuzzer on an ICS?
NSM 101 for ICS About me Chris Sistrunk, PE Electrical Engineer Sr. ICS Security Consultant Control system security assessments ICS Village (DEF CON & RSA Conference) Entergy (11+ years) SCADA Engineer
How Secure is Your SCADA System?
How Secure is Your SCADA System? Charles Drobny GlobaLogix, Inc. Houston, TX, USA Our Industry is a Target 40% of cyber attacks on Critical Infrastructure targets are aimed at the Energy Industry The potential
Utility Telecom Forum. Robert Sill, CEO & President Aegis Technologies February 4, 2008
Utility Telecom Forum Robert Sill, CEO & President Aegis Technologies February 4, 2008 1 Agenda Asked to describe his job, Mike Selves, director of Emergency Management and Homeland Security in Johnson
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
Using ODVA Common Industrial Protocol to Enhance Performance White Paper
Monitor & Control Multiple Groups Using ODVA Common Industrial Protocol to Enhance Performance White Paper Monitor & Control Multiple Groups Using ODVA Common Industrial Protocol to Enhance Performance
Wireless Communications for SCADA Systems Utilizing Mobile Nodes
, pp. 1-8 http://dx.doi.org/10.14257/ijsh.2013.7.5.01 Wireless Communications for SCADA Systems Utilizing Mobile Nodes Minkyu Choi Security Engineering Research Support Center, Daejon, Republic of Korea
Industrial Control System Cyber Situational Awareness. Robert M. Lee* June 10 th, 2015
Industrial Control System Cyber Situational Awareness Robert M. Lee* June 10 th, 2015 Executive Summary Cyber situational awareness is the concept of understanding and visualizing the networked environment
Waterfall for NERC-CIP Compliance
Waterfall for NERC-CIP Compliance Using Waterfall s Unidirectional Security Solution to Achieve True Security & NERC-CIP Compliance Date: Jul. 2009 The material in this document is proprietary to Waterfall
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and
On the use of Honeypots for Detecting Cyber Attacks on Industrial Control Networks
CIBSI 2013 Panama City, Panama, October 30 th, 2013 On the use of Honeypots for Detecting Cyber Attacks on Industrial Control Networks Paulo Simões, Tiago Cruz, Jorge Gomes, Edmundo Monteiro [email protected]
How To Protect Power System From Attack From A Power System (Power System) From A Fault Control System (Generator) From An Attack From An External Power System
Network Security in Power Systems Maja Knezev and Zarko Djekic Introduction Protection control Outline EMS, SCADA, RTU, PLC Attacks using power system Vulnerabilities Solution Conclusion Introduction Generator
i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors
March 25-27, 2014 Steven A. Kunsman i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors ABB Inc. March 26, 2015 Slide 1 Cyber Security for Substation
The SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices
The SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices Kyle Wilhoit Sr. Threat Researcher Trend Micro 1 Glossary HMI: Human Machine Interface IED: Intelligent Electronic Device SCADA:
Proxy Server, Network Address Translator, Firewall. Proxy Server
Proxy Server, Network Address Translator, Firewall 1 Proxy Server 2 1 Introduction What is a proxy server? Acts on behalf of other clients, and presents requests from other clients to a server. Acts as
TNC is an open architecture for network access control. If you re not sure what NAC is, we ll cover that in a second. For now, the main point here is
1 2 This slide shows the areas where TCG is developing standards. Each image corresponds to a TCG work group. In order to understand Trusted Network Connect, it s best to look at it in context with the
NERC CIP Version 5 and the PI System
Industry: Transmission/Distribution/Smarts Presented by NERC CIP Version 5 and the PI System Bryan Owen PE OSisoft Cyber Security Manager Agenda Update on OSIsoft Cyber Initiatives War Story CIP Version
NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER
NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER NEW GENERATION PROGRAMMABLE AUTOMATION CONTROLLER Understanding what a PAC is starts from the understanding of PLC. A PLC is a Programmable Logic while
Critical Infrastructure & Supervisory Control and Data Acquisition (SCADA) CYBER PROTECTION
Critical Infrastructure & Supervisory Control and Data Acquisition (SCADA) CYBER PROTECTION ALBERTO AL HERNANDEZ, ARMY RESERVE OFFICER, SOFTWARE ENGINEER PH.D. CANDIDATE, SYSTEMS ENGINEERING PRESENTATION
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
Solution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
Cloak and Secure Your Critical Infrastructure, ICS and SCADA Systems
Cloak and Secure Your Critical Infrastructure, ICS and SCADA Systems Building Security into Your Industrial Internet Phillip Allison Tempered Networks Discussion topics Threats to network security TCP/IP
Vulnerability Testing of Industrial Network Devices
Vulnerability Testing of Industrial Network Devices Matthew Franz ([email protected]) Critical Infrastructure Assurance Group (CIAG) http://www.cisco.com/go/ciag 2003, Cisco Systems, Inc. All rights reserved.
SEMANTIC SECURITY ANALYSIS OF SCADA NETWORKS TO DETECT MALICIOUS CONTROL COMMANDS IN POWER GRID
SEMANTIC SECURITY ANALYSIS OF SCADA NETWORKS TO DETECT MALICIOUS CONTROL COMMANDS IN POWER GRID ZBIGNIEW KALBARCZYK EMAIL: [email protected] UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN JANUARY 2014
Basic Vulnerability Issues for SIP Security
Introduction Basic Vulnerability Issues for SIP Security By Mark Collier Chief Technology Officer SecureLogix Corporation [email protected] The Session Initiation Protocol (SIP) is the future
Host/Platform Security. Module 11
Host/Platform Security Module 11 Why is Host/Platform Security Necessary? Firewalls are not enough All access paths to host may not be firewall protected Permitted traffic may be malicious Outbound traffic
NETWORK SECURITY (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 NETWORK SECURITY (W/LAB) Course Syllabus Course Number: NTWK-0008 OHLAP Credit: Yes OCAS Code: 8131 Course Length: 130 Hours Career Cluster: Information
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
Protocols and Network Security in ICS Infrastructures 2
Protocols and Network Security in ICS Infrastructures 2 Authors Miguel Herrero Collantes Antonio López Padilla May 2015 This publication is the property of INCIBE (the Spanish National Institute for Cyber-security)
A Proposed Integration of Hierarchical Mobile IP based Networks in SCADA Systems
, pp. 49-56 http://dx.doi.org/10.14257/ijsh.2013.7.5.05 A Proposed Integration of Hierarchical Mobile IP based Networks in SCADA Systems Minkyu Choi 1 and Ronnie D. Caytiles 2 1 Security Engineering Research
CLOUD BASED SCADA. Removing Implementation and Deployment Barriers. Liam Kearns Open Systems International, Inc.
CLOUD BASED SCADA Removing Implementation and Deployment Barriers Liam Kearns Open Systems International, Inc. SCADA Traditional definition and application. SCADA DEFINITION Definition Supervisory Control
The State-of-the-State of Control System Cyber Security
The State-of-the-State of Control System Cyber Security Prepared for HTCIA September 19, 2012 Joe Weiss PE, CISM, CRISC, ISA Fellow (408) 253-7934 [email protected] Summary Control systems are
Cyber Security for SCADA/ICS Networks
Cyber Security for SCADA/ICS Networks GANESH NARAYANAN HEAD-CONSULTING CYBER SECURITY SERVICES www.thalesgroup.com Increasing Cyber Attacks on SCADA / ICS Systems 2 What is SCADA Supervisory Control And
13 Ways Through A Firewall What you don t know will hurt you
Scientech 2013 Symposium: Managing Fleet Assets and Performance 13 Ways Through A Firewall What you don t know will hurt you Andrew Ginter VP Industrial Security Waterfall Security Solutions andrew. ginter
INTRUSION DETECTION SYSTEMS and Network Security
INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS
EVALUATING INDUSTRIAL ETHERNET
EVALUATING INDUSTRIAL ETHERNET WHAT IS STANDARD? Written by: Shuo Zhang Networks Marketing Rockwell Automation As industrial automation systems evolve, industrial Ethernet is becoming increasingly popular
Industrial Communication Whitepaper. Principles of EtherNet/IP Communication
Industrial Communication Whitepaper Principles of EtherNet/IP Communication 1 Contents Introduction...3 Producer/Consumer Model...4 EtherNet/IP Messaging Types...7 Real Time Data Exchanges...9 Typical
Vulnerabilities in SCADA and Critical Infrastructure Systems
International Journal of Future Generation Communication and Networking 99 Vulnerabilities in SCADA and Critical Infrastructure Systems Rosslin John Robles 1, Min-kyu Choi 1, Eun-suk Cho 1, Seok-soo Kim
13 Ways Through A Firewall
Industrial Control Systems Joint Working Group 2012 Fall Meeting 13 Ways Through A Firewall Andrew Ginter Director of Industrial Security Waterfall Security Solutions Proprietary Information -- Copyright
Cyber Risk Mitigation via Security Monitoring. Enhanced by Managed Services
Cyber Risk Mitigation via Security Monitoring Enhanced by Managed Services Focus: Up to But Not Including Corporate and 3 rd Party Networks Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance
ModbusFW Deep Packet Inspection for Industrial Ethernet
ModbusFW Deep Packet Inspection for Industrial Ethernet Matthew Franz ([email protected]) Venkat Pothamsetty ([email protected]) Critical Infrastructure Assurance Group (CIAG) Cisco Systems, Inc. http://www.cisco.com/go/ciag/
Improving SCADA Control Systems Security with Software Vulnerability Analysis
Improving SCADA Control Systems Security with Software Vulnerability Analysis GIOVANNI CAGALABAN, TAIHOON KIM, SEOKSOO KIM Department of Multimedia Hannam University Ojeong-dong, Daedeok-gu, Daejeon 306-791
CompTIA Network+ (Exam N10-005)
CompTIA Network+ (Exam N10-005) Length: Location: Language(s): Audience(s): Level: Vendor: Type: Delivery Method: 5 Days 182, Broadway, Newmarket, Auckland English, Entry Level IT Professionals Intermediate
patriotscada Distributed Firewall for SCADA and Industrial Networks
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.303.DATA Fax: 800.864.6249 Email: [email protected] patriotscada Distributed Firewall for SCADA and Industrial Networks What Makes This
Security for. Industrial. Automation. Considering the PROFINET Security Guideline
Security for Industrial Considering the PROFINET Security Guideline Automation Industrial IT Security 2 Plant Security Physical Security Physical access to facilities and equipment Policies & Procedures
Guideline on Firewall
CMSGu2014-02 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Firewall National Computer Board Mauritius Version 1.0 June
Process Control and Automation using Modbus Protocol
Process Control and Automation using Modbus Protocol Modbus is the fundamental network protocol used in most industrial applications today. It is universal, open and an easy to use protocol. Modbus has
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
Data Security Concerns for the Electric Grid
Data Security Concerns for the Electric Grid Data Security Concerns for the Electric Grid The U.S. power grid infrastructure is a vital component of modern society and commerce, and represents a critical
Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems. Enzo M. Tieghi etieghi@visionautomation.
Integrating Electronic Security into the Control Systems Environment: differences IT vs. Control Systems Enzo M. Tieghi [email protected] Security IT & Control System Security: where are we?
FOXBORO. I/A Series SOFTWARE Product Specifications. I/A Series Intelligent SCADA SCADA Platform PSS 21S-2M1 B3 OVERVIEW
I/A Series SOFTWARE Product Specifications Logo I/A Series Intelligent SCADA SCADA Platform PSS 21S-2M1 B3 The I/A Series Intelligent SCADA Platform takes the traditional SCADA Master Station to a new
Cyber Security Design Methodology for Nuclear Power Control & Protection Systems. By Majed Al Breiki Senior Instrumentation & Control Manager (ENEC)
Cyber Security Design Methodology for Nuclear Power Control & Protection Systems By Majed Al Breiki Senior Instrumentation & Control Manager (ENEC) 1. INTRODUCTION In today s world, cyber security is one
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 40 Firewalls and Intrusion
Cyber Security Implications of SIS Integration with Control Networks
Cyber Security Implications of SIS Integration with Control Networks The LOGIIC SIS Project Standards Certification Education & Training Publishing Conferences & Exhibits Presenter Zach Tudor is a Program
Networking Basics and Network Security
Why do we need networks? Networking Basics and Network Security Shared Data and Functions Availability Performance, Load Balancing What is needed for a network? ISO 7-Layer Model Physical Connection Wired:
Industrial Security Solutions
Industrial Security Solutions Building More Secure Environments From Enterprise to End Devices You have assets to protect. Control systems, networks and software can all help defend against security threats
This is a preview - click here to buy the full publication
TECHNICAL REPORT IEC/TR 62443-3-1 Edition 1.0 2009-07 colour inside Industrial communication networks Network and system security Part 3 1: Security technologies for industrial automation and control systems
Lessons Learned from AMI Pioneers Follow the Path to Success
welcome Lessons Learned from AMI Pioneers Follow the Path to Success Joe Cummins, PCIP UTC TELECOM May 2010 394 Simcoe Street South Oshawa, ON L1H 4J4 (905) 404-2009 2 outline security risks in smart grid
Network Access Security. Lesson 10
Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
Firewalls. Network Security. Firewalls Defined. Firewalls
Network Security Firewalls Firewalls Types of Firewalls Screening router firewalls Computer-based firewalls Firewall appliances Host firewalls (firewalls on clients and servers) Inspection Methods Firewall