Industrie Security 0.1?

Transcription

1 Industrie Security 0.1? Zur Notwendigkeit von Security Testing Prof. Dr. Hartmut Pohl, Jochen Klein

2 Information Security (INFOSEC) Informationssicherheit Zustand eines IT-Systems, mit folgenden Sachzielen: Confidentiality: Informationen nur für Berechtigte zugreifbar Integrity: Genauigkeit und Vollständigkeit, Verarbeitungsmethoden geschützt Availability: Nutzung von Daten und Anwendungen durch Berechtigte Authenticity: Daten stammen vom behaupteten Berechtigten ISO/IEC 270xx

3 Natanz Uranium Enrichment Facility Iranian President Mahmoud Ahmadinejad visits the Natanz uranium enrichment facilities, where a closed computer network was infected by malware introduced via a small flash drive softscheck

4 Professional Attacks Example: Stuxnet and Derivatives 100 % Stuxnet 2006 Code Red 2006 Flame 2007 Roter Oktober 2007 Duqu 2009 Mahdi 2011 Gauss 2012 Disttrack, Shamoon 2012 miniflame 2012 Narilam 2012 Havex 2014 Stealth Storm Worm % Viruses, Worms, Spam, Phishing, Spyware, Adware, (Botnets) Skript Kiddies, Students, Everybody Targeted

5 Attack Surface, Attack Paths Internet Successful Attacks essential exploiting Vulnerabilities: No Vulnerability no Attack! Attack Paths Attack Surface Organisation Information System Permitted Port Undetected, unpublished, unpatched Vulnerabilities Firewall, Intrusion Detection, Applications, Servers, SQL, IIS, Mails, FTP, CRM Patched Vulnerabilities Anti-Virus Assets - Data Encryption, Keys 5 idefense Vupen WabiSabiLabi ZDI

6 Vulnerability Lifecycle Black Risk Vulnerability-free Phase seemingly! Grey Risk Vulnerability discovered, used White Risk Vulnerability fully disclosed: Manufacturer Product Shipment Vulnerability discovered Attack: Exploit developed Vulnerability published Exploit published Patch published 1 Zero-Day-Vulnerability - nobody knows 2 Manufacturer knows unpublished 3 Manufacturer publishes Vulnerability 4 Manufacturer patches

7 Vulnerability Lifecycle Black Risk Vulnerability-free Phase seemingly! Grey Risk Vulnerability discovered, used White Risk Vulnerability fully disclosed: Manufacturer Zero Day Product Shipment Vulnerability discovered Attack: Exploit developed Vulnerability published Exploit published Patch published 1 Zero-Day-Vulnerability - nobody knows 2 Manufacturer knows unpublished 3 Manufacturer publishes Vulnerability 4 Manufacturer patches

8 Indispensible Security Measures Grundschutz ISO Family Access Control, Passwords Anti-Virus Scanner Firewall Encryption: Key Generation, Key Management IDS/IPS

9 Software Security Tested Kommerzielle Software Webapplications, ERM, CRM, SCM, ERP, E-Business, CIM, Apps für mobile Devices Sicherheitssoftware Firewalls, Router, Gateways, Verschlüsselung, Intrusion Detection Industrial Control Systems (PLC/SPS) Embedded Systems Smart Grid / Smart Meter Gateway Security, Energiemanagement und Smart Home

10 Security Testing Process ISO 27034: Identifying Zero-Day-Vulnerabilities Security Analysis: Requirements Architecture Analysis Threat Modeling Attack Paths, Attack Surface Static Source Code Analysis Conformity Testing, Covert Functions Explorative Testing: Manual Auditing Penetration Testing Dynamic Analysis: Fuzzing Exploits, Patches Secure Design Secure Implementation Requirements Product Security Design Implementation Release Verification Presentation Reports ISO 27034

11 Threat Modeling: Data Flow Diagram Advanced Metering Infrastructure (AMI) External-powered Meter Battery-powered Meter Electricity Gas Water Heat Metered Value Metered Value SMGW Admin Trusted Time Service Time Synchronization Firmware Download Measured Values - Tariffs Network Status Wake-up Call... LMN Smart Meter Gateway Customer Information Security Module HAN Authorized External Entity CLS Data Verteilnetzbetreiber (VNB) Messstellenbetreiber (MSB) Messdienstleister (MDL) Lieferant (LF) WAN Prosumer Visual Display Service Technician Controllable Local System (CLS)

12 Principle Fuzzing Process Fuzzer Target Expert Advice: Identification, Rating Report Patch, Fix

13 Full Fuzzing Process Test System Target System Identification Input Interfaces Code Coverage Proprietary Developed Fuzzer Proprietary Developed Attack Strings Fuzzer Target 2 Encryption I/A DB Target Processor ARM, AMD, IBM, Intel, Nvidia, PLC, Power PC, Qualcomm, Sun, Snapdragon, Target OS Android, CardOS, JCOB, Nucleus, OS X, QNX, Unix, VxWorks, Windows, S7, Monitor-Client Monitor/Debugger Expert Activities Expert Advice: Identification, Rating Proof of Concept Exploits Report Patch, Fix

14

15 Security Testing Achievements Method No. Vulnerabilities No. Tools used Architecture Analysis: Threat Modeling 112 (986) 1 Static Source Code Analysis Penetration Testing 0 (76) 4 + Dynamic Analysis: Fuzzing Sum 156 > 13

16 Indispensible Security Measures Security Level 0: Grundschutz ISO Family Access Control, Passwords Anti-Virus Scanner Firewall Encryption: Key Generation, Key Management IDS/IPS

17 Security Success 5 effective Methods: Security Requirements Threat Modeling Static Source Code Analysis Penetration Testing Dynamic Analysis: Fuzzing Many Tools of > 300 Every Software and Firmware (Hardware) All Processors & Operating Systems Every Software Development Process Common Criteria / Protection Profiles

18 Live Presentation Identifying Zero-Day-Vulnerabilities in PLC

19 Industrie Security 0.1? Zur Notwendigkeit von Security Testing Prof. Dr. Hartmut Pohl [email protected] + 49 (2241) softscheck GmbH Köln Büro: Bonnerstr Sankt Augustin www. softscheck.com